Front-page articles summarized hourly.
Play in landscape orientation—rotate your device to play.
Flowise is winding down as AI models mature and coding agents reduce the need for rigid low‑code workflows. Key dates: July 29, 2026 (announcement and code freeze); August 10, 2026 (repository archived); August 31, 2026 (end of life). The Apache 2.0 licensed code will remain on GitHub for forks, with core team presence ending and community moderation handed off. Users are encouraged to fork the repo to continue development. Thank you to the community.
Bugtraq is back. SecurityFocus has acquired Bugtraq and relaunched the mailing list with the same address ([email protected]) and a mission of full disclosure, researcher-first, without corporate filters. Old archives will be preserved separately. The post invites vulnerability disclosures, 2026 disclosure discussions, and community input to restore Bugtraq’s role as a hub for security history. It stresses preserving historic exploits and analyses in an era of AI-generated knowledge and disinformation.
Cloudflare blocks access to acm.org, requiring cookies; the message explains a security trigger blocked the action (e.g., certain words, a SQL command, or malformed data). It advises contacting the site owner with what you were doing and including the Cloudflare Ray ID and your IP to resolve the issue.
fec is a Rust crate for forward error correction targeting SDR, space, and satellite links. It implements convolutional (Viterbi) codes (rate 1/2 to 1/8, k 4–16) with hard/soft decoding and optional SIMD acceleration on nightly builds, plus Reed–Solomon (GF(2^8)) CCSDS (255,223) coding with error and erasure decoding and dual-basis representations. It draws inspiration from libcorrect, is compatible with Phil Karn’s libfec (not borrowed), and offers a fec-shim for a C ABI. BSD-3-Clause license. Roadmap: more widths, erasures, punctured codes.
FIPS 140-3 validates a module boundary for a specific firmware/config and approved algorithms; it does not prove product security, correct operation, or proper key management. Most buyers leave FIPS mode off despite buying the certificate, because the certificate’s scope is narrow and drift is common. Validations are snapshots; upgrades can leave devices off validated status for periods, and known flaws persisted in validated modules (ROCA, EUCLEAK, Dual_EC_DRBG, YubiKey). Auditors focus on process, attestations, and key provenance, not the certificate alone. Treat the certificate as a floor; verify configuration, maintain lifecycle evidence, and document non-approved choices if FIPS is off.
Researchers found three WebKit features in iOS/macOS proxy browsers that bypass proxies and reveal the device’s real IP: DNS prefetching (DNS lookups via the device path, bypassing proxies; iOS 26.0+), WebAuthn Related Origin Requests (validation fetches from OS credential service, exposing the real IP; iOS 18.0+), and WebTransport (HTTP/3/QUIC connection opened directly from the device; iOS 26.4+). These leaks also affect Apple iCloud Private Relay; VPNs remain unaffected. Psylo 1.3.1 blocks dns-prefetch, disables WebTransport and WebAuthn by default, with per-silo toggles to re-enable.
Pi is a minimal, extensible coding harness designed for cost and performance. It ships with four tools and a sub-1,000-token system prompt, encouraging users to build what they need. Databricks found that Pi, with a lean harness, delivered higher pass-rates at lower cost than larger rivals, thanks to tighter context. Shopify’s Pi Autoresearch shows extensibility yields major productivity gains without bloating the core. The core message: minimal, context-disciplined interfaces cut costs and keep power through user extensions, especially useful for local models.
Unit 42 analyzes passwordless attack surfaces targeting Google's synced passkeys and Cloud Authenticator. It details three attacks: Pass-ta-key, where malware signs with the device identity key to authenticate without user interaction; Silver Pass-ta-key, which replaces the UV key to bypass user verification and automate logins; and Golden Pass-ta-key, which steals the SDS master key to decrypt all synced passkeys and takeover accounts. Attacks exploit onboarding/recovery flaws and weak UV validation. Mitigations include strict user verification, validation of key registration/attestation, hardened onboarding/recovery flows, restricting local passkey data, and better anomaly detection. Security remains multi-layered; endpoint compromise remains a risk.
