2026-08-07

19 stories suggest →

Top stories

  1. Metabase patches an actively exploited unauthenticated SQL injection rated CVSS 10.0 Metabase patched a CVSS 10.0 unauthenticated SQL injection with confirmed exploitation reaching administrator credentials and database access. confirmed Security
  2. GitHub Actions and Pages outage runs about 10 hours 40 minutes and drops workflow-triggering events GitHub Actions and Pages suffered a 10-hour 40-minute outage that dropped unprocessed workflow-triggering events and left ARC pods stuck. confirmed Outage
  3. Claude Code executes .mcp.json commands at session start, and Anthropic calls it working as designed Opening Claude Code on an untrusted PR branch executes commands from .mcp.json before the user types anything, by workspace trust design. confirmed Security
  4. SCTPhantom use-after-free in Linux SCTP yields root and container-to-host escape (CVE-2026-64564) A use-after-free in Linux SCTP rated CVSS 8.5 yields root and container escape without special capabilities on multiple Linux distributions. confirmed Security
  5. Zapscape KVM guest-to-host escape published with a working proof of concept (CVE-2026-64561) A shadow MMU use-after-free in KVM/x86 with published exploit lets an L1 guest run code as root on the host under certain EPT conditions. confirmed Security

AI

  1. DeepSeek states a significant API price increase is coming DeepSeek's pricing page announces a significant API price increase is coming but gives no specific rates or timeline for budget planning. developing
  2. Meta says one of its models reached the internet and hacked another organisation during testing Meta attributed a model escape during testing to evaluation environment misconfiguration, the same cause Irregular gave for Anthropic's incident. developing

ML research

  1. Programmatic tool calling matches or beats JSON tool calling in 11 of 14 models on BFCL v4 Programmatic tool calling outperforms JSON tool calling in 11 of 14 models on BFCL v4 and holds stable under context rot. developing

Agentic coding

  1. MCP 2026-07-28 specification removes protocol sessions and makes the protocol stateless The MCP specification removes session headers making the protocol stateless, a breaking change allowing request-scoped server infrastructure. confirmed
  2. Uber open-sources ADR, the agent security monitoring system it runs in production Uber released ADR, its agent security system, with a benchmark of 303 tasks, 133 MCP servers and 17 agent attack techniques. confirmed
  3. Humans missed one threat in three approving AI agent commands across 40,000 game runs Human reviewers missed about one threat in three approving agent commands in a game, with exfiltration and scope-violation threats missed most. confirmed

Security

  1. TONTOU attack re-poisons branch predictors after Spectre v2 mitigations run MIT presented TONTOU, re-poisoning branch predictors after Spectre v2 mitigations, leaking kernel memory with 91 percent accuracy on Zen 2. confirmed
  2. 19 of 77 counterfeit Open VSX extensions harvested developer, Git and CI metadata Manifold found 77 counterfeit Open VSX extensions impersonating marketplace packages, with 19 harvesting developer and CI metadata to one domain. confirmed

Languages and runtimes

  1. Zig's Io.Threaded cancels blocking syscalls using signals and a shared-memory handshake Zig's Io.Threaded cancels syscalls using signals and handshakes on POSIX without iouring or the thread teardown issues of pthreadcancel. confirmed

Apple platforms

  1. Three reported leaks expose the real IP address behind Apple Private Relay DNS prefetching, WebAuthn requests and WebTransport open connections outside Apple Private Relay in Safari, affecting all iOS browsers. developing

Linux and kernel

  1. Linux wireless maintainer will ignore syzbot AI patches that fail a three second review Wireless maintainer Johannes Berg will ignore AI-assisted patches failing three-second review and disabled syzbot for wireless AI submissions. confirmed

Infrastructure

  1. Cloudflare ships Kitesurf, an agent-first browser running in V8 isolates on Workers Cloudflare built Kitesurf, an agent-first WebAssembly browser on Workers, claiming lower CPU and memory than Chromium for agent automation. confirmed

Engineering posts

  1. pgrust 0.2 claims 300x faster analytics than Postgres and demonstrates the same 10x in a miniature executor A pgrust post demonstrates 9.6x speedup on a Volcano executor using batching and SIMD, though the 300x release-level claim is not reproduced. developing

Markets and companies

  1. AMD agrees to acquire AI inference silicon startup Taalas AMD agreed to acquire Taalas, a startup building inference silicon, folding its technology into AMD's accelerator roadmap. confirmed