Tailscale Traced Database Corruption to a 16-Year-Old SQLite Bug
SQLite is about as close to “boring, reliable” as a database gets. It sits inside phones, browsers, and countless desktop apps, and most developers never think about it twice. So when Tailscale, a company that runs a mesh VPN used by thousands, started seeing their SQLite databases get corrupted, the last thing anyone expected was […]
Researchers pull hidden reasoning out of Claude, GPT, and Gemini
Advanced AI models do not give you a straight answer all at once. They break a problem into pieces and work through them step by step, in a chain of thought that providers deliberately keep hidden. That hidden reasoning is valuable, because it is exactly what you would want if you were training your own […]
Mythos Attack Breaks a Post-Quantum Crypto Candidate, and the Lesson Is Uneasy
Late last month a team of cryptographers took a post-quantum signature scheme out of contention before it ever shipped, and they did it with an attack that left the research community quietly reassessing how much trust to place in the standards pipeline. The scheme was HAWK, a lattice-based digital signature candidate that had made it […]
Januscape: The 16-Year-Old KVM Flaw That Earned a $250K Bounty
Google handed out $250,000 for a Linux kernel vulnerability that had been hiding in plain sight for 16 years. Named Januscape and tracked as CVE-2026-53359, the flaw is a use-after-free bug in the KVM hypervisor’s shadow MMU code. It lets a guest virtual machine escape to the host, and it is the first KVM exploit […]
pgrust shows Postgres can catch up on analytics with batching and SIMD
A Rust-based Postgres rewrite called pgrust has been making the rounds, and its claim is hard to ignore: it runs analytical queries hundreds of times faster than stock Postgres. The author’s write-up walks through how, and the techniques are refreshingly concrete. This is not a vaporware benchmark grab, it is a working implementation that passes […]
OpenAI’s GPT-5.6 upgrade brings better accuracy and free unlimited chats
OpenAI shipped a meaningful upgrade to ChatGPT this week, and the headline is simple: most of it lands for free users too. The company introduced GPT-5.6 Sol for Plus and Pro subscribers, made GPT-5.6 Luna the default for Free and Go tiers, and gave everyone a couple of new controls over how the model reasons. […]
Amazon Ties Debug and Chalk NPM Hijacks to North Korean Hackers
A pair of hijacked packages on the npm registry turned into a reminder of how fragile the JavaScript supply chain really is. Amazon publicly attributed the takeover of the widely used debug and chalk packages to a North Korean threat actor it tracks as Sapphire Sleet, grouping the incident in with a broader campaign of […]
GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI both introduced time-based security measures this month that deliberately slow down the software supply chain. The idea is simple: make it harder for attackers to push malicious packages into your dependencies before anyone notices. Dependabot now has a default three-day cooldown before opening version update pull requests. PyPI will reject new file […]
Microsoft Just Made It Way Easier to Plug AI Agents Into Your Database
Microsoft Just Made It Way Easier to Plug AI Agents Into Your Database Microsoft has announced the general availability of the MCP Toolkit for Azure Cosmos DB (v1.1.2), giving developers a standardized way to connect AI agents and copilots directly to their operational data. The toolkit, which first appeared in preview at Ignite 2025, is […]