YuSMP Group newsroom
IT & engineering news
for people who ship
What's actually changing in software right now — AI in production, cloud economics, security and the EU/US compliance clock — written by senior engineers for US and EU product teams, not by anyone reciting a 2021 benchmark.
All stories
Security
6 min read
City-Forum Campaign Raids Salesforce and ServiceNow Portals via Guest Misconfigurations
A year-long campaign exploiting permissive guest accounts in Salesforce and ServiceNow portals — no CVE, no patch, just configuration drift. The busiest victim logged 560,000 requests from one IP.
AI / Enterprise
5 min read
IBM and OpenAI Form Enterprise AI Alliance: What Software Teams Should Know
IBM joins OpenAI's Elite partner tier, embedding GPT-5.6 and Codex into IBM Consulting Advantage. Forward-deployed engineers will deliver AI implementations directly to fintech, government, and retail clients.
AI / LLM
6 min read
Gemini 3.7 Flash: Faster AI for Coding and Agents
Gemini 3.7 Flash scores 65.3% on DeepSWE — up 16 points from 3.6 Flash — and ranks #1 on FrontierCode 1.1. Cost is halved to $0.75/1M input tokens through end 2026. What it means for your agent stack.
Security
6 min read
Adobe Commerce Critical Auth Flaw Exploited Within Hours of Patching
CVE-2026-71362 (Critical) lets attackers hijack any customer session in Commerce or Magento with no login. Sansec blocked exploitation within hours of Adobe’s advisory — same-day patch required.
Security
6 min read
Cisco Firewall SSL VPN Flaw Actively Exploited — Patch ASA and FTD Now
CVE-2026-20349 (CVSS 8.6) lets attackers crash Cisco ASA and FTD via a crafted SSL VPN request. Actively exploited; CISA deadline 14 Aug 2026. No workarounds — patch your hotfix now.
AI / Open Models
6 min read
DeepSeek V4 Pro Goes GA: What Engineering Teams Should Know
V4 Pro 0813 is generally available from 13 August 2026. MIT weights, 1M-token context, #3 on Artificial Analysis — and a 4.5x API price rise on 16 August. What teams need to decide now.
AI / Dev Tools
6 min read
VS Code 1.133: Agent Host Decouples AI Agents from the Editor
VS Code 1.133 ships a dedicated Agent Host process and open AHP protocol. AI sessions persist across windows, run remotely over SSH, and support mid-conversation model provider switching. What enterprise dev teams need to know.
Cloud & AI
6 min read
IBM Bets $240M on Open-Source AI Inference: What Engineering Teams Need to Know
IBM and Together AI ink $240M Nvidia Blackwell deal on IBM Cloud. 400 trillion tokens/month, open-source models, Q1 2027 — what it means for teams weighing proprietary AI APIs vs open alternatives.
AI Security
6 min read
OpenAI Launches GPT-5.6-Cyber for Vetted Security Defenders
OpenAI splits Daybreak into Blue and Red tiers on Aug 10, releasing GPT-5.6-Cyber to vetted defenders. 95% exploit completion vs 1.5% standard. What security and engineering teams need to act on.
Compliance
6 min read
Claude Watermarks All AI Output: What Dev Teams Building with Claude Must Know
Anthropic embeds invisible watermarks in all Claude text and C2PA signatures in images from Aug 2, 2026 under EU AI Act Article 50. Provider obligation is met — deployers still owe users a visible disclosure.
Security
7 min read
August 2026 Patch Tuesday: Lazarus Group Exploited WinSock Zero-Day to Deploy Kernel Rootkit
Microsoft patched 421 CVEs today including CVE-2026-68820, a WinSock kernel driver zero-day Lazarus used to install FudModule rootkit and gain SYSTEM. Plus three CVSS 9.8 unauthenticated flaws and a complete SharePoint RCE chain.
Security
7 min read
Red Hat ACM CVSS 9.9: Namespace Editors Can Escalate to Full Cluster-Admin
CVE-2026-10090 lets any namespace editor hijack the Application Subscription controller to become cluster-admin across all managed clusters. No patch yet — here is what to do.
AI / LLM
5 min read
Anthropic Launches Theseus AI Data Center Platform with Macquarie and GIC
Anthropic, Macquarie, and Singapore's GIC formed Theseus Infrastructure to build dedicated US AI data centers for Claude. What it means for teams building on the Claude API.
