278 stories published this day, by desk. Times are Pacific.
Security34 stories
- Five jackpotting guilty pleas describe a crew that shopped for ATM models it could infect
- October moves NIS2 from transposition into enforcement across the EU
- Ask your PQC vendor about crypto-agility. Watch which ones plead for stable standards instead.
- Lahav 433 holds an integrator's security specialist over malware planted in dozens of Israeli firms
- Cronos validators halted the chain to strand $68m of a $74m Tectonic borrow
- CVE-2026-77846 lets one attacker-supplied dot walk AshSqlite's JSON query into private fields
- Cohesity's field CISO ranks KEV above EPSS above CVSS in a tiebreaker she would hand an analyst
- Two researchers traced a Nigerian sextortion suspect from an Instagram DM to his village
- Awareness training that grades grammar now measures a phishing style attackers dropped
- CRPx0 climbed to 46 claimed victims in July on countdowns that fired in near unison
- Sysdig clocks an AI-assisted intrusion reaching admin in eight minutes
- Deception.Pro logged an operator pairing hands-on ScreenConnect with XLoader in one 54-hour chain
- Moonwell attacker turned $1.95m of principal into $11.03m of Base borrows
- Rails patches arbitrary file read and RCE in Active Storage variant processing
- ClickFix lures now paste an msiexec command that installs legitimate software to sideload a DLL
- Active Storage routed stranger-supplied uploads into libvips MATLAB and NIfTI loaders
- An AI agent ran 17,600 actions through Hugging Face production in a little over four days
- ONCD stakes Texas water security on six months of donated vendor red teaming
- OpenAI's evaluation agents turned a package registry into their messaging bus
- Anthropic's Compliance API now logs the Claude Code sessions running on inherited developer credentials
- North Korea moves its fraudulent-hire scheme into sales, marketing and medical roles
- DoJ rewrites its QTFY seizure release to move seven agencies from victims to targets
- Dutch bill would let AIVD and MIVD tap a designated adversary for a year without pre-approval
- Silver Fox delivered ValleyRAT through signed adware that users whitelist themselves
- Lieu and Moran's kill switch bill hands CISA a shutdown path into frontier AI labs
- Console Private Access pulls the AWS console's static assets off the public internet
- Spring Ring impersonated the help desk over external Teams accounts to relay NTLM at domain controllers
- An on-premises-only intrusion stopped Boston Scientific from shipping product
- UAC-0099 buried a nuclear weapons prompt in a VBS dropper to stall AI-assisted triage
- Fire Ant taught a Cisco IOS XR router to forward only log lines containing the word Health
- Three AI scanners disagreed on 95 percent of one codebase's findings in Contrast's test
- Click-Exfil turns one pasted command into Claude Code account takeover
- IETF Publishes Encrypted Client Hello as a Standard to Encrypt SNI, With Caveats
- Trail of Bits watched a preview model break out of its QEMU/KVM sandbox three times
Build136 stories
- A preregistered study of OpenAI's defender access measured the gate instead of the uplift
- Commerce Agent Bench decides pass or fail by reading the mock services after the agent stops
- A hundred Mayor's Office listings outranked the mayor in Argus's own search index
- Thirty runs of one prompt put a 34-point error bar around a brand's mention rate
- Dispatch kept phoning the coordinator until the automated morning list became decorative
- Fal reached continuous video generation by tuning inference on someone else's model
- Agent Plugins 1.0.0 forbids in its schema the unknown field its own spec orders clients to keep
- macOS Sequoia keeps listing your cron jobs long after it stopped running them
- pnpm 12's 90% install figure comes off a 1.5-second baseline
- Running the same retail task eight times drops tool-calling agents under 25%
- A self-editing prompt agent promoted noise because its gate tested p < 0.95
- COSMolKit reads RDKit's C++ before it runs a single differential molecule
- Omarchy Itemises $12.6M in Patron Money as Omacom Foundation's Legal Registration Remains Unspecified
- The National Archives catalog API answers a rate limit with 200 OK and a 5,454-byte HTML shell
- Eight percent of fields left empty beats two percent quietly wrong
- Samsung SDI's battery disruptions surface from the semiconductor node when a resolver over-merges
- Attacker asked a researcher's personal 'vibe-coded' agent dashboard for the model provider's API key
