2026-09-25

17 stories suggest →

Top stories

  1. Federal appeals court upholds the Pentagon designation that bars Claude from Defense Department work A 2-1 appeals panel upheld the Pentagon designation barring the Defense Department and its contractors from using Claude. confirmed AI
  2. Cloudflare fixes a cross-tenant data exposure in Containers Cloudflare fixed a Containers flaw that handed new tenants unzeroed 64 KiB disk blocks holding other customers' data. confirmed Security
  3. Two compromised GitHub Actions were re-enabled with their malicious tags intact Two GitHub Actions disabled in May for compromise ran again from 2026-09-16 until both were disabled again on 2026-09-25. confirmed Security
  4. File-notification APIs leak user and application behaviour on four operating systems File-notification APIs let a local app watch another's activity on Linux, Android, Windows, and macOS, with only Linux partly fixed. confirmed Security

AI

  1. Google publishes Trillium TPU radiation test results for Project Suncatcher Google reports Trillium TPUs surviving a proton beam past a five-year dose and a satellite passing three-axis vibration testing. developing
  2. Gemini 3.8 Live with Live Avatar reaches general availability Google made Gemini 3.8 Live generally available in Gemini Enterprise with native speech-to-speech and tool calling mid-conversation. confirmed

ML research

  1. Automated C-to-Rust tools cut unsafe blocks without removing the memory bugs A study of 464 machine-translated Rust programs found 177 inherited the C memory bugs and 77 new Rust bugs appeared. confirmed

Agentic coding

  1. GitHub Copilot app adds per-project local sandboxing that fails closed The GitHub Copilot app gained per-project local sandboxing that errors out rather than running an unenforceable policy. confirmed

Security

  1. PHP stream wrapper sent Authorization and Cookie headers to the host a redirect pointed at PHP patched a stream wrapper that forwarded Authorization and Cookie headers to whatever host a redirect pointed at. confirmed
  2. SourceHut build logs allowed account takeover through an ansi2html XSS An ansi2html XSS let anyone who could write to a SourceHut build log run script in every browser that viewed the job. confirmed
  3. macOS serial device nodes sit outside TCC, and Apple declined the report A researcher reports macOS serial device nodes are world-readable with no TCC prompt, and Apple declined the report. confirmed

Developer tools

  1. git-bug 0.11.0 ships a rewritten web UI, a code browser and a formal on-disk specification git-bug 0.11.0 ships a rewritten web UI, a formal on-disk specification, and preservation of unknown operations. confirmed

Languages and runtimes

  1. Fearless SIMD reaches 1.0 with portable SIMD and no ad-hoc unsafe code Fearless SIMD 1.0 confines Rust SIMD unsafe code to one kernel macro and a small safe transmute module, with a three-year support commitment. confirmed
  2. Go 1.27 adds a portable SIMD package with emulation fallback Go 1.27 adds an experimental portable simd package that emulates missing operations where no hardware SIMD exists. confirmed

Apple platforms

  1. KosmicKrisp passes the Vulkan 1.4 conformance test suite on Apple silicon KosmicKrisp passed the Vulkan 1.4 conformance suite on Apple silicon, giving macOS a Khronos-conformant driver. confirmed

Infrastructure

  1. The Dutch interior ministry publishes the NixOS configuration behind its government workplace The Dutch interior ministry published the NixOS flake behind its government workplace, with SBOM-per-host CI. confirmed

Engineering posts

  1. Kafgres reaches 700 MB/s produce throughput inside Postgres after replacing a tick loop with socket readiness Replacing a 5 ms tick loop with socket readiness took Kafgres produce throughput from 197 MB/s to 703 MB/s. confirmed