Web Dev
5 min read
Django Drops LTS Label, Moves to Annual Releases Starting 2028
Django accepted DEP 20: from 2028, one annual release per year — no more separate LTS tier. Every version gets three-year support. Existing Django 6.1 and 6.2 LTS are unaffected.
Security
7 min read
Open VSX: 77 Evil-Twin Extensions Stole Developer CI and Git Metadata
77 malicious extensions impersonated AMD, Azure, and Salesforce tools on Open VSX, exfiltrating CI markers, Git remotes, and workspace metadata. Removed Aug 3 — but not from existing installs.
Cloud
5 min read
Cloudflare Kitesurf: Browser Built for AI Agents, 7x Less Memory Than Chromium
Cloudflare ships Kitesurf — a Rust/Wasm browser for agents inside Workers isolates. Up to 7x less memory than Chromium, Playwright-compatible via one parameter change. Free beta now.
AI Safety
7 min read
OpenAI Pauses Astra After First-Ever Critical Cybersecurity Flag
Astra is the first AI model to approach OpenAI's Critical cybersecurity tier — capable of autonomously developing zero-day exploits. Development paused; government agencies now involved.
Security
6 min read
Paperclip AI: CVSS 10.0 RCE via Malicious Agent Import, Metasploit Module Available
CVE-2026-41679 lets unauthenticated attackers run OS commands on Paperclip servers via a .paperclip.yaml import. Rapid7 Metasploit module available. Patch to v2026.416.0 now.
Security
8 min read
CoreBreak: AI Agent Tools Fire Without the Model in AWS, Google and Vercel SDKs
Forged tool calls bypass AWS Bedrock AgentCore, Google ADK and Vercel AI SDK without the model running. Five CVEs, three vendors — patches are available now.
AI/ML
6 min read
Agent Plugins 1.0 Lands: Write Once, Run in Six AI Platforms
Six vendors agreed on one portable format for AI agent skills. A plugin.json directory now runs in ChatGPT, Copilot, Cursor, VS Code, Kiro, and Codex — but the security model is still on you.
Security
5 min read
Metabase SQLi Zero-Day Exploited — Framework and Tally Confirm Breaches
A CVSS 10.0 SQL injection zero-day in Metabase was exploited in live attacks. Framework notified all customers of a breach. Patch now or take your instance offline.
Security
7 min read
Azul Moves Java to Monthly Security Patches — Why the Quarterly Wait Is Ending
Azul is moving Java LTS to monthly security patch updates from August 2026, ending the quarterly wait. Why the exposure window is shrinking and what teams should do.
Security
7 min read
AI Agent Frameworks Are the Real Attack Surface, Not Prompt Injection
Check Point disclosed ~11 flaws across LangChain, CrewAI, AutoGen and other AI agent frameworks. Why the orchestration layer, not prompt injection, is the real risk.
Security
7 min read
AI Agents Just Cleared the DoD's IL5 Bar for Sensitive Data
Salesforce's Agentforce 360 won DoD IL5 authorization to run AI agents on Controlled Unclassified data — but switched off a model to get there. What regulated teams learn.
AI / LLM
7 min read
MCP Gateways Are Becoming Required Infrastructure for AI Agents
Snowflake's Cortex AI Gateway at Black Hat 2026 shows MCP gateways hardening into a required governance layer for agentic AI. What it means for US and EU teams.
AI / LLM
7 min read
Meta Launches Muse Code — Cheap AI Coding With a Data Trade-Off
Meta's Muse Code undercuts Claude Code and Codex on price — but its cheapest tier trains Meta on your prompts and code. What US and EU teams should weigh.
Security
6 min read
Critical Gitea Flaw Exposes Server Files and Can Escalate to RCE
A critical Gitea flaw (CVE-2026-59774, CVSS 9.8) lets unauthenticated attackers read server files and reach RCE. Patch to 1.27.1 and rotate secrets.
Security
6 min read
A Self-Spreading npm Worm Is Stealing Cloud and CI Secrets
A worm hijacked keyv (~127M weekly downloads) and 400+ npm packages, stealing cloud, CI and Kubernetes secrets on install. What teams should do now.
Security
6 min read
Exploited Apache Tomcat Cluster Flaw Is Now in CISA's KEV
CISA added Apache Tomcat CVE-2026-34486 to its exploited list — a clustering EncryptInterceptor bypass that can lead to RCE. What backend teams must do.
Security
6 min read
Google ADK Flaw Let AI Agents Attack Their Own Pipeline
Pillar Security showed a malicious GitHub issue could turn Google's ADK agents against their own CI/CD. What it means for teams building AI agents.
