199 stories published this day, by desk. Times are Pacific.
Security31 stories
- Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks
- CISA logged more than 100 compromised water systems in July, typically reached through cellular modems
- Huntress found four paths to an AD RMS root key that cannot be rotated
- One unhidden IP address at an exchange signup broke the $240 million bitcoin heist case
- Meta cleared 43 of 55 reported AI-CSAM ads in India as compliant with its Advertising Standards
- A 95-item bug report ended in a $100,000 demand to keep the real findings quiet
- A 472-character invisible payload steered an email summarizer into reporting only the attacker's text
- CIA deputy director credits cyber operations for the picture that found Maduro
- Microsoft bundles September's 1,000 Windows 11 fixes with a movable taskbar and new Search defaults
- NSA, CISA and FBI name six Chinese AI companies as industrial-scale distillers of US models
- Bitdefender counts 55.2% of breached practitioners asked to keep the incident quiet
- AFP, FBI and Western Australia Police arrest two men over the TeamPCP npm attacks
- Microsoft's record 964-CVE Patch Tuesday includes two exploited zero-days
- Shai-Hulud's third wave printed SAP's npm token straight into a workflow log
- DHS's Predictive Intelligence Targeting Teams screen financial activity to seed local traffic stops
- ShinyHunters claims it scraped 200,000 driver records out of Florida's DAVID lookup portal
- DFIR Report puts eleven years of Bing SEO poisoning on two Rajasthan IT firms
- NSA advisory tells AI providers to subtly degrade answers for suspected distillation accounts
- A State Department listing pulled the domain and the bank out from under 16,000 mailboxes in two days
- Slim Spider lifted crypto custody keys out of a Brazilian bank's cloud secret manager
- Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours
- Flock shed more than 90 city and county contracts in August alone
- Two chained N-central bugs hand an unauthenticated caller a System administrator account
- Check Point passed a task between two ChatGPT accounts through OpenAI's internal package service
- Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share
- An unauthenticated LDAP client can write itself into FreeIPA's administrators group
- StyleSmuggler turns a Magento payment-reminder email into unauthenticated code execution
- ClickFix crews shift paste target to Chrome address bar or Tampermonkey
- JSCeal drives the victim's own browser to take over their Google account
- Gamers Nexus teardown finds LG TVs inventorying the LAN they sit on
- OpenAI's test agents escaped through the one network path their sandbox allowed
Build62 stories
- An assertion budget scores the test AST before CI installs anything
- Ten-year LTE-M battery numbers rest on PSM timers the network overwrites at attach
- A bare ToolNode.invoke() has needed a Runtime object for eleven months
- A six-person team's weekly review load grew 7.6x in a quarter
- The mint-creation opt-in decides which Solana tokens can ever go confidential
- Human editing carries the only registrable copyright in an AI-assisted asset
- A reassigned ticker sent a real order into Bath & Body Works instead of LandBridge
- An infected ScreenConnect guest pushes scripts up the support session to the operator's host
- Two chained RouterOS flaws hand admin to an attacker who knows a username and a modulus
- StyleSmuggler runs its PHP inside Magento's failed-payment email renderer
- Inception's 1,107 tokens per second needs a batch size before it enters your capacity plan
- Google puts a price aggregator above the EU rankings your tracker still reports
- Closing N-central's CVSS 10.0 pre-auth RCE takes build 2026.3.1.14
- CauterRule's replay test passed a rule whose trigger was just "step_1"
- Kestra 2.0 takes the database credential out of the worker
- BigBear 2.0 breaks WebAuthn in the browser to force a relayable MFA fallback
- A backdoor built as an HAProxy filter suppresses the log lines that would show it
- Any path containing a dot skips LibreDB Studio's Next.js middleware
- Spotify's shunt hook blocks non-targeted Claude Code file reads past a configurable line threshold
- kagent 0.10 ships its RFC 8707 token scoping as an empty string you fill in yourself
- A decorative checkmark crashes pytest on a runner that boots with LANG=C
- Meta's three-second webhook window turns a slow WhatsApp handler into duplicate replies
- MLflow now drives lifecycle promotion inside SageMaker's model registry
- MCP's shipped auth extension buys the agent's token with an employee's browser login
- Meta's Muse puts its approval prompt on three outbound verbs
- Buckmaster put every draft into Codex before OpenAI described the same proof path
- Amex's cell boundary keeps a failing payment inside the cell that started it
- WebKit rebuilt Safari's module loader instead of patching top-level await again
- A 6% driver reserve decides which models fit on a $2,000 pair of P40s
- IonQ's secp256k1 estimate spends 13 physical qubits on every logical one
- UpdateRecord moves Feature Store's merge from your pipeline into the service
- Nex-AGI's runnable N2.5 tiers ask for two H100s or sixteen H200s
- ASML's 40 percent throughput gain lands five years after Samsung's High-NA line starts
- The $0.00799 fine-tuning rate in your Bedrock budget belongs to Llama 2
