video recaps.
Crypto
CFTC emergency order keeps Kalshi live in New York
The CFTC declared a market emergency on 11 August 2026 and ordered KalshiEX to keep offering event contracts in New York, overriding the state attorney general's bid to shut the exchange down.
Security
OpenAI's cyber model answers 95% of exploit prompts
OpenAI released GPT-5.6-Cyber on 10 August 2026, a model trained to find zero-days and build exploit chains. It completes 95% of advanced offensive-security requests that standard GPT-5.6 Sol completes 1.5% of the time, and it ships only through Daybreak Red, an application-vetted access tier.
AI
Facial recognition arrives on the London Underground
British Transport Police switched on live facial recognition inside a Tube station for the first time on Tuesday 11 August, starting at Victoria. Cameras convert every passing face into a numeric template and check it against a watchlist of people wanted by police or the courts, deleting non-matches automatically. The pilot now runs to November.
Hardware
Intel's $15B packaging bet, explained
Intel is raising $15 billion in new stock, and its own list of priorities puts advanced packaging and external wafers ahead of CPUs. Selling equity rather than debt is deliberate: it protects the investment-grade rating Intel says it wants to keep.
Security
The TeamCity RCE in CISA's KEV, explained
CVE-2026-63077 is a CVSS 9.8 unauthenticated remote code execution flaw in on-premise JetBrains TeamCity, caused by an XStream allowlist that added TeamCity classes without removing XStream's permissive defaults. CISA added it to the KEV catalog on August 5 with a federal patch deadline of August 8.
Startups
Unitree's $9B humanoid robot IPO, explained
Unitree priced its Shanghai STAR Market IPO at 150.8 yuan a share on August 6, valuing the company near $9.04 billion and making it the first publicly traded humanoid robot maker. It raises about $904 million against 2025 revenue of 1.7 billion yuan and roughly 60% gross margins.
Crypto
Strategy sold bitcoin below cost to defend STRC
Strategy sold 1,690 bitcoin for $108.6 million at an average of $64,262 per coin, well under its own $75,385 cost basis, and spent every dollar buying back 1,152,020 STRC preferred shares. The August 10 filing marks the first time the company has realised a loss on bitcoin to defend an instrument it issued.
Security
Valve's Steam hardware data breach, explained
Valve emailed European Steam hardware buyers on August 10, 2026 after attackers stole delivery data from CEVA Logistics, its European shipping partner. Names, addresses, phone numbers, emails and the item and price leaked; Steam passwords, Steam Guard codes and payment details did not.
AI
Meta opens Muse Glimmer, a 30B local agent model
Meta released Muse Glimmer, a 30B agentic model, under an Apache 2.0 license on August 10, 2026. It runs on a single 24 GB consumer GPU, and Meta says open weights for its flagship Muse Spark 1.2 follow in the coming weeks.
AI
OpenAI pauses Astra over Critical cyber rating
OpenAI said on 7 August 2026 that it slowed development of Astra, an unreleased frontier model, after internal evaluations placed it at the Critical cybersecurity threshold of its Preparedness Framework. It is the first time a leading lab has publicly throttled one of its own models over offensive cyber capability.
Hardware
Japan's court kills RED's compressed RAW patent
Japan's IP High Court upheld the invalidation of RED's compressed RAW video patent JP 5231529 on 30 June 2026, ending a challenge Panasonic filed in 2022. Sony, Apple and Nikon all attacked the same patent family and failed. Nikon, which bought RED in 2024, lost this one defending it.
Software
Why Windows 11 Weather eats 1 GB of RAM
Testing published on 9 August 2026 found Windows 11's bundled Weather app holding more than 1 GB of RAM in normal use and peaking near 1.6 GB. macOS Weather does the same job in roughly 250 MB. The cause is architectural: it is an MSN web app running on WebView2, with Chromium subprocesses to match.
Security
How one GitHub issue hijacked three AI coding agents
A GitHub issue filed by an account with no repository access was enough to run attacker code on the CI runners behind Anthropic’s, Google’s and OpenAI’s own coding agents. Novee Security disclosed the chain at Black Hat USA on August 5: Gemini CLI’s flaw is rated CVSS 10.0, Claude Code’s 9.1 on NVD, and all three products failed at the same seam between the agent’s validator and the shell.
Internet
RFC 10023, the for-sale sign for domains
You can now advertise that a domain is for sale with a single DNS record. RFC 10023, published in July 2026 by Marco Davids of SIDN Labs and registered with IANA, reserves _for-sale as a leaf node name and defines the TXT syntax that goes with it. Around 250,000 records are already live, and it is the first IETF-registered underscored record to carry commercial intent rather than technical policy.
