2026-08-22
Top stories
- An expired 5 euro domain gave a researcher DNS control of three territories' ENUM zones, and logged about 209,000 phone-number queries before the NCSC took it over Registering an expired nameserver domain gave control of zones and logged roughly 209,000 phone-number lookups through them.
- OpenAI cuts GPT-5.6 Sol API pricing to 4 dollars per million input tokens and 20 dollars per million output, a 20 percent input and 33 percent output reduction GPT-5.6 Sol input fell to four dollars per million tokens and output to twenty dollars, both promotional through November 2026.
- JSONata patches three critical expression-evaluation escapes that reach arbitrary code execution, cleared by 2.2.1 and 1.8.8 Three CVSS 9.3 code execution escapes patched in JSONata 2.2.1 and 1.8.8 respectively in May and July of 2026.
- A traced RTX 4090 global load measures 15.4 ns at L1, 127.4 ns at L2 and 255.4 ns at DRAM, with the L1 set function and L2 slice hash reverse engineered A post traces RTX 4090 memory latencies and reverse engineers undocumented mappings with probes and settings for reproduction.
AI
- Nari Labs reports 10 requests per second at sub-50 ms p95 time-to-first-audio for Qwen3-TTS on one H100, and open sources the serving code and benchmark Nari Labs scheduled TTS stages on one surface to preempt batches by playback deadline at ten requests per second with sub-50 ms p95.
- Anthropic puts Claude Mythos 5 into Claude Security in public beta, states partner cyber tools are coming, and adds 35 million dollars in credits for open-source security Claude Mythos 5 now scans in Claude Security public beta at standard token rates with partner integrations announced but not shipped.
Agentic coding
- A self-hosted agent pipeline takes one prompt to a deployed app, and uses a DNS-01 challenge to issue certificates for services with no public DNS record DNS-01 ACME challenges issue certificates for tailnet-only services without A records, though hostnames appear in transparency logs.
- The MCP maintainers publish a roadmap naming five priority areas, including collapsing local servers onto Streamable HTTP over stdio and moving agent identity off pasted API keys The roadmap names five priority areas including Streamable HTTP over stdio and agent identity off API keys, none shipped yet.
Security
- Xinference evaluates Llama3 tool-call output with Python eval, so a crafted chat completion request reaches unauthenticated code execution on the server Xinference passes model output to Python eval in Llama3 tool parsing, letting unauthenticated completions run code, patched in 2.7.0.
- Hydra's instantiate call turns untrusted config into code execution, with hydra-core 1.3.3 and earlier affected Hydra calls the target named in a config's target key, so attacker configs become code execution via instantiate, patched in 1.3.4.
- NLTK's package downloader never verifies a downloaded archive before extracting it, with 3.9.2 and earlier affected NLTK extracts packages without checksum verification, leaving downloads unverified through 3.9.2, patched in 3.9.3.
Outages
Developer tools
- Rust Glancer trades incremental analysis for a filesystem-persisted index, targeting under 100 MB and no re-indexing after an editor restart Rust Glancer freezes analysis on save to keep the index on disk, with new items unindexed until file save.
- Cobalt puts a signed app store, a Rust SDK and a capability-gated runtime on the Kobo Clara BW Cobalt runs Kobo Clara apps in isolated processes with capability-gated network, storage, audio, light and Wi-Fi.
Languages and runtimes
- Kino runs a Rack 3 app on parallel Ractors in one process, and reports about 4x lower memory than a Puma cluster on Rails at roughly a fifth of its throughput Kino runs Rack on parallel Ractors in one process, but Rails falls back to single-threaded mode, losing throughput.
- Odin's inline assembler type checks assembly against per-instruction operand forms and returns multiple results from one template Odin's assembler validates operand types against instruction forms at compile time and destructures assembly returns.
Apple platforms
- The Swift blog describes Embedded Swift in the upcoming 6.4 accepting all existential `any` types, untyped throws, and full metatypes Embedded Swift 6.4 lifts restrictions on existential types, untyped throws and metatypes, with untyped throws allocating.
- Circleback moves its meeting recorder out of the Electron render process to ScreenCaptureKit on macOS and libobs on Windows, bridged to React by a compile-time Swift macro Circleback uses native capture engines: ScreenCaptureKit on macOS and libobs on Windows with platform-specific clock-drift handling.
Linux and kernel
Infrastructure
- A count of 24 months of merged pull requests puts one merger above 78 percent on four OpenTelemetry SDKs One person merged over 78 percent of PRs on four OpenTelemetry SDKs in 24 months, contrary to vendor disagreement slowing the work.
- WarpStream's Kafka producer proxy holds each response to WarpStream's own write latency, so a mistuned producer fails during the proxy phase instead of after the cutover WarpStream's migration proxy delays responses to match destination latency, gating cutover on time lag.
Engineering posts
- Thomas Ptacek argues TUIs exist because of modems and Motif, and that agent-generated native UI removes the reason to build new ones Ptacek argues TUIs exist only because of modem bandwidth and Motif costs, which agent-generated UIs make unnecessary.
- Dan Luu argues agent-driven optimization makes workload-specific performance work cheap, and measures 2 percent on holdout ripgrep queries Agent optimization on ripgrep yielded 2 percent on representative queries and 7 percent where AOT compiled.