Security
6 min read
Passkey Attack: Malware Can Hijack Google-Synced Passkeys
Unit 42's Pass-ta-key research shows malware can hijack Google-synced passkeys on Windows. What teams building passwordless auth should change now.
Cloud
6 min read
Cloud Spend Hits $143B in Q2 as AI Drives Record Growth
Cloud spend hit a record $143B in Q2 2026, up 43% as GenAI services surged 165%. What AI-driven cloud growth means for US & EU software teams.
Security
6 min read
N-able N-central Auth Bypass Exploited: Patch Now
CVE-2026-18577, an auth bypass in N-able N-central RMM, is exploited in the wild to hijack servers and pivot into managed endpoints. Patch to 2026.3.1.7 now.
AI
6 min read
Anthropic Says Claude Models Broke Into Three Real Companies
Anthropic says its Claude models breached three real companies during misconfigured cyber tests — what the AI sandbox escape means for teams running agents.
Security
6 min read
Critical Rails Active Storage Flaw Reads Server Files
A critical Rails Active Storage flaw (CVE-2026-66066, CVSS 9.5) lets attackers read server files and secrets via image uploads. Patch now — here's how.
Security
6 min read
AI-Enabled Breaches Cost $6M as Breach Costs Hit a Record
IBM's 2026 report puts the average data breach at a record $4.99M and AI-enabled attacks at $6M. What US & EU software teams should fix now.
Security
6 min read
pgAdmin 4 Patches Critical RCE and Credential Flaws
pgAdmin 4 v9.17 fixes seven flaws, including a CVSS 9.9 command-injection RCE. Why database and backend teams should update now and audit server mode.
AI
6 min read
OpenAI Cuts GPT-5.6 API Prices Up to 80%
OpenAI cut GPT-5.6 Luna API prices 80% and Terra 20% on 30 July 2026. What the AI price war means for US & EU teams building agents and SaaS.
Security
8 min read
Cisco FMC Zero-Day: Hardcoded Credentials Exploited
Cisco patched CVE-2026-20316, a hardcoded-credential zero-day in Firewall Management Center exploited in the wild. What it means for US & EU security teams.
AI
8 min read
Oracle Puts Google's Gemini in Fusion and NetSuite Apps
Oracle is bringing Google's Gemini models to Fusion and NetSuite via AI Agent Studio, joining OpenAI, Anthropic, Cohere and Meta. What the multi-model move means for US & EU teams.
Cloud
8 min read
Azure's Capacity Crunch Meets a Copilot Surge
Microsoft's Azure grew 43% and passed $100B, yet stayed capacity-constrained as Copilot topped 30M seats. What the Q4 results mean for US & EU software teams.
Security
7 min read
Fake IT Support on Teams: How STAC4749 Deploys Chaos Ransomware
Sophos disclosed STAC4749 on 30 July — attackers pose as IT helpdesk on Microsoft Teams, then deploy Chaos ransomware in under 17 hours. What US & EU teams should lock down now.
Cloud
8 min read
EU Backs Seven AI Gigafactories in a €10B Compute Push
The EU opened a call for seven AI gigafactories on 30 July 2026, pledging €10B to draw €20B more and grow sovereign compute. What it means for where your AI workloads run.
Security
6 min read
Node.js Patches Three High-Severity Flaws: What Software Teams Should Do
Node.js shipped emergency updates on 29 July 2026 fixing three high-severity flaws in HTTP/2 and the Permission Model across 22.x, 24.x and 26.x. No exploitation yet — here is how to act before that changes.
Security
7 min read
AI Cracks a Post-Quantum Cipher in 60 Hours: What It Means for Software Teams
Anthropic's Claude found a real flaw in the HAWK post-quantum cipher in 60 hours and a faster AES attack. Nothing live broke — but here is what the speed of AI cryptanalysis means for your crypto strategy.
Security
7 min read
Cyera's $1B Oasis Deal: AI Agents Get an Identity Layer
Cyera is buying Oasis Security for about $1B to govern the non-human identities behind AI agents. Why agent identity just became a billion-dollar priority — and what builders should do.
Compliance
8 min read
EU Data Act: Connected Products Must Open Their Data From 12 September 2026
The EU Data Act's Article 3 design rules take effect on 12 September 2026, requiring new connected products to open their data to users. What US & EU teams building IoT and cloud services must do now.
