2026-08-09

12 stories suggest →

Top stories

  1. OpenAI pauses internal Astra work after rating the model critical for autonomous cyber capability OpenAI paused internal activity on Astra after rating it critical for autonomous vulnerability discovery and exploitation with new containment. confirmed AI
  2. Claude Code makes auto mode the default permission mode on 2026-08-14 Anthropic makes auto mode default on Pro, Max and Team starting 2026-08-14, where classifiers detected planted commands 89% versus human 13.6%. confirmed Agentic coding
  3. PortSwigger breaks webmail CSS sanitization to steal login tokens and drive OpenAI's Atlas browser PortSwigger breaks webmail CSS sanitization across Yahoo, AOL, Fastmail, ProtonMail, Gmail and Outlook to exfiltrate tokens and inject prompts. confirmed Security
  4. Head Mare exploits unpatched TrueConf servers to ship backdoored client installers Head Mare compromised unpatched TrueConf servers to replace client installers with unsigned backdoored builds, affecting connected organizations. confirmed Security
  5. UTM publishes Triton, a DirectX 11 user-mode driver for QEMU Windows guests UTM released Triton, a DirectX 11 user-mode driver for QEMU Windows guests implementing the driver interface instead of replacing system DLLs. confirmed Dev tools

AI

  1. CNBC ties the OpenAI, Anthropic and Meta rogue-agent disclosures to one evaluation vendor CNBC reports OpenAI's incident came from the same evaluation-environment vendor as Anthropic and Meta disclosures, a shared third-party testbed. confirmed

Security

  1. Craft CMS 5.10.5 fixes a passkey login that accepts replayed WebAuthn assertions Craft CMS fixed passkey login accepting replayed WebAuthn assertions, where one captured request authenticates further sessions for the account. confirmed

Outages

  1. Cloudflare restores R2 objects unavailable for about 36 hours after an ENAM write failure A write failure in Cloudflare R2 left multipart-uploaded objects unreadable for about 36 hours after the write window closed on 2026-08-07. confirmed

Infrastructure

  1. RFC 10023 defines a _for-sale DNS leaf node name RFC 10023 specifies a for-sale DNS leaf node carrying TXT records, letting registrars and availability services adopt it retroactively. confirmed
  2. Fastmail adds an Amsterdam data region and lists what stays in the United States Fastmail added an Amsterdam EU data region but lists what stays in the US, including logs, emergency backups and geographic replicas. confirmed

Engineering posts

  1. Shopify moved checkout inventory reservations from Redis to MySQL with SKIP LOCKED Shopify moved checkout inventory reservations from Redis to MySQL with SKIP LOCKED, moving reservation and ledger into one transactional store. confirmed

Hacker News

  1. Hacker News argues over whether writing code was ever the hard part A blog post arguing code was never the hard part drew the day's largest HN thread, with commenters separating typing from debugging and design. discussion