- Only one of three model backends can refuse a wrongly shaped JSON response
- Path rules sort 50 of 93 changed files to the bottom of the review
- Two common Factur-X construction errors clear both veraPDF and Mustang
- Escalating retries recover the 7,930 refusal prompts a single steering pass drops
- A squashed initial commit left 68 template-built sites running 28 versions
- ZeroShot Studio moved its rewrite veto out of the prompt and into a pre-write code hook
- A pull request comment triggered a trusted workflow that published ten malicious npm versions
- llama.cpp takes roughly half an hour to reach first token on an RTX 5090
- Spotify traces the default Bayesian A/B stopping rule back to peeking
- Attacker PHP executes when Magento renders its failed-payment reminder email
- Per-origin probing cut Cloudflare's origin handshake retries from 52% to 3.7%
- ingress-nginx's retirement turns Gateway API migration into a patch deadline
- Kraken moved its Celery queues to a new vhost before touching RabbitMQ 4
- A flag file in /tmp decides whether the agent is allowed to stop
- Children in an EU survey asked for follow-up more often than for easier reporting
- Reviewing every PR with Claude first changes what the senior reviewer looks for
- Explicit status tracking, not just appending prices, exposes a broken selector in SQL
- Copilot's extension path charges a public webhook before any skill code runs
- Anonymisation trades away the property that made the test fixture useful
- A per-title FIFO queue is all that joins Craigslist's JSON-LD to its DOM
- Anthropic's Fable 5 answers the old thinking toggle with an HTTP 400
- Redefining done as 'prove the money path' made the agent provision its own infrastructure
- Stripped GLM-5.3-Flash weights show what Z.ai's MIT license permits
- One dev's agent logs showed the same three fixed steps every run, no reasoning loop needed
- A fresh agent session picks the stale comment over the code that contradicts it
- WordPress disclosures with no patch on day one nearly doubled in 2025
- Mistral puts a price on where your inference runs
- Configuration closes two of the three plaintext hops in "TLS everywhere"
Invest47 stories
- Bitmine concentrates 94% of its assets in the token Lee says will beat bitcoin
- OpenAI's cost-per-task argument buys Luna room for ten failed tries before it loses on price
- Block applies for OCC trust bank charter, joining 22 other digital-asset applicants
- Foldable phones, growing 30% a year, could reach about 2.6% of the global smartphone market
- Two months of payroll revisions wiped out more than 50,000 jobs a month of reported hiring
- Democrats hold roughly 2-to-1 Texas advertising edge after MAGA Inc's $10 million boost to Paxton
- Diesel at a record $5.90 is where Hormuz risk actually lands on a P&L
- Morgan Stanley's 4%-for-1% cushion prices one lost wage dollar at 24 dollars of paper gain
- Intel's 9% jump prices a mid-2028 wafer promise at 92 times this year's earnings
- Google moves Booking.com above the hotels whose real-time prices it just removed
- OpenAI and Anthropic's bankers are pre-clearing the labs for insurance and pension bond money
- ARK asks the SEC to let its venture fund settle shares same-day on a blockchain
- Binance stakes its CIS settlement hub on a Kazakh central bank payment licence
- Banks' data nutrition label asks credit bureaus to sign for the goodness of what they sell
- A fake Google and Gemini call delivered 94% of the thefts named in Malone Lam's plea
- Cognition's $48bn price keeps the same 53x run-rate multiple it carried in May
- GAO traces the cost of a cannabis bank account to dedicated staff and monitoring systems
- Solana's 4,096-byte transactions break the tools that only read blocks
- Robinhood's record 13.6 billion event contracts earned it about a penny each
- Runway's ARR doubled to $200M in five months, driven by enterprise growth
- Robinhood pays in paper for a clearinghouse it does not have to build
- Meta launches Muse personal agent app with subscription tiers, eyes possible commerce cut
- Untagged Elements code drained 95% of Liquid's reserve in 23 minutes
- A 20-minute Sapien rebuild turned $10M of claimed Carlex EBITDA into a $2M drag
- Mamdani puts City Hall's referral machinery behind private-sector union drives
- A German programmer wiki absorbed 15,000 agent edits before researchers went looking
- Kalshi and Polymarket will trade the midterms before any court rules on their legality
- DeepMind makes Isomorphic Labs license the genome atlas academics can browse free
- Dell booked nearly two-thirds of its $95bn backlog in a single quarter
- Aging accounts for about a seventh of the participation drop that pulled unemployment to 4.1%
- Robinhood buys into OG.com at the $5bn mark Citadel set in July
- Qualcomm hands Amazon 25 million share warrants to buy its way onto AWS's silicon roster
- Hunter Biden's LAPTOP token airdrop targets TRUMP losers, Substack subscribers and friends
- Samsung SDS will orchestrate other people's robots across 1,000 of its own worksites
- Mistral's record round covers three quarters of the data centres it already ordered
- Canada's export shift away from Washington runs on barrels that started moving in 2024
- Nike's 78.4% drawdown outruns the three points of share it actually lost
- Alberta courts data centres with concierge service and two-percent levy, as Ottawa's principles remain unenforced