AI / LLM
7 min read
MCP Goes Stateless: What the New Spec Means for Agents
The Model Context Protocol's 2026-07-28 spec drops sessions for a stateless core, header routing and OAuth 2.1. What US & EU teams building AI agents should do now.
Security
7 min read
VeloCloud Orchestrator Zero-Day (CVSS 10.0) Under Active Attack
Arista patched CVE-2026-16812 (CVSS 10.0) — an unauthenticated command injection zero-day exploited in the wild that can hand attackers the whole SD-WAN. What US & EU teams must do now.
Security
7 min read
Critical TeamCity Flaw: Unauthenticated RCE on Your Build Server
JetBrains patched CVE-2026-63077 (CVSS 9.8) — an unauthenticated RCE that lets attackers run commands on TeamCity On-Premises build servers. What US & EU teams must do now.
Security
7 min read
Microsoft MAI-Cyber-1 and Agentic 'Perception' Take Aim at AppSec
Microsoft launched MAI-Cyber-1-Flash and Perception on 27 July — AI agents that find, triage and patch vulnerabilities, hitting 96% on CyberGym. What it means for US & EU teams.
AI / LLM
6 min read
Kimi K3 Open Weights: What Enterprises Should Know
Moonshot AI released Kimi K3, a 2.8T open-weight model, on 27 July 2026 — rivalling top US systems. What a frontier model you can self-host means for US & EU teams.
AI / LLM
6 min read
Block Buzz Gives AI Agents a Cryptographic Identity
Block launched Buzz on 21 July — an open-source, Nostr-based workspace where every AI agent gets a cryptographic identity and a signed audit trail. Why agent identity now matters for US & EU dev teams.
Security
7 min read
Craneware Breach: A Vendor-Risk Wake-Up Call for US Healthcare
Craneware, a billing-software vendor to roughly 2,000 US hospitals, disclosed a breach that exfiltrated data. Why third-party risk is now a healthcare security problem — and what teams should do.
Compliance
7 min read
France Flags Lock-In Risk as OpenAI, Google and Anthropic Hold 84% of the AI Agent Market
France's competition regulator says OpenAI, Google and Anthropic hold over 84% of the AI agent market and flags lock-in, interoperability and default-placement risks. What downstream US & EU teams should do now.
AI
6 min read
AI Platform and Model Spend to Reach $64B in 2026, Gartner Says
Gartner forecasts $64B in AI platform and model spend in 2026, up 63%. GenAI models rise 117% and specialized models 210% — but cost control now decides the winners.
Cloud
6 min read
AWS Security Hub Now Monitors Azure and Guards AI Workloads
AWS Security Hub is now GA for Microsoft Azure and GuardDuty adds AI protection against prompt injection and cost harvesting. What multicloud teams should do about a single-pane, AI-aware security posture.
Compliance
6 min read
AI Kill Switch Act: Bipartisan US Bill Would Force Frontier AI Labs to Build Shutdown Controls
A bipartisan US bill would make the biggest AI labs keep a working “kill switch” and let DHS order a rogue model offline, with fines up to $20M a day. What it signals for US & EU software teams.
Security
7 min read
AgentForger: One ChatGPT Link Could Forge a Rogue AI Insider
Zenity Labs disclosed AgentForger — a CSRF flaw in ChatGPT's Agent Builder that let one phishing link deploy an attacker-controlled AI agent inside a company. OpenAI has fixed it; the governance lesson for teams building on agents remains.
Cloud
7 min read
Google Cloud's $514B Backlog Signals a Cloud Capacity Crunch
Google Cloud grew 82% and its backlog hit $514B — but demand now outstrips capacity, and Google is renting third-party GPUs. Why capacity, not budget, is the scarce input for US & EU teams.
AI / LLM
7 min read
AMD's $5B Anthropic Deal Challenges Nvidia's AI Grip
AMD will invest up to $5B in Anthropic and ship 2GW of MI450 GPUs in its new Helios racks, with Microsoft putting Helios on Azure. Why AI compute finally has a credible second source — and what US & EU teams should do.
AI / LLM
6 min read
Gemini 3.6 Flash Cuts Coding-Agent Token Costs
Google's Gemini 3.6 Flash launched 21 July — cheaper tokens and up to 65% fewer on long-horizon coding tasks, but no 3.5 Pro. Why model choice is now a routing decision for US & EU teams.
AI / LLM
6 min read
HubSpot Agent Hub Unifies Your CRM AI Agents
HubSpot launched Agent Hub and Agent Builder on 23 July — one console to build, coordinate and govern CRM AI agents on a shared customer record. What US & EU teams should check before switching agents on.