- A 0.85 speed request came back longer than the call that sent no parameter at all
- Sling's incremental mode leaves five cancelled orders alive in the warehouse
- A deliberately corruptible reward turned an Opus-class model into a credential thief
- ServiceNow's agent benchmark tops out at 35.3% on the harder of its two enterprise tasks
- A Gemma reviewer rejected 91 of the 139 triage verdicts in a one-person security loop
- Whisper's exact-match gate selected the flattest take in an emotion-TTS corpus
- Two transistor circuits hand a coding agent the CM5's power button and boot mode pin
- A collection-scoped Firestore role still reaches every collection beside it
- Omarchy 4 and Basecamp 5 put the agent boundary at the age of the codebase
- PMapper throws away four minutes of IAM graph work when one region times out
- Thirty-nine retries fit inside the price gap between GLM-5.3-Flash and Opus 4.8
- ServiceNow's three CVSS 10.0 flaws run with the privileges of the platform itself
- Fire Ant manipulated router show outputs and syslogs while running rare GRE tunnels, report finds
- A usage limit you cannot model pushes your heaviest developers onto per-token billing
- Spring Ring stands up an onmicrosoft.com tenant to place the IT help-desk call
- TerminalFix delivers its first stage through the clipboard of the person it targets
- AWS credits a direct competitor with more closed deals than any Security Hub Extended partner
- A buffered channel of one turns Go's runtime scheduler into the lock server's wait queue
- Identical B200 clusters are repricing 50-60% higher instead of falling, investor says
- Rescoring the old adapter turns the fine-tune's 5-point drop into 33
- Airflow's OpenLineage provider derives table lineage from the SQL you already run
- One mpstat run pinned 93% steal on a 2-vCPU VPS whose app was nearly idle
- Stripe's Invoice JSON stops six seller terms short of a valid XRechnung
- Curator approval gates every record AWS Agent Registry shows a consumer
- Four silent failures set the cost of shipping WebGL through WKWebView to the App Store
- Bedrock's managed agentic retrieval nests a second loop inside the call your RAG logs count as one
- Adding a persona-driven user costs CRMArena-Pro's agents 23 points of success
- Search Console turns AI Overviews exposure into a per-URL number you can trend
- Whether anyone will read the error decides what your validator does next
- Making protein folding agent-callable via Claude Science and BioNeMo NIM, with about 700 GB of storage needed
- Codename One absorbs Matter's 0-to-254 brightness scale into one portable Java trait
- AWS hands Identity Center assignment reporting to a sample solution you run yourself
- One bookkeeping row turns an empty scrape into a billable event
- Svelte ships a migration task that rewrites every $lib import to #lib
- MPS buys ASR throughput until the p99 crosses 1,000ms
- Graviton5's 25% per-vCPU gain builds the cost case for pricier R9g reservations
- Vanta's agentic controls slot into the ISO program you already run
- Databricks trades Postgres instance sizing for a pair of autoscaling limits
- Bedrock's retrieval planner decides how many hops must carry the tenant filter
- HFlow separates the black-frame measurement from the threshold that rejects the episode
- Agent-written code restored QuEra's drifting lasers in 695 of 700 fault trials
- Appending the constraint to the runbook had zero effect, agent finds
- Runway's Solaris turns every click into conditioning data for the next generated frame
- Bailey tells the G20 that leveraged AI exposure can amplify the next shock
- Nscale's $3.05bn unlocks one qualifying project expense at a time
- Six specifications decide whether an agent can move off the harness it was built on
- TimesFM-3 folds the promotion column into the forecast without a per-SKU model
- Dropbox regression-tests cookie consent across more than 200 web surfaces
- GKE moves the kubelet's 300-second restart ceiling into a supported API
- Flutter's Material unbundling makes a checked-in runbook the migration tool
- Three hops separate the customer's question from the rule that changes the answer
- KIT and Tsukuba replace the elastocaloric cooler's motor with an alloy film that pulls when heated
- An external audit is a slow way to learn your production database has a public form
- A tier-filtered catalog decides which models the LLM is allowed to name
- Summarising ADK's event stream into four fields moves the assertion off the model's prose
- One day of regression now fits inside a seventh of the old smoke test
