Daily coverage of AI, developer tools and infrastructure. Each story explains what happened and why it matters, with a link to the original source.
Meta launched Muse Spark Open, an 816B parameter model that competes with Chinese AI rivals but requires large companies to sign separate agreements for commercial service offerings.
Attackers are exploiting CVE-2026-105740 in Langflow to run arbitrary code via MCP server configurations, with over 1,400 attempts recorded.
A new auditing system called EnvCheck identified 110 reward hacking vulnerabilities and grading bugs in Terminal-Bench, DeepSWE, and BFCL using a multi-agent swarm approach.
OpenCode 2.0 launches with a background server process, a new API, and a JavaScript interpreter for agent tool composition.
GitHub now expires unvalidated npm trusted publishing configurations after 48 hours to prevent package hijacking via repository slug reuse.
A researcher found a critical vulnerability in Google's DevSite platform where an OAuth client secret was used to sign session cookies, enabling remote code execution across multiple domains.
Voxlocal is a minimal, open-source voice agent written in Rust that runs locally on macOS. It demonstrates how to chain speech recognition, vector search, and small language models for low-latency int
CrowdStrike and ZenoX report that attackers used open-source AI agents ARTEX and SCARLET LOOP to breach South Korean banks and Brazilian loyalty platforms in late 2026.
Cactus Compute releases Whistle, a tiny open-weight speech model that runs on CPUs without dependencies and integrates with the Needle engine for direct tool calling.
Portia is a new open-source tool that profiles data, generates SQL, and validates results without the AI model ever reading raw records.
The x32 ABI allows applications to use 32-bit pointers while retaining 64-bit registers, reducing RAM usage significantly without sacrificing speed.
OpenSearch veterans launch Infino, an open source retrieval layer that lets AI agents query a single Parquet copy of data, replacing fragmented search and vector stacks.
Eight malicious npm packages in the MALFEX campaign have been downloaded over 40,000 times, delivering remote access trojans and information stealers to Windows systems.
A three-month trial shows AI improves drafting quality for all lawyers, but only seniors gain unassisted judgment skills while juniors see polarized results.
Google has temporarily stopped paying for product vulnerability reports in its open source bug bounty program due to a spike in invalid automated submissions.
