2026-09-14

19 stories suggest →

Top stories

  1. Wiz reports in-the-wild chaining of two JFrog Artifactory flaws from unauthenticated request to admin token Wiz reports actors chaining two JFrog Artifactory flaws, in some cases reaching a created admin account in under five minutes. confirmed Security
  2. Apple ships iOS 27, iPadOS 27 and macOS 27, with Siri AI as an English beta and no iPhone rollout in the EU Apple releases iOS 27, iPadOS 27 and macOS 27, with Siri AI as an English beta and no iPhone rollout in the EU. confirmed Apple
  3. Bishop Fox maps NetScaler CVE-2026-19490 from a safe patch-state probe to root, with the decoded length as the payload Bishop Fox weaponizes NetScaler CVE-2026-19490 to root, and a crash-length POST drops all traffic for about 45 seconds. confirmed Security
  4. Julia 1.13 skips system-image objects during GC marking and replaces the hash function with RapidhashNano Julia 1.13 marks system-image objects permanently, cutting a bare-session full collection from 35 ms to 2 ms. confirmed Languages
  5. Private frameworks in iOS 27 and macOS 27 let a third-party model stand in for Siri's planner MacRumors reports iOS 27 private frameworks let a third-party model replace Siri's server-side planner, unusable today. developing Apple

AI

  1. Vals AI reports Claude Fable 5.1 solving a 370-year-old cipher by using the book itself as the key Vals AI reports Claude Fable 5.1 decoding a 370-year-old cipher by using Urquhart's own book as the key. developing

ML research

  1. A Hopper profiling study argues a single SM utilization number hides how much useful work LLM decode does A Hopper profiling study replaces the single SM utilization number with eight counter-validated views of decode work. developing

Agentic coding

  1. Paired same-model tests find no average advantage for vendor-native agentic coding harnesses A preprint finds no average advantage for vendor-native coding harnesses across 80 paired same-model private tasks. developing
  2. Anthropic reports CI jobs rising 25x in six months and rebuilds test selection around a shared journal Anthropic rebuilds CI test selection around a shared journal after agent-driven job volume rose 25x in six months. confirmed

Security

  1. A generic Android strategy takes an unprivileged app to root on Samsung, Xiaomi and Oppo-family flagships Calif.io takes an unprivileged Android app to root on Samsung, Xiaomi and Oppo-family flagships with no CVEs named. confirmed
  2. A RubyGems maintainer finds the GemStuffer gems executed code on RubyDoc.info through YARD and hunted cached API keys A RubyGems maintainer finds the flood gems run code on RubyDoc.info through YARD and scrape for cached API keys. confirmed

Developer tools

  1. A compression engineer argues against JPEG XL on the Web and demonstrates a 1,918-byte decode bomb A compression engineer argues against JPEG XL on the Web and reports a 1,918-byte image needing 17.43 seconds to decode. discussion

Languages and runtimes

  1. A Tokio performance write-up from RustConf names the failure modes, including a blocking-pool ceiling near 50,000 tasks per second A RustConf write-up reports Tokio's global blocking pool degrading near 50,000 blocking tasks per second on a 32-core host. confirmed

Apple platforms

  1. Xcode 27 adds coding agents with a choice of model, a Device Hub and a Swift Concurrency instrument Xcode 27 adds coding agents backed by a model of the developer's choice, a Device Hub and a Swift Concurrency instrument. developing

Linux and kernel

  1. Ubuntu 26.10 moves cp, mv and rm to uutils, completing the Rust coreutils migration Ubuntu 26.10 moves cp, mv and rm to the Rust uutils implementations, completing the coreutils migration begun in 25.10. confirmed

Infrastructure

  1. Cloudflare probes origins for key agreement support and cuts origin HelloRetryRequests from 52 percent to 3.7 percent Cloudflare probes origins for supported key agreement groups, cutting origin HelloRetryRequests from 52 percent to 3.7 percent. confirmed

Engineering posts

  1. Reverse engineering why the x86 undefined instruction is called ud2 Raymond Chen reconstructs why x86 named the supported undefined instruction ud2 rather than ud0 or ud1. confirmed

Markets and companies

  1. Automattic confirms Mullenweg has returned as chairman and CEO after the board removed him Automattic confirms Matt Mullenweg is chairman and CEO again after the board voted to put him on paid leave. confirmed
  2. Temporal raises $550M at a $12.55B valuation and reports 1.9 trillion billable actions in August Temporal raises $550M at a $12.55B valuation and reports 1.9 trillion billable actions in August across 4,300 customers. confirmed