Foundry Local is a local AI runtime that embeds into apps via package managers as a ~20MB native library. Built on ONNX Runtime with automatic GPU/NPU selection, it runs Phi, Qwen, Mistral and more offline through an OpenAI-compatible API.
colleague.skill, yourself-skill, nuwa-skill and other 'human distillation' OSS tools are exploding in popularity, primarily in China. Seeing a tool that distills colleagues, I wondered 'what if I distilled myself?' and researched how.
CVE-2026-40175: unrelated to the March supply-chain compromise. axios's config merge picked up tainted Object.prototype values and passed them through as HTTP headers without CRLF validation, chaining to SSRF. Fixed in 1.15.0.
UC Berkeley's RDI team demonstrated that major benchmarks including SWE-bench and WebArena can be manipulated to near-perfect scores without completing any tasks. They identified 7 vulnerability patterns and released BenchJack, an automated benchmark attack tool.
Anthropic's Claude Cowork moves from research preview to general availability, adding RBAC, group spend caps, usage analytics, OpenTelemetry support, Zoom MCP connector, and per-tool access control.
Adobe released a patch on April 11, 2026 for a Prototype Pollution RCE in Acrobat Reader that had been exploited since December 2025. CVSS 8.6, Priority 1. Apply within 72 hours.
Four Japanese tech giants form a new company backed by mega-banks and Nippon Steel to build a trillion-parameter foundation model for physical AI, with roughly ¥3 trillion in combined public-private funding.
If a long-running Mac suddenly can't open new TCP connections while existing ones keep working, it's the 49.7-day tcp_now overflow in the XNU kernel. Symptoms, why only a reboot fixes it, and the RFC 7323 workaround Apple never implemented.
The latest GlassWorm wave bundles Zig-compiled native binaries in an Open VSX extension and silently installs a second-stage payload across VS Code, Cursor, Windsurf, VSCodium, and Positron.
Google officially ships Device Bound Session Credentials (DBSC) to all Windows users in Chrome 146. By locking private keys inside the TPM, stolen cookies become useless on any other device.
Based on the 2025 Maintainers Summit consensus, coding-assistants.rst was merged into the Linux kernel, establishing rules for AI-assisted contributions: no Signed-off-by for AI, Assisted-by tag attribution, and full human responsibility.
A CVSS 9.3 unauthenticated RCE in the Marimo Python notebook was exploited within hours of advisory disclosure. Meanwhile, Astral published its comprehensive supply chain security posture for uv and ruff, covering CI/CD pipeline hardening, Trusted Publishing, and Sigstore attestation.
