2026-08-03
Top stories
- Arch Linux disables AUR package adoption and then all pushes after a wave of malicious takeovers of orphaned packages Arch Linux disabled AUR adoption on 2026-07-30 after malicious takeovers of roughly 200 orphaned packages with credential-stealing build steps.
- JFrog audits 55 advisories from one GitHub account and finds 54 fabricated, after NVD rated six SQLite CVEs critical or high JFrog found 54 of 55 advisories from one GitHub account fabricated, including six SQLite CVEs that NVD had rated critical or high.
- Unit 42 recovers a threat actor's environment showing an unattended DeepSeek-driven agent chain that compromised no targets, with the three confirmed compromises coming from manual attacks Unit 42 recovered a threat actor's unattended DeepSeek-driven agent that autonomously chained three CVE exploits but compromised no systems.
AI
ML research
- TokTier measures tokenization reaching up to 64 percent of time to first token for coding agents at a 94.1 percent prompt-cache hit rate Tokenization consumes up to 64 percent of time to first token for coding agents at high cache hit rates, dropping 16 to 34 percent under vLLM.
- A Locksmith Loop paper reports 91.90 percent branch coverage on one internal COBOL program when validating agent-migrated code against the original with a deterministic parity oracle Locksmith Loop validates agent-migrated COBOL against the original with a deterministic parity oracle achieving 91.9 percent branch coverage.
Agentic coding
- Anthropic's Claude Code lead says a single agent run rewriting the Electron Claude desktop app in Swift has been going about 15 days and is still running Anthropic's Claude Code lead reports a single agent run rewriting the Electron Claude desktop app in Swift has been running for 15 days.
- David Crawshaw argues agent-driven personalization replaces plugin systems, and names Claude Code's closed source as the wall Crawshaw argues that agent-driven personalization of developer tools replaces plugins, but Claude Code's closed source blocks that approach.
Security
Developer tools
Languages and runtimes
- Rust accepts a 2026-2027 project goal for Move and Forget traits, with the stated aim of deprecating Pin rather than extending it Rust accepted a 2026-2027 goal to add Move and Forget traits with the eventual aim of deprecating Pin entirely rather than extending it.
- Octane compiles React's hooks model ahead of time with no virtual DOM, and its own benchmark grid puts Vue Vapor ahead on the geometric mean Octane compiles React hooks ahead of time with no virtual DOM, using a per-component OctaneCompat island to migrate existing React applications.