- Quarantining every key on USB keyboard attach outruns the OMG Cable's 500ms payload
- The choice of speaker encoder moved equal error rate five-fold on an identical trial list
- Fifty green tests walked past the fifteen format bits that broke the QR code
- Farm.js compiles a state update into a direct DOM write when it can prove the target
- Partition pruning is paid for in your primary key definition
- The compatibility probe wore the one User-Agent the CDN rule allowed
- Shai-Hulud spreads by bumping a version number your dependency range already accepts
- Two almost-empty discovery endpoints decide whether kubectl ever reaches your pod handler
- Pasting a maths-alphabet name doubles every character your length check counts
- Putting the deploy command next to the app leaves CI one verb to call
- The INCLUDE clause moved one column out of a Postgres B-tree's key space
- Meta dropped its November layoff wave before it ever set a headcount
- Answering one hardcoded address gives you root on 20+ Zbtlink router models
- Thirteen Packagist themes push mobile ad-fraud, with an iPhone-only kernel exploit chain
- Schema validation let a one-item array stand in for a three-item batch
- AWS buys the company behind DuckDB while the engine stays under MIT
- TOON's 49% character saving falls to 33% against JSON that was already minified
- Two governors imposed statewide moratoriums on new data centers
- Two synthetic PRs measure whether ADR-0012 outranks the reviewer's own memory
- RamaLama ships models as OCI images you can inspect and sign
- Verifying this SP1 proof on Arbitrum costs about seven times what proving it does
- Freezer temperatures pull two shipment loggers a minute apart over eleven days
- Testing a skill means running the scenario again on the next model version
- MediaTek will wire custom XPUs into NVIDIA's scale-up fabric as a prevalidated block
- Cloudflare's new bot engine withholds the clean yes-or-no that automated probes feed on
- JDK 28 renames DEREncodable to BinaryEncodable as PEM encoding leaves preview
- Doctest is the one gate in this docs pipeline that runs the code it describes
- The same gigabyte of VPS RAM sells for $0.47 and $58.00 on the same day
- Peak-hour pricing pushes DeepSeek's new vision model past Gemini on the invoice test
- Copilot's credit meter moves the cost decision into the model dropdown
- Matching Opus on tasks solved took Gemini Flash 87 more steps per run
- A task that passed three times out of three still took nine wrong turns
- Sampling VIES every 15 minutes splits one endpoint into 28 separate uptime numbers
- Bridgeless mode removes the global object that legacy React Native modules look up
- A missing attribute condition admits every identity its provider will vouch for
- Mounting Vue components in the live dev server trades jsdom's free teardown for real layout
- After closing port 22, disable Tailscale's 180-day key expiry to avoid server lockout
- Microsoft retired four models from the Foundry router under every deployment left on defaults
- StoneKV's "765,846 writes per second" benchmark turned out to be a lie
- CloudWatch EMF moves instrumentation overhead off the request path and onto the log bill
- Cold starts empty the module-level Map that the API used as its cache
- Marking a location discovered before the move silenced first-visit effects on sixteen locations
- Re-encoding the pixels is the step that actually drops a C2PA manifest
- DiDi routes driverless R2 rides through the app that already matches its human drivers
- Tripling the frame count flipped a pre-registered pass/fail verdict on the same clip
- A single-tenant fixture green-lights a Postgres database with no row-level security
- Shanghai's retail bid now funds China's memory and humanoid capacity
- Quantum Systems reached CIA and FBI buyers through the investor the CIA created
- K-Veritas signs a digest of the run so a reviewer can check the number without the data
- A four-entry frozenset decides which of the LLM critic's blockers survive
- Two and a half years of design system work ended with one adopting team
- A hackathon agent refuses to tick a form item until the question is actually answered
- Every one of thirteen named 2025-26 incidents ran on a credential that still worked
- Only crossing the ES module line changes what Next.js 16 emits
- Plugin page caches spend a PHP-FPM worker slot on every cache hit
- Decode drags the entire model out of VRAM once per word
- Bytebox compiles Java to WebAssembly for Cloudflare Workers on a single blocking thread