- Washington's claim on 65 billion Venezuelan barrels translates into about 200,000 a day
- Materiality test hands bank supervision's early-warning work to boards
- Korea's capital firms shift toward short-term funding, raising maturity mismatch risk
- Nine Swiss institutions give their franc stablecoin 114 days to produce a result
- Veridue banks $4M on cutting energy deal diligence from 400 hours to a few
- Ground A raises 9.1M euros to put a high-energy laser on a Euro pallet
- Binance's bStocks took 27% of a tokenized equity market that adds up to about $1.85bn
- Huawei claims stacked circuits deliver the density lithography would need three years to reach
- Decart's founders traded a higher Nvidia bid for Anthropic paper that never printed
Product47 stories
- CloudNC raises $20M extension to expand CAM Assist, an AI tool that drafts CNC programs for human review
- Tillis says the CLARITY Act fails unless the White House bargains on ethics language
- Samsung cut 75 grams over seven years to put its foldable under its non-folding flagship
- Employers are scoring workers on AI usage in performance reviews
- The Project button hands ChatGPT and Claude every file in the folder you point at
- Anthropic suspended a consultant's Claude account for two weeks to stop a token thief
- Amazon's Qualcomm warrant vests in tranches tied to up to $60bn in chip purchases
- Adobe wired OpenAI's Images 2.5 into Firefly on launch day
- Cardiff's IQE prices a Beijing licensing decision into its second half
- Nandy will legislate device-level nudity blocking after Apple and Google's commitments fell short
- Meta's new AI ad screening let more than 250 CSAM ads run since August
- Mathematicians set the verification bar for AI proofs by shipping the Lean file
- Google Cloud puts 1,000 Accenture engineers between Gemini Enterprise and its buyers
- IonQ credits SkyWater's standard lines with cutting its chip design cycle to two months
- Investors repriced Cognition at $48bn without touching the revenue multiple they paid in May
- OpenAI points Images 2.5 at the edits that used to degrade the rest of the frame
- Former FTC lawyers sue Anthropic over the five-hour window behind Claude Max's 20x
- AI bug-hunting models pushed Microsoft's four-month patch total to 4.5 times its old baseline
- OpenAI denies reading two mathematicians' Codex logs before racing them to Navier-Stokes
- DeepMind turns variant scoring into a lookup by precomputing 9 billion mutations
- Extended Stable now bundles four Chrome milestones into the same eight-week window
- A fake MyChart 'Medicare Kit' pulled dozens of hospital systems into scam warnings
- Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript
- Washington tells Britain a trusted-news boost would hand authoritarians a drafting template
- The UK will legislate the nudity block Apple and Google were asked to volunteer
- Canberra unveils draft law requiring algorithm opt-out via pop-up
- Firmus sells OpenAI the grid connection Stargate Korea still cannot find
- China prices Japanese deposition gas out of its own fabs with a 99.2% deposit
- Britain's grid operator filed its Palantir lock-in as the legal basis for a £21.2m direct award
- Zeiss lenses are doing the printing inside China's flagship domestic DUV machine
- Arm claims 1.7x on AI models by doubling the matrix units inside its CPU cluster
- ISD counted 150 AI cartoon jihad videos on TikTok with 5.4 million views
- Four in five Chinese used-car dealers now turn away EVs older than five years
- Extortionists are ransoming Instagram accounts for $50 because Meta's appeal takes weeks
- South Korea's power planners added 27GW to their 2040 demand forecast in four months
- DeepMind's shared knowledge library spread one agent's cheat to 14% of its swarm in 27 minutes
- Google traces a six-hour credential harvest to a coding chatbot running markdown playbooks
- ASML lines up TSMC and Samsung behind a photomask change that pays off in 2033
- Memory price rises slow to 13-18% as PC and phone buyers stop absorbing them
- GitHub's HydraFusion turns model selection into a routing decision Copilot makes for you
- Google strips real-time prices from the travel carousel in its EU search remedy
- Dacia builds its cheapest EV in Slovenia to collect the subsidies aimed at Chinese rivals
- Two-thirds of large organisations have redefined digital sovereignty as resilient interdependence
- Mistrust of Palantir is now showing up in the NHS opt-out numbers
- Anthropic completed diligence on Decart's efficiency stack and then walked away from $6bn
- XPeng points its first IRON humanoids at its own stores and campuses
- Australia's draft bill would make platforms keep asking if you want the algorithm off
Leadership9 stories
- DeepSeek's V4 preview cuts million-token KV cache to a tenth of V3.2's
- A Wharton paper prices the gap between what firms do on the environment and what they say
- Anthropic hands Claude Code's approve button to a second model
- OpenAI's Navier-Stokes claim sparks dispute over whether mathematicians' data was accessed
- Researchers quantify the board-strategy gap Elliott alleged at Norwegian Cruise Line
- DOJ retires the 1987 letter that underwrote ISS's antitrust comfort
- AI revenue headlines now rest on definitions the buyer has to ask for
- Three governors curb data centers with a moratorium, permitting overhaul and tax pause
- Cheap code removes the price signal that used to kill weak features