2026-09-12

17 stories suggest →

Top stories

  1. Researchers attribute the May RubyGems package flood to an OpenAI agent swarm that the registry was never told about Researchers attribute May's flood of 2,000 malicious RubyGems packages to an OpenAI agent swarm the registry never knew about. developing Security
  2. GitLab patches an unauthenticated arbitrary file read scoring CVSS 10.0 in the repository commits API GitLab patches a CVSS 10.0 unauthenticated arbitrary file read in the commits API affecting every self-managed install since 18.7. confirmed Security
  3. Dario Amodei calls for slowing AI capability progress and commits Anthropic to embedded outside evaluators Dario Amodei calls for pacing AI capability progress and commits Anthropic to outside evaluators with employee-level access. confirmed AI
  4. Anthropic reports a Russia-linked espionage actor running an AI-orchestrated kill chain that re-tooled its own malware until it evaded detection Anthropic reports a Russia-linked actor running an AI-orchestrated kill chain that re-tooled its malware until detection failed. confirmed Security

AI

  1. OpenAI withdraws sponsorship of a Caltech AI math hackathon after an open letter from mathematicians OpenAI pulled its sponsorship of a Caltech AI math hackathon after mathematicians objected to uncompensated verification work. confirmed

Security

  1. Traefik forwards arbitrary upgrade tokens, letting an h2c tunnel bypass the whole middleware chain Traefik forwards arbitrary upgrade tokens, so against an h2c-accepting backend a tunnel bypasses BasicAuth and ForwardAuth. confirmed
  2. An Android keep-alive offload lets any app send traffic outside the VPN tunnel with Block all connections without VPN enabled An Android keep-alive offload lets any app send UDP outside the VPN tunnel, defeating the Block all connections without VPN switch. confirmed

Developer tools

  1. mold 2.42.1 is likely the last C++ release, and mold 3.0 is a Rust rewrite aiming to replace GNU ld Rui Ueyama says mold 2.42.1 is likely the last C++ release, with mold 3.0 a Rust rewrite targeting /usr/bin/ld. confirmed
  2. Google replaces destination URLs in search results with opaque google.com/goto redirects Google now returns opaque google.com/goto redirects in search results instead of the destination URL of each result. developing
  3. pnpm 12.4 installs npm, Cargo and Python dependencies from one workspace and one lockfile pass pnpm 12.4 resolves npm, Cargo and Python dependencies from one workspace file, sharing one store and one fetch path. confirmed

Languages and runtimes

  1. Seven async runtimes produce four different outputs for the same fire-and-forget program Brown researchers run one fire-and-forget program on seven async runtimes and get four different outputs from it. confirmed

Apple platforms

  1. Three years on, the Apple Neural Engine turns out to have no instruction set, only DMA writes into configuration registers Reverse engineering finds the Apple Neural Engine has no instruction set, only DMA burst writes into fixed hardware registers. confirmed

Infrastructure

  1. PlanetScale sustains 118.5 million queries per second on 512 Neki shards over 1.22 PiB PlanetScale reports 118.5 million queries per second on 512 Neki shards over 1.22 PiB of single-shard point reads. confirmed

Engineering posts

  1. Conviva replaced mmap with io_uring and O_DIRECT in its Rust query engine and the first cut ran 60 percent slower Conviva replaced mmap with iouring and ODIRECT in its Rust query engine, and query time rose from 13.6s to 21.8s. confirmed

New videos

  1. Dioxus maintainer reports tens of thousands of agent-written Rust lines that never cleared the merge bar A Dioxus maintainer says tens of thousands of agent-written Rust lines never merged, while build plugins went years to weeks. discussion

Markets and companies

  1. Salesforce closes its acquisition of Fin, the former Intercom, three months after the agreement Salesforce closed its roughly $3.6 billion acquisition of Fin, the former Intercom, on 2026-09-10, ahead of the stated schedule. confirmed

Hacker News

  1. Hacker News argues about its own AI content mix, and three filters ship in response An Ask HN thread on the site's AI content mix reached 793 points, and three filtering tools shipped the same day. discussion