Software
Why Shopify moved checkout off Redis
Shopify moved checkout inventory reservations off Redis and into the same MySQL database that already held the inventory ledger, then proved it at Black Friday 2025 peak: $5.1 million in sales per minute with the database writer under 50% CPU. The move was not about speed. Redis could not express multi-location stock or make reserve-and-claim atomic, and the fix was one MySQL row per sellable unit claimed with SKIP LOCKED.
Startups
OpenAI buys NextSlide to aim ChatGPT at PowerPoint
OpenAI has acquired NextSlide, a startup that turns notes and documents into finished presentation decks, and its whole team is now working on ChatGPT. Terms were undisclosed and the deal actually closed earlier in 2026, but it fits a clear pattern: OpenAI keeps buying finished output formats rather than model capability.
Security
SCTPhantom: the 18-year-old Linux bug that hands out root
CVE-2026-64564, named SCTPhantom, is a use-after-free in Linux's SCTP address-reconfiguration code that turns an unprivileged local shell into root and lets an attacker escape a container onto the host. The flawed code shipped in December 2007 and is fixed in kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6.
Hardware
AMD buys Taalas: AI models etched into silicon
AMD is acquiring Toronto startup Taalas, which builds chips with AI model weights etched directly into the silicon instead of streamed from HBM. AMD plans to pair them with its Helios racks so GPUs handle prompt processing while Taalas parts generate tokens, with the deal expected to close in Q4 2026.
Startups
Hadrian raises $1.37B to automate defense manufacturing
Hadrian closed a $1.37 billion Series D at a $7.87 billion valuation on August 6, 2026, to build highly automated factories for aerospace and defense parts. JPMorganChase's Security and Resiliency Initiative anchored a co-lead group alongside WCM, Washington Harbour Partners, Valor Equity Partners, 137 Ventures and Baillie Gifford.
Software
Why the Nixpkgs core team disbanded
The Nixpkgs core team disbanded on August 7, 2026, ten months after the NixOS Steering Committee created it. Its two remaining members cite failed recruitment and steering committee micromanagement, leaving Nixpkgs governance with no direct owner.
AI
Cloudflare's Kitesurf, the browser built for AI agents
Cloudflare's new Kitesurf browser drops Chromium entirely: it is a Rust rendering engine running in a V8 isolate on Workers, using 3.1x to 3.8x less CPU and 4.7x to 7.0x less memory than headless Chromium on agent tasks, while rendering each page about 1.75x slower. It is free in beta and existing Puppeteer or Playwright code reaches it by adding one parameter.
AI
Meta's Muse Code: two prices, one model
Meta shipped Muse Code, a terminal coding agent, on August 5 with two prices for one model: $1.25 per million input tokens, or $0.10 if you let Meta train on your prompts and completions.
Security
86,000 exposed server BMCs, explained
HD Moore's runZero scan found 86,000 baseboard management controllers reachable from the open internet, 54% carrying at least one critical flaw, and 75,000 still vulnerable to a bug disclosed in 2013.
Hardware
Chinese DRAM inside HP and Asus laptops
HP, Asus and Acer have qualified DRAM from China's CXMT and started shipping it in notebooks sold outside the United States, because AI data centres are absorbing roughly 70% of 2026 memory output.
Security
Why cities swapped Flock for Axon plate readers
At least seven US cities that canceled Flock Safety license plate reader contracts replaced them with Axon cameras within weeks. The votes ended Flock's national lookup network, which let out of state agencies search local data, not the plate scanning itself.
Gaming
Switch 2 sales fell 34% but Nintendo profit jumped 150%
Nintendo shipped 3.82 million Switch 2 units in the June quarter, down 34.4% from the console's launch quarter, yet operating profit rose 150.5% to 142.6 billion yen. Software attach and a $300 million tariff refund did the work hardware volume used to.
AI
OpenAI moves to dismiss Apple's trade secrets suit
OpenAI asked a federal judge on August 5 to dismiss Apple's trade secrets lawsuit, arguing Apple never identified any specific secret and only described broad product categories. The 31-page motion also calls the case pretextual cover for Apple's talent losses and AI failures.
Security
How khunt turned Oracle SQL injection into Windows SYSTEM
Attackers exploited a SQL injection flaw in a public web app to compile a post-exploitation toolkit called khunt directly inside an Oracle database, using CREATE JAVA SOURCE to gain SYSTEM-level command execution on the Windows host without writing malware to disk. Huntress disclosed the case on August 5, 2026.
AI
Google DeepMind's leadership shakeup, explained
Google is restructuring its AI leadership: Demis Hassabis moves from Google DeepMind CEO to Chair and Alphabet Chief Scientist, Koray Kavukcuoglu becomes SVP of Google DeepMind reporting directly to Sundar Pichai, and 27-year veteran Jeff Dean is leaving to launch an independent AI research company with Sanjay Ghemawat.