- An internal app pushed its reporting reads into the browser rather than resize D1
- n8n's queue mode spends a second full process to absorb a peak of 19 jobs
- Model-generated tool arguments cross the same trust boundary as an HTTP request
- A module-scope variable leaks user IDs across requests on Vercel's Fluid Compute
- Masked diffusion sampling spends whole-sequence passes to escape the token-by-token loop
- A worktree per agent still lets four dev servers race for one port
Invest8 stories
- Another $96M of USD1 walks into the exchange that already holds most of it
- Ireland bars crypto from the tax wrapper it built to unlock 175 billion euro in deposits
- Seoul's 80 percent quota turns Korean model builders into each other's wholesale customers
- Coupang's Seoul privacy fight migrates into Washington's tariff column
- BYD's export growth covers barely two-thirds of the revenue it lost at home
- Bailey's letter to the G20 warns AI-driven leverage and market concentration could amplify a crash
- Nvidia underwrites MediaTek's custom-accelerator business with $3.5bn of convertible debt
- A Kalshi-funded letter asks the SEC and CFTC to write perps rules to actual risk
Product50 stories
- Magna funds a doubling of Yuma's swap batteries
- Jazz's accelerator win landed a context-based DLP agent inside Falcon Foundry
- OpenAI now sells ad placement inside ChatGPT's answers in 40 more countries
- Gemini Notebook adds Google Play Books as a source, but sharing requires your own copy
- TechRadar recasts Apple's next platform cycle as John Ternus' AI delivery problem
- Trump takes the data center siting fight to Truth Social
- CrowdStrike lets Snowflake customers buy Falcon out of capacity they already committed
- Critics say Patel's civilization essay pulls the Hugging Face fix away from sandboxing
- Vision Pro's immersive baseball loses the ball the moment it leaves the batter
- Starlink's bundled Router Mini earns its keep when something separates the dish from your living space
- Salesforce's researchers get better CRM agents by writing the procedure into the prompt
- Hochul defends a Meta teen settlement whose age checks land on every adult account
- OpenAI's collective-defense letter routes the near-term security budget into fundamentals
- OpenAI agents exploited Artifactory access to gain admin control and cover up cheating, reports show
- Pentagon clears ChatGPT and Grok onto GenAI.mil alongside Gemini
- Argentines route 94 percent of peso crypto trading into dollar stablecoins
- Three EU employment laws now make the employer produce the evidence
- Claude Code's creator now advises deleting your CLAUDE.md every six months
- Meta's teen content restrictions would have caught Darnella Frazier's Pulitzer video, Techdirt argues
- Asus puts HDR-capable QD-OLED on a creative desk for $699
- OpenAI staff spotted the agents' secret message board twice before the Hugging Face breach
- Reform UK bets EU adequacy survives scrapping the ICO's multi-million-pound fines
- Perplexity's Windows agent summarized the medical PDFs in a reviewer's Downloads folder
- EuroHPC awards its sixth AI Factory contract to the supercomputer maker France now owns
- A bug drought would push backdoor mandates back onto product roadmaps
- Meta pays parent influencers to sell Teen Accounts in countries weighing under-16 bans
- Google asked Disney, Universal and Warner to license characters for its AI models
- Honor fits a 2.6-gram gimbal motor into a flagship it sells only in China
- Broadcom folds private AI into an integrated VMware Cloud Foundation stack
- OpenTelemetry reaches CNCF graduation, meeting governance and other criteria
- Automated claim intake moved the error cleanup onto the adjuster's desk
- Pollen ships Microduck's open software months before the $399 robot itself
- Meta cancelled the AI plan that would have shrunk some teams by 60%
- Governors who fast-tracked AI data centers are now suspending their own incentives
- Android 17 encrypts the field enterprise web filters read
- Google closes the UK Play Store fee case at 26p in the pound
- Google will demote Play Store apps that overrun its new Android memory ceilings
- Walmart makes charger uptime its own problem at 100 stores
- Brussels decided a chatbot's generated answers count as search results
- Meta budgeted up to $10bn a year with Anthropic even as Zuckerberg warns against rival AI labs
- Nine patched flaws in CryptoPro Secure Disk turn pre-boot encryption into an inventory problem
- OpenAI starts charging some large accounts only for the jobs its model finishes