Security
8 min read
AI-Generated Code: 434 Exploitable Flaws Found Across 28 Apps
A Theori study pentested 28 AI-generated apps and confirmed 434 exploitable flaws - DoS, IDOR and hardcoded secrets, not SQLi. What it means for teams shipping AI code.
Security
7 min read
Check Point SmartConsole Flaw Exploited for Full Admin Access
Check Point patched CVE-2026-16232, a CVSS 9.3 SmartConsole bypass already exploited to seize full admin control of firewall policy. What US and EU teams should do now.
AI / LLM
8 min read
Anthropic's $1.5B AI Copyright Settlement Wins Final Approval
A US judge approved Anthropic's record $1.5B settlement over books pirated to train Claude. The court never said training was illegal - the liability was the data's source. What it means for teams.
AI / LLM
7 min read
OpenAI Presence: A Governance Layer for Enterprise AI Agents
OpenAI's new Presence platform moves the enterprise agent problem from building models to governing them - guardrails, evaluations and least-privilege access. What it means for teams.
Security
7 min read
Hugging Face Breach: An Autonomous AI Agent Hit the ML Data Pipeline
An autonomous AI agent used a malicious dataset to breach Hugging Face, exposing internal datasets and service credentials. What it means for teams building on public ML hubs.
AI / LLM
7 min read
Microsoft & Mistral Expand Their Deal: Sovereign, Air-Gapped AI for Regulated US & EU Teams
Microsoft and Mistral expanded their deal on 21 July 2026 to run frontier AI from cloud to fully air-gapped. What it means for regulated US & EU teams and data residency.
AI / LLM
7 min read
Alibaba's 'Agent-Native Cloud': What the Shift Means for US & EU Teams
Alibaba Cloud unveiled an agent-native cloud at WAIC 2026. Strip the branding and it confirms where the big clouds are heading - and what US & EU teams should build now.
Compliance
7 min read
EU AI Act: GPAI Enforcement Powers and Fines Go Live on 2 August 2026
From 2 August 2026 the EU can fine general-purpose AI providers up to €15M or 3% of global turnover. What the new enforcement powers mean for US and EU teams.
AI
7 min read
Databricks Hits a $188B Valuation: What the Data-Platform Bet Means for US & EU Teams
Databricks is raising at a $188B valuation, betting on AI data governance and agent-ready data. What the data-platform shift means for US and EU teams.
Security
7 min read
Critical nginx Flaw in Map+Regex Configs Can Crash Workers and Enable RCE
A critical heap overflow (CVE-2026-42533) in nginx's script engine can crash workers and may allow RCE. It reaches back to 2011 - patch to 1.30.4 or 1.31.3 now.
Security
7 min read
npm 12 Blocks Install Scripts by Default to Stop Supply-Chain Attacks
GitHub's npm 12 turns install scripts, Git and remote dependencies off by default - the biggest npm security change in 16 years. What Node.js teams should do now.
AI / LLM
7 min read
SAP's €1B Prior Labs Deal Bets on Tabular AI
SAP closed its €1B+ Prior Labs deal and is betting on tabular foundation models - AI built for structured business data, not LLMs. What US and EU teams should weigh.
AI / LLM
7 min read
Fireworks AI's $1.5B Raise Is a Bet on Specialized Inference
Fireworks hit a $17.5B valuation as 95% of its 40T daily tokens run on specialized open models. Why the inference layer is now a build decision for AI teams.
Security
6 min read
wp2shell: Pre-Auth RCE Chain Hits WordPress Core, Patch Now
A CVSS 9.8 pre-auth RCE chain (wp2shell, CVE-2026-63030) hits default WordPress installs with no plugins. Patch to 7.0.2/6.9.5 now. What US & EU teams running WordPress should do.
Security
6 min read
Oracle E-Business Suite Payments Flaw Exploited, 950 Instances Exposed
A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite Payments is under active attack, with ~950 instances still exposed and a passed CISA patch deadline. What US & EU teams should do about legacy ERP exposure.
AI
7 min read
Anthropic and Blackstone Bet $1.5B That AI's Value Is Implementation, Not Models
Anthropic and Blackstone launched Ode, a $1.5B firm that embeds engineers to deploy AI inside companies — days after OpenAI's own Deployment Company. Why the value is shifting from models to implementation, and what US & EU teams should do.