Software
Cloudflare OS: an open agent platform for work, explained
Cloudflare has open-sourced Cloudflare OS, a self-hosted platform that gives every employee an AI agent workspace with zero-trust access to internal systems, deterministic workflows, and shareable full-stack apps, all built on Cloudflare Workers.
Security
The Atlassian Rovo data leak, explained
A researcher disclosed in May 2026 that Atlassian's Rovo AI agent can be tricked by a hidden prompt injection into exfiltrating Jira tickets and Confluence documents to an attacker's website, and despite an initial acknowledgment, the flaw is still unpatched as of this week's public disclosure.
Crypto
Trump Media's last bitcoin is collateral, not treasury
Trump Media moved 2,628 BTC worth about $165 million to Crypto.com on August 2, leaving roughly 4,261 BTC in tagged wallets. Filings show 4,260.73 BTC of that is pledged as convertible-note collateral until May 2028, so almost nothing left is actually free.
AI
Qwen3.8-Max launched with no benchmark table
Alibaba launched Qwen3.8-Max on August 3, 2026, a 2.4-trillion-parameter flagship it calls a new bar for coding, and published no SWE-bench, Terminal-Bench, or SWE-bench Pro score to support it. The pricing is concrete at $2 in and $6 out per million tokens; the capability claim is not.
Gaming
Why Xbox prices jumped in the UK and Europe
Microsoft's Xbox price increase hit Europe and the UK on 1 August: the disc Xbox Series X is now £669.99 and €799.99, and the entry Series S rose 43% in a single day. Microsoft blames memory and storage costs it says have risen more than 2.5x.
Security
The Coldcard firmware bug that cost 1,082 BTC
Coldcard's firmware checked whether a configuration macro existed instead of whether it was switched on. It existed and it was set to zero, so five years of wallets built their recovery seeds from a fallback pseudo-random generator, and an attacker swept roughly 1,082 BTC out of 1,196 addresses in 41 minutes.
Internet
EU AI Act Article 50 explained: what applies today
Article 50 of the EU AI Act applies from today, so chatbots must identify themselves and deepfakes must be disclosed. The machine-readable marking rule for generative systems already on the market slipped to 2 December, which is the part most builders actually needed.
Software
How an AI Collatz proof broke Lean's kernel
A machine-assisted disproof of the Collatz conjecture appeared on 25 July and type-checked in Lean. It was wrong, and it was wrong in the most interesting way possible: it had found a genuine soundness bug in the proof assistant's kernel, letting False be derived through metaprogramming.
Security
Cisco FMC hardcoded credentials, explained
CVE-2026-20316 is a hardcoded login baked into Cisco Secure Firewall Management Center. It has been exploited since early July, CISA added it to the KEV catalog on July 29, and the federal patch deadline is August 1.
Hardware
The FCC humanoid robot import ban, explained
The FCC added foreign-made humanoid and quadruped robots to its Covered List on July 29, blocking new imports. China, which holds roughly 85% of the global humanoid market, threatened countermeasures the next day.
Software
Go's generic collections proposal, explained
Four years after generics landed, a Go working group has proposed container/set, container/hash, container/ordered and heap/v2 for the standard library, targeting Go 1.28.
Gadgets
Lenovo's first Googlebooks leaked: what we saw
Marketing renders of Lenovo's first three Googlebooks leaked on Friday evening: two white clamshell laptops with a blue glowbar and, more surprisingly, a detachable 2-in-1 with a kickstand, stylus and Dolby Atmos speakers, all due to ship this fall.
AI
Why Google pulled Earth's AI image tool in a day
Google switched off the Nano Banana 2 image generator inside Google Earth about 24 hours after launching it, after OSINT researchers showed a single prompt could paste fake nuclear plants, refugee crowds and bombed hospitals onto real satellite maps.
AI
Inside qm, Y Combinator's open-source agent harness
Y Combinator pushed qm to GitHub this evening: the MIT-licensed TypeScript agent harness it runs for its own staff, where every employee and every Slack channel gets its own memory, files, credentials and sandbox. It swaps between Pi, OpenCode, Codex and Claude Code, and ships with a threat model that says out loud what the agent is not trusted to do.
AI
Why xAI's turbines run one more year
SpaceX committed today to removing all 69 unpermitted gas turbines at its Southaven, Mississippi data center, starting as early as August and finishing by July 2027. The turbines are replaced by a permitted 1.2 GW plant of 41 units, so capacity rises while a Clean Air Act suit over the past two years stays live.
AI
How a 439% AI fund lost two thirds in a month
Leopold Aschenbrenner's AI hedge fund told investors it is down about 67% in July, days after selling its entire public stock portfolio to Citadel in one block trade to cover margin calls. The fund is still up roughly 78% for 2026, which is the whole story of leverage in one line.