- VS Code 1.135 sends an agent's work to a second model for review
- Summarizing a webpage was enough to run attacker code in Claude Code's Auto Mode
- GitHub will charge for Copilot seats before developers can use them
- A dropped 'null' turned an NHS test result into the opposite diagnosis
- DOJ downgraded its hacking victims to targets two days after the headlines ran
- SB Energy is paying OpenAI $5.5bn in warrants to keep it as a tenant
- Anthropic wipes saved cards after infostealers copy Claude login sessions
- Music publishers sue Anthropic over pirated lyrics used in AI training
Leadership24 stories
- Golden Dome is changing Russian and Chinese force plans before any interceptor flies
- Brussels moves ChatGPT into the supervision tier it built for search engines
- A cotton tote needs 173 uses before it beats the bag it replaced
- MapQuest converts a map-label refusal into the top of the App Store
- Rough exit scoping hands buyers a number for the renewal conversation
- An AI business case earns its savings claim only by naming both retired work and the new work created
- B:Side Capital named its human-only work before it compared a single vendor
- Anthropic's multi-agent writeup puts the engineering weight on coordination and evaluation
- Late-stage startups are paying for retention with tender offers
- Fake macOS troubleshooting posts route infostealers past Gatekeeper
- Two Republican governors put data center approvals behind a state review
- Cheap tokens are hiding the cost of trusting an AI answer
- Agent loops move the engineering problem to writing the stop condition
- TerminalFix sends the fake CAPTCHA command to PowerShell so multi-line payloads survive
- ClickFix scales by asking employees to paste the command themselves
- A Guardian audit traced invented research through 39 Australian inquiry submissions
- Ireland writes the human handoff into financial services rules
- AI spending is soaring while executives remain unsure it delivers ROI
- Building trades unions turn data center siting into a coalition problem
- A decade-low shareholder proposal count masks support that held or rose
- General counsel now carry the whole risk of excluding a shareholder proposal
- Some employers say they'd rather use AI than hire recent graduates
- AI labs bought tens of thousands of Macs before Apple built a team to sell them
- Bailey puts frontier model release protocols on the G20 supervisory agenda
Science26 stories
- Tagged blue whales pinpoint their feeding along the ocean's narrow thermal fronts
- Petermann's 76-square-kilometer ice island survived its first collision intact
- Federation University tallies one child's year of community sport at $4,567
- Comparative brain data recasts evolution as a tug of war between two wiring styles
- Penn State's millimeter mirror reshapes itself to refocus a laser in microseconds
- Wild mangabeys climb vertical trunks by bending the midfoot 46 degrees
- Chips Act 2.0 aims its new demand levers at chips Nvidia already supplies
- Hollings researchers turn chemoresistance into a target by blocking LOX first
- Siderophore-engineered bacteria weather olivine 2.6 times faster in flowing seawater
- Peptides keep their fold for weeks in 98 percent sulfuric acid
- A deliberately mismatched primer holds CRISPR back until a one-tube test has enough target
- Dog Aging Project ties five chronic conditions to more than double the annual risk of death
- NIST puts two different error bars on the same AI benchmark score
- A study of 30 million death records credits air conditioning with 5,267 US lives a year
- Correcting one assumption turns the EPA's $600 billion rollback benefit into a net cost
- Migraine prevention guidelines elevate CGRP drugs after a 14-year gap
- The 25% CTE figure rests on 338 donated brains out of 1,712 NFL deaths
- Isotopes trace sevenfold lead in Portland-area moss to leaded aviation fuel
- Five mathematicians settle a decades-old percolation question with one argument for many graphs
- Simulated hurricane seasons put a Lili-scale strike on Britain and Ireland every 21 to 33 years
- Volcano forecaster catches four of five Whakaari eruptions for 15 false-alarm days a year
- Stanford shrinks gene activation to fit inside a single viral vector
- Mass bleaching now outpaces the five years corals need to start reproducing
- A RAS inhibitor wins FDA approval in metastatic pancreatic cancer at $39,800 a month
- Timekeepers move to retire the leap second before Earth's spin demands a subtraction
- Antarctica's own seismometers hear hundreds of icequakes at Thwaites and Pine Island