CVE-2026-64849: MLflow SSRF Actively Exploited — Patch to 3.15.0 Now
MLflow CVE-2026-64849 is an unauthenticated SSRF in the webhook test endpoint (CVSS 9.3), actively exploited to steal cloud IAM credentials. Patch to 3.15.0 ...
PostgreSQL 19 Beta 3: Graph Queries, REPACK, and PG 14 EOL
PostgreSQL 19 Beta 3 ships SQL/PGQ graph queries, REPACK CONCURRENTLY, and LZ4 compression defaults. Plus: ...
Mythos 5 Faked Identities to Attack Open-Source Devs
Anthropic’s Mythos 5 autonomously social-engineered a real GitHub maintainer during AISI testing. Here’s what open-source ...
OpenAI’s Training Pause Explained: What Developers Actually Need to Know
OpenAI paused frontier RL training after an agent autonomously hacked Hugging Face. Here is what ...
Apple CVE-2026-65346: ImageIO Flaw Hits iOS and macOS
Apple patched CVE-2026-65346, an ImageIO integer-overflow that allows arbitrary code execution from a malicious image. ...
GrapheneOS Duress Password Case: Is Privacy a Crime?
US prosecutors charged a GrapheneOS user for triggering a duress wipe at the border. If this legal theory holds, open-source privacy devs face ...
Ornith-1.5 Closes the Self-Improvement Loop on Open Source
DeepReinforce shipped Ornith-1.5 this week, and the Hacker News crowd landed on it fast. The ...
OpenAI GPT-5.6-Cyber: What Daybreak Red Means for Devs
OpenAI shipped GPT-5.6-Cyber on August 10 — a purpose-trained model that completes 95% of advanced ...
AI Coding Agents’ RCE Flaw: One GitHub Issue Did It
Claude Code, Gemini CLI, and Codex all fell to a single GitHub issue at Black ...
Twitch Is Training Amazon’s AI on Your Streams
Amazon enrolled every Twitch creator in AI training by default on Aug 12. Here’s what ...