2026-09-10
Top stories
- RSA-260 factored with a GPU lattice siever built by Devin Cognition factored RSA-260 with a GPU lattice siever written by Devin, using about 4,900 GPU-days, roughly $400k at market prices.
- Shopify moves its mobile apps from React Native back to Swift and Kotlin Shopify is rebuilding its four mobile apps natively and ends or hands off React Native Skia, FlashList and Restyle.
- DeepSeek V4.1 Flash undercuts V4 Pro and takes over its API route on 2026-09-14 DeepSeek prices V4.1 Flash below a third of V4 Pro off-peak and routes V4 Pro requests to Flash from 2026-09-14.
- Automattic's board puts Matt Mullenweg on leave and names the CFO interim CEO Automattic's board put Matt Mullenweg on leave and named CFO Mark Davies interim CEO, and Mullenweg says he voted against it.
AI
ML research
Agentic coding
Security
- Forgejo 16.0.4 fixes a critical remote code execution through template repositories Forgejo 16.0.4 fixes a critical flaw where generating a repository from a malicious template runs code on the host.
- A 2023 Docker build argument left a live GitHub admin token in a public Baseten image A GitHub token in a public Baseten image's build history stayed live for three years with admin on key repositories.
- Deadbugz MCP server behaves for three tool calls, then poisons its own tool descriptions A malicious MCP server answers three tool calls normally, then rewrites its tool descriptions to exfiltrate SSH and AWS keys.
- Open WebUI 0.11.1 fixes an SSRF and two authenticated denial-of-service flaws Open WebUI 0.11.1 fixes an authenticated SSRF to cloud metadata and two denial-of-service flaws any default-role user can trigger.
- Claude subscribers report drained token allowances from stolen login sessions Claude subscribers report token allowances drained by stolen login sessions, with Anthropic naming infostealer malware.
Languages and runtimes
- Microsoft makes Rust a Tier-1 language and ships rustc_codegen_utc for the MSVC backend Microsoft declares Rust a Tier-1 language alongside C++, C#, and TypeScript, and builds Rust internally with rustccodegenutc.
- JEP 544 proposes storing compiled native code in the Java AOT cache JEP 544 would store C1 and C2 native code in the Java AOT cache, taking framework startup cuts from 50 to 70 percent up to 65 to 80.
Infrastructure
- 1.1.1.1 validates post-quantum DNSSEC and refuses to fall back to conventional signatures Cloudflare's 1.1.1.1 now validates ML-DSA-44 DNSSEC signatures and refuses to downgrade to ECDSA once a parent DS signals one.
- AWS Lambda raises the asynchronous function timeout to 90 minutes on Managed Instances AWS Lambda raises the function timeout to 90 minutes, for asynchronous invocations on Managed Instances only.
- PlanetScale opens Neki, sharded Postgres with real Postgres on every shard PlanetScale previews Neki, a sharded Postgres where a routing layer speaks the wire protocol and each shard is stock Postgres.
Engineering posts
New videos
- Rerunning the IFScale instruction-following benchmark against current frontier models Rerunning the IFScale benchmark moves the instruction-following ceiling from about 250 to near 2,000 in twelve months.
- LinkedIn puts 1,300 internal tools and 600 playbooks behind three MCP tools LinkedIn hides 1,300 internal tools and 600 playbooks behind search, get schema, and execute, because MCP degrades past forty.
Markets and companies
- Bending Spoons agrees to acquire Miro for $1.355 billion Bending Spoons agrees to acquire Miro at a $1.355 billion enterprise value, a week after closing Airtable.
- Microsoft and TracerAI rescind the DMCA takedown against Luanti Microsoft and TracerAI withdrew the DMCA notice against Luanti, and the app is back on Google Play without a counter-notice wait.