Hi there!

🛡️ Security & Privacy

• Researchers built a sub-$100, coin-sized device that plugs into an unlocked external port on a Boeing 737 and can spoof flight-computer data, take over autopilot inputs, or send commands over in-flight Wi-Fi. More
• A researcher released "ShieldBreak," a Microsoft Defender zero-day that bypasses a prior patch and grants SYSTEM privileges on fully updated Windows 10/11 and Server systems. More
• Cryptographer Matthew Green warns that AI-driven bug-hunting could exhaust exploitable software vulnerabilities within two years, pushing law enforcement toward demanding backdoors instead. More
• A hacker exploited a missing Firestore security rule on meeting-recorder tl;dv to access 181,874 meetings from 84,312 users — including joining live government and corporate calls uninvited — after six months of ignored disclosure. More
• Anthropic will embed invisible text watermarks and C2PA-signed metadata into Claude-generated content, driven initially by EU AI Act transparency rules but rolling out globally. More · More
• Mozilla revoked and rotated the GPG subkey used to sign Firefox and Thunderbird Linux artifacts after an unencrypted copy was accidentally committed to a private GitHub repo. More
• British Transport Police expanded its live facial recognition trial into London Underground stations, starting at Victoria station, as part of a program running through November. More

🛸 Tech

• Buf shipped the first fully spec-compliant Language Server Protocol implementation for Protobuf, bringing go-to-definition, completion, and rich diagnostics to editors like VS Code and Neovim. More
• A widely shared essay, "RISC-V: They Should Have Known Better," argues the ISA's pile of optional extensions fragments implementations and hurts both embedded and high-end performance — sparking a heated Hacker News and Lobsters debate. More
• Zed introduced Delta, a new multiplayer app (built on DeltaDB) for coding with agents where humans and AI share a live, comment-able worktree and conversation history synced with git. More
• ASUS unveiled the Oxiis E250G1, a clip-on friction-drive e-bike booster with 500W peak power, adaptive incline detection, a 50km eco-mode range, and app-controlled ride modes. More

🤖 AI

• Z.ai launched GLM-5.3, whose post-training run unexpectedly produced strong multi-step exploit-chain reasoning; the company is delaying open-weight release by two weeks for safety hardening after the model found over 1,000 real vulnerabilities. More
• OpenAI expanded its Daybreak program with GPT-5.6-Cyber, a purpose-trained cybersecurity model for vetted defenders that completes 95% of advanced exploit-development requests versus 1.5% for the standard model. More
• DeepSeek released Harness, an MIT-licensed, fully pluggable open-source rival to Claude Code, alongside the general-availability launch of V4-Pro and a new peak/off-peak API pricing scheme that amounts to a price hike. More · More
• Anthropic's Frontier Red Team found that independent Claude agents given conflicting goals on a shared codebase escalated into "turf wars" with self-replicating malware, though some negotiated truces or invented tournament-style resolutions. More
• A widely discussed essay argues AI coding tools have removed the natural speed limit on bad engineering decisions, making weak technical judgment far more costly and fast-moving than before. More
• xAI released Grok 4.6, a 500K-context frontier model tuned for long-running agents, coding, and knowledge work, claiming parity with GPT-5.6 Sol at roughly half the price. More
• Meta open-sourced Muse Glimmer, a 30B-parameter agentic model distilled to run locally on a single consumer GPU (under 20GB at 4-bit), aimed at offline agents, tool use, and coding. More
• Docker launched Docker Sandboxes, disposable microVM-isolated environments that let coding agents like Claude Code and Codex run in permissive "YOLO mode" without risking the host machine. More
• Qwen released Qwen3.8-27B, a dense vision-language model with strong agentic, coding, and computer-use benchmarks and a native 262K-token context window extensible to 1M. More
• A new research paper, "Stealing Reasoning Traces from Proprietary LLM APIs," shows encrypted chain-of-thought blocks from Anthropic, OpenAI, and Google can be replayed into a weaker sibling model and decoded in plaintext — exposing real secrets from public agent trajectories. More
• MIT Technology Review's daily digest covers new architectures aiming to succeed the transformer, plus how university AI researchers are adapting as industry outpaces academic resources. More

🛠️ Tools

• Ante is a ~15MB, dependency-free Rust coding agent that works like Claude Code or Codex but runs offline with a built-in inference engine and uses far less memory, CPU, and disk I/O. More
• git-knife is a desktop GUI for rewriting git commit metadata — messages, author/committer dates, and identities — including bulk regex find-and-replace, filling a gap left by existing Git GUIs. More

🚣🏻‍♀️ Misc

• An essay on cultivating creative solitude explores how Alexander Grothendieck and Ingmar Bergman protected the fragile, half-formed ideas that became their most original work. More
• In the Dutch town of Loosdrecht, people live on impossibly thin, boat-access-only strips of land in a lake — leftovers from centuries of peat mining. More
• A deep, technical rumination revisits Whitehead and Russell's Principia Mathematica through the lens of modern computation and formal logic. More

📩 Please feel free to share this article with colleagues and friends who will find it valuable.

Thanks for reading!

Have a great day!
Bogdan