A post on X is unavailable because the account owner restricts who can view their posts; to see it, the viewer must log in or sign up, with standard login prompts and footer information shown.
libexpat, a fast cross-platform streaming XML parser in C99 under MIT, is funded for up to six months by the City of Munich’s Open Source Sabbatical program. Starting Aug 1, 2026, Sebastian Pipping will work full-time on libexpat maintenance, remotely via digital@M. Priorities: fix five known unfixed vulnerabilities, add XML 1.0r5 support, and improve robustness and maintainability. He recently fixed a Mozilla-identified vulnerability. Community contributions are welcome; he asks for vulnerability reports and tips on Clang/MinGW/AddressSanitizer/Wine setups.
An essay tracing Leopold Aschenbrenner’s SALP: a highly concentrated, levered bet on AI hardware and related assets that surged before liquidating as liquidity dried and margin pressure mounted. It argues liquidity is a crowd-driven system: once longs exhaust, only traders and weak hands remain, making liquidation inevitable. Linking SALP to past blows like LTCM and Amaranth, it blames Leverage + Concentration and offers lessons on risk management, sizing (Kelly), and the need for sober, battle-tested capital allocators over flashy genius.
Could not summarize article.
This article shows how to build combinational logic inside VP8 key-frames by abusing prediction modes. Treat all-white/black blocks as wires; use horizontal and vertical prediction (H_PRED, V_PRED) to route signals. TM_PRED blocks implement arithmetic-based gates: NOT via 255 − x and AND via A + B − 255, enabling NAND as well. With these gadgets, arbitrary logic circuits can be constructed. The piece focuses on key-frames, hints at future synthesis from Verilog to VP8 frames, and suggests exploring sequential logic with inter-frames.
Centering a div used to require absolute positioning and transform; now CSS grid with place-items centers content. But in a webview with chrome (sidebars, DevTools), the centered element lands in the wrong rectangle. A fix computed the chrome width (outerWidth-innerWidth) and shifted the element, but DevTools disrupted this. The breakthrough was using the pointer to locate the webview within window: by comparing screenX, clientX and scale, you can derive a left/right offset to center. Firefox exposes this; Chromium does not, so the approach starts with an estimate and refines on pointer entry. The author also released a 'center' demo.
TechAscent explains integrating DuckDB with Clojure to power laptop analytics via TMD (tech.ml.dataset). A bridge between functional, in-memory columnar processing and relational storage, DuckDB’s batched C interface enables large joins without loading all data into memory. The piece walks through a workflow: importing a 50GB CSV (400M rows) into DuckDB, adding a colors dataset, and performing a 1.4B-row join in seconds, plus color-by-month aggregation. It notes zero-copy query paths, BRIN and ART indexes, portability (C++11), MIT license, and open development, showing why DuckDB complements TMD for on-laptop analytics.
INTERPOL’s Africa Cyberthreat Assessment 2026 says AI drives 55% of cybercrime on the continent, with online scams the top threat. AI-powered fraud, stolen credentials, and social engineering push losses from $192m (2024) to $484m (2025). Regions differ: East Africa faces mobile-money fraud and ransomware; West/Central Africa, BEC and romance scams; Southern Africa, highly connected, attracts international networks. Deepfakes and synthetic identities amplify sextortion and fraud (TrendAI notes ~600,000 sextortion cases). Gaps in real-time data sharing and preparedness persist; 17 countries updated laws; four operations yielded 1,500+ arrests and over $100m recovered.
Troy Hunt analyzes a surge of FedEx/parcel‑duty phishing SMSes and how they slip past controls. He flags seven dodgy signs: typos and odd capitalization, a short/identical tracking number, urgency, and a suspicious domain (bpoint.com.au). Verifying via legitimate sources shows the link can be tampered with to modify values, and the messages imitate FedEx and Australia’s BPOINT. A follow‑up email later contains the actual invoice, illustrating a combined SMS/email scam. He argues for combining user vigilance with technical controls, noting Australia’s multi‑billion losses to scams.
Made by Johno Whitaker using FastHTML