54 of 55 advisories from one GitHub account were fabricated, likely by AI. How six fake SQLite CVEs passed MITRE and NVD unchecked, and why scanner hits for them are false positives.
Unit 42's three Pass-ta-key attacks need malware already on Windows, no admin rights. The SDS master key sits in Chrome memory in plaintext, with no way to rotate it.
Aug 4, 2026: the keyv worm hit 12 unrelated orgs in 3h43m, and the poisoned builds carried valid GitHub Actions provenance. Why rotating credentials first is the thing that triggers the payload.
Tested on M1 Max 64GB: SeFi-Image turbo runs on MPS in bf16 at 13–47s/image; fake text and face artifacts only clear up on 5B RL at 50 steps, 18 min/image.
Measured on M1 Max 64GB: weight-only INT8 runs 41% slower than fp16, a hand-written Metal int8 GEMM 15.6x slower, MPSMatrix int8 3x, and MLX 8-bit 9% slower.
Tested on M1 Max 64GB ComfyUI: v0.24.1 fails to load int8_tensorwise, v0.30.1 hits the missing aten::_int_mm MPS kernel, and a dequantize patch runs slower than bf16.
Tested on M1 Max 64GB: AnimaLoraToolkit + Anima-Base crashes on torch 2.6.0 (MPS SDPA bug) but runs 300 steps clean on 2.7.1, at ~21 s/step, roughly 9x slower than an RTX 5090.
WordPress Core trimmed its PHPUnit CI matrix ahead of 7.1. PRs now test 3 PHP versions, a Sunday cron covers the rest weekly, and reruns dropped from about 68% to 36%.
Muon and SOAP cut final diffusion loss 18% vs AdamW. Mapping that to Anima (Cosmos DiT) and SDXL U-Net LoRA training, plus existing LoRA-Muon research, before writing any code.
15 formats renamed to .png, then Rails 8.1.3 vs 8.1.3.1 on one attachment: SVG logged 123x45 on the vulnerable build, nothing on the patched one. Plus the matload entry point and the libvips 8.13 floor that stops boot.
MCP 2026-07-28 drops initialize, session IDs, and SSE resume; Sampling, Roots, and Logging are deprecated. I wrote minimal servers for both specs and diffed them with curl.