Security
Unit 42 caught DeepSeek running its own attack campaign
Palo Alto Networks Unit 42 published research this morning documenting a Chinese speaking operator who wired DeepSeek into the Hermes Agent framework and let it hunt targets on its own over Telegram. The agent enumerated 25,209 hosts and triaged them well, but both of its unsupervised exploit attempts failed, and it leaked the operator's own API keys and target lists to the internet.
Software
GitHub ships native stacked pull requests
GitHub put stacked pull requests into public preview on July 30, 2026, giving every repository a native way to split one large change into an ordered series of small, independently reviewable PRs. Merging one layer automatically rebases and retargets the PRs above it, the exact problem third-party tools like Graphite were built to solve.
Security
Cheap Android TV boxes are running an ad-fraud botnet
Bitsight traced roughly 38,000 cheap Android TV boxes sold through Amazon, Best Buy and Newegg to a Chinese ad-fraud operation earning an estimated $50,000 a day. The boxes watch the HDMI signal: when your TV is on they rent your connection out as a residential proxy, and when it is off they sit there clicking fake ads.
AI
GCC bars LLM-generated code past 15 lines
The GCC steering committee adopted a policy on July 29, 2026 declining any legally significant contribution that includes or derives from LLM-generated content, using the GNU Project's roughly 15-line threshold for legal significance. LLM-generated test cases are the single carve-out, and using an LLM to research, find bugs or review patches stays permitted.
Startups
Recursive's $410M AWS compute bet, explained
Recursive Superintelligence signed a $410 million multi-year compute deal with AWS on July 28. It has raised $650 million total, so about 63 percent of all money it has ever raised is now committed to a single cloud vendor.
Security
Arista's CVSS 10 VeloCloud zero-day, explained
CVE-2026-16812 lets an unauthenticated attacker run OS commands on VeloCloud Orchestrator On-Prem by sending a crafted HTTP request. It scores 10.0, it was exploited as a zero-day, and CISA has added it to the KEV catalog.
Web3
Why Ethereum's L2 TVL just hit a 2-year low
Ethereum layer-2 value has fallen back to levels last seen in 2023. Our own DefiLlama pull shows why the headline understates it: Base alone holds 69 percent of L2 DeFi TVL, while ZKsync Era sits at $14 million and Polygon zkEVM rounds to zero.
AI
Anthropic's open-weights position, explained
Anthropic published a policy note on July 27 stating it has never advocated banning open-weights models. Instead it backs three narrower levers: chip export controls on China, action against industrial-scale distillation, and mandatory pre-release safety testing for every sufficiently capable model, open or closed.
Security
The My Eicher fleet platform hack, explained
A researcher walked up the URL tree of the My Eicher fleet platform and found unauthenticated internal APIs listing 748,000 customers, 2.5 million one-time passwords going back to 2021, and 76,000 identity documents, enough to take over any account and track 676,000 commercial vehicles in real time.
AI
Opus 5: 97% vs 24%, explained
A fresh run of SlopCodeBench put Claude Opus 5 at a 24% strict pass rate across 17 evolving checkpoints, four times better than Opus 4.8 and Sonnet 5 at 6%, but nowhere near the 97% it scores on SWE-bench Verified. The gap is the difference between fixing one issue and maintaining a codebase as the spec keeps changing.
Security
GitHub halves public bug bounty payouts
From July 27, a critical vulnerability reported through GitHub's public bug bounty pays a flat $10,000, down from a range that topped $30,000. The top money moves to an invite-only VIP tier, and GitHub says the reason is a triage queue drowning in low-effort and AI-generated reports.
AI
Kimi K3 open weights and the hardware math
Moonshot promised Kimi K3's weights by July 27, 2026. Even if they land on time, the file is roughly 1.4 terabytes at four-bit precision, which needs about eighteen 80GB accelerators just to load before serving a single request. Open, in this case, does not mean runnable.
Startups
Kalanick's Atoms raises $1.7B for physical AI
Travis Kalanick has closed a $1.7 billion round led by Andreessen Horowitz for Atoms, a holding company that folds CloudKitchens and the robotics firm Pronto into one bet on automating food, mining and transport. Ben Horowitz joins the board and no valuation was disclosed.
Software
Debian’s four AI proposals, explained
Debian opened a General Resolution on July 24, 2026 with four seconded proposals for LLM-assisted contributions, ranging from an outright ban to a permissive disclosure regime. The winner becomes the first binding AI policy at a distribution thousands of downstream projects inherit from.
Hardware
GM’s sodium-ion grid bet, explained
GM and Peak Energy are building a $71 million, 4 GWh sodium-ion factory near Sacramento for grid storage only. The cells lose to lithium iron phosphate on density and per-cell cost, but claim 20,000 cycles, 96% round-trip efficiency and no cooling loop at all.