2026-08-28
Top stories
- JetBrains says its Cadence service was breached through the unpatched TeamCity flaw it disclosed itself JetBrains says its Cadence server was exploited through CVE-2026-63077, the TeamCity flaw JetBrains itself disclosed and had not patched.
- PaperCut reports active exploitation of a flaw affecting every PaperCut NG and MF version PaperCut says a flaw affecting every NG and MF version is under active exploitation and has shared no technical detail.
- UniBLEed documents two root RCE chains on the Unitree G1, one of five bugs over Bluetooth A five-bug Bluetooth chain reached unauthenticated root on tested Unitree G1 units before Unitree patched the cloud key oracle.
- SourceHut will prohibit LLM-assisted original content in its terms of service from 2026-09-10 SourceHut will prohibit LLM-assisted original content and AI-enabling software from 2026-09-10, with no retroactive enforcement.
- Anthropic opens a research preview of the Model Hardware Standard for agents driving physical devices Anthropic opened a gated research preview of the Model Hardware Standard, letting agents drive lab and manufacturing instruments.
AI
- Z.ai publishes GLM-5.3 weights and reports large gains on vulnerability discovery benchmarks Z.ai published GLM-5.3 weights at 753B parameters and reports CyberGym 84.5 against GLM-5.2's 77.2, all figures vendor-run.
- Gemini Omni 1.1 Flash adds scene extension to 40 seconds, keyframe control, and 4K upscaling Gemini Omni 1.1 Flash extends generated scenes to 40 seconds, adds keyframe control, and upscales output to 4K.
- Gemini 3.5 Transcribe reaches public preview with separate streaming and pre-recorded APIs Gemini 3.5 Transcribe enters public preview with split streaming and pre-recorded APIs and a cited 2.6 percent word error rate.
ML research
- A multi-agent environment reports results novel against prior literature on five of twelve construction problems Agents from different model families with no orchestrator report novel results on five of twelve AlphaEvolve construction problems.
- Spectral Allocation accounts for Muon's advantage over Adam and proposes SAMuon A paper attributes Muon's edge over Adam to spectral allocation and proposes SAMuon, which cuts training tokens by up to 24 percent.
Agentic coding
Security
Developer tools
- htmx 4.0.0 makes attribute inheritance explicit and renames every event htmx 4.0.0 ends default attribute inheritance and renames every event, while npm latest stays on the 2.x line until 2027.
- Google Play removed Luanti over a DMCA notice filed by an AI takedown vendor Google Play pulled Luanti's Android app on a Tracer.AI notice claiming Minecraft assets in an app that ships no game assets.
- Sovereign Tech Agency commits 508,640 euros to Flatpak sandboxing over two years The German Sovereign Tech Agency committed 508,640 euros to Flatpak sandboxing work running through the end of 2027.
- A fuzzer-found divide by zero in FFmpeg's VPK demuxer crashes on a 21-byte input A 21-byte file that FFmpeg's probe reads as VPK triggers a divide by zero, crashing any app parsing untrusted media.
Languages and runtimes
- The OpenAI Python SDK moves to HTTPX2 and changes the default TLS trust store The OpenAI Python SDK's move to HTTPX2 drops certifi for the OS trust store, so TLS can fail in minimal container images.
- A Rust service measures musl at 26 percent slower than glibc after switching allocators Brokk measured its Rust service 26 percent slower on musl than glibc even with mimalloc, and is dropping musl builds.