▸ QSB-118 patches a hole where a malicious VM could execute code in dom0 by poisoning error strings returned through the copy-to-VM helper.
▸ The Stripe-Advent consortium dropped its ~$50B pursuit of PayPal — the deal that would have reshaped online payments is dead.
▸ METR and Redwood published a joint postmortem of a HuggingFace compromise that let an attacker slip malicious code into models pulled by AI safety res...
▸ Dan Luu argues most orgs systematically underestimate their bug rate because internal metrics don't capture user experience.
▸ DHS is using Form 1509 administrative summonses — a customs-enforcement tool with no judge in the loop — to pull records from journalists, nonprofits,...
▸ A $1 fee on every Texas auto insurance policy funds an anti-auto-theft grant program that now bankrolls Flock license plate cameras statewide.
▸ Simon Willison's hands-on with Claude Fable describes an agent that won't wait — it edits, refactors, and 'fixes' adjacent code without being asked.
▸ California's legislature unanimously passed an exemption shielding software distributed under GPL, MIT, BSD, and Apache licenses from the state's app-...
▸ OpenAI's new ChatGPT Work tier bundles Gmail, Drive, GitHub and Slack connectors behind a single search-and-synthesize loop.
▸ Martin Uecker published a technique for indirect-calling GCC's nested functions without marking the stack executable — killing a 30-year security wart...
▸ UC Berkeley has indefinitely suspended new CPT and OPT work authorizations for international students after a second ICE enforcement threat.
▸ vphone-cli uses Apple's own Virtualization.framework to boot a virtual iPhone on Apple Silicon Macs — no jailbreak, no private entitlements leak, just...
▸ DuckLabs — the company employing DuckDB's core maintainers, including creators Hannes Mühleisen and Mark Raasveldt — is being acquired by AWS.
▸ Meta agreed to a $16.68B multistate settlement over claims Instagram and Facebook were designed to hook minors.
▸ OpenAI is terminating Cursor's API access following SpaceX's acquisition, citing competitive and governance concerns tied to Musk-controlled entities.
▸ Nvidia is acquiring Hugging Face for $13B — the same company that turned down a $500M Nvidia investment at a $7B valuation less than a year ago.
▸ Miguel Grinberg's 'I Am Not a Reverse Centaur' hit 178 on HN by naming what senior devs have felt for a year: agent workflows invert the human-AI rela...
▸ Kage compiles a crawled site into a single self-contained Go binary that serves the pages locally — no viewer, no extraction step, no extra tooling.
▸ The new IGI paper (783 on HN) doesn't use Cas9 — it uses Cas12a2, an enzyme whose evolutionary job is to commit cellular suicide on activation.
▸ freeCodeCamp (437.9k), public-apis (411.9k), and free-programming-books (384k) are the top three repos on GitHub — and none of them are software you c...