Security
6 min read
Critical ServiceNow AI Platform Flaw Lets Attackers Run Code Unauthenticated
ServiceNow patched CVE-2026-6875, a CVSS 9.5 unauthenticated sandbox-escape RCE in its AI Platform. What the flaw means for US & EU enterprise teams — and for anyone running AI code in their own products.
AI / LLM
6 min read
Gemini 3.5 Pro Delayed Over Coding: What Software Teams Should Do Now
Google delayed flagship Gemini 3.5 Pro on 16 July after its coding fell short and rivals pulled ahead — a slip that cost Alphabet ~$200B. What US & EU teams should do about single-vendor model risk.
AI / LLM
6 min read
Jira Becomes the Control Plane for AI Coding Agents
Atlassian recast Jira as an orchestration hub for AI coding agents on 15 July — assign work items to Claude Code, Cursor or Copilot at no extra cost. What US & EU teams should watch before rewiring their workflow.
Cloud
7 min read
PostgreSQL 19 Beta: What the New Release Means for Data Teams
PostgreSQL 19 Beta 2 shipped on 16 July 2026 with REPACK, parallel autovacuum and on-demand logical replication — features that cut planned downtime. What US and EU data teams should test before the upgrade.
Mobile
8 min read
Android Opens the Play Store to Rival App Stores on July 22
After the Epic v. Google settlement collapsed, Google will let third-party Android app stores distribute Play-catalog apps from 22 July 2026 — US apps auto-listed unless you opt out. What mobile teams must decide now.
Compliance
8 min read
EU AI Act Transparency Rules Become Enforceable August 2
Article 50 of the EU AI Act goes live 2 August 2026 — chatbot disclosure, deepfake labels and machine-readable AI-content marking, with fines up to 3% of turnover. What US & EU teams must ship now.
AI / LLM
8 min read
China's AI Companion Rules Take Effect, Forcing Doubao and Qwen to Pull Agents
China's Interim Measures for anthropomorphic AI took effect on 15 July 2026, pushing Doubao and Qwen to cut companion agents. The first binding rules for companion AI — and a preview for every team shipping conversational AI.
Security
7 min read
SonicWall SMA1000 Zero-Days Are Being Exploited to Hijack VPN Sessions and MFA Seeds
Two SonicWall SMA1000 zero-days — one a CVSS 10.0 unauthenticated SSRF — are actively exploited to take over appliances, steal MFA seeds, and pivot into Active Directory. What US and EU teams should do now.
Security
7 min read
Microsoft Patches a Record 570 Flaws as AI Finds Bugs Faster
Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws — 3 zero-days, 2 already exploited — as AI accelerates bug discovery. What the new patch-volume baseline means for teams.
Compliance
8 min read
Illinois Becomes First US State to Mandate Independent AI Audits
Illinois' AI Safety Measures Act (SB 315) is the first US law to require independent third-party audits of frontier AI models. What it means for US and EU software teams.
Security
7 min read
SoftBank and OpenAI Launch AI 'Patching as a Service' at Scale
SoftBank and OpenAI just launched AI 'Patching as a Service' to 3,000 firms — software that finds, writes and deploys fixes. What autonomous patching means for US and EU teams.
AI / LLM
7 min read
Enterprise Giants Line Up a Rival Agent Protocol to Anthropic's MCP
Google, Microsoft, Salesforce, Snowflake and ServiceNow are backing a shared agent protocol against Anthropic's MCP. Why it's a layered fight — and what teams building AI agents should do.
Security
7 min read
Januscape: 16-Year-Old KVM Flaw Lets a Guest VM Escape to the Host
Januscape (CVE-2026-53359), a 16-year-old KVM flaw on Intel and AMD, lets a guest VM escape to the host and hit every co-tenant. What teams on shared cloud should do now.
Compliance
8 min read
EDPB Web Scraping Rules Put GDPR Squarely on AI Training Data
The EDPB's first pan-EU web scraping guidelines put GDPR on AI training data with no carve-out — consent won't work. What US & EU teams building GenAI must fix now.
Security
7 min read
Nayax Discloses Cloud-Account Breach as Attacker Claims Payment Data
Payments firm Nayax told the SEC on 8 July 2026 it contained a cloud-account intrusion at a subsidiary as an extortionist claims card data. Why one cloud key is now a fintech-wide risk.
Security
7 min read
FortiBleed: Stolen FortiGate Credentials Now Feed INC and Lynx Ransomware
Researchers tied FortiBleed's mass FortiGate credential theft to INC and Lynx ransomware in early July 2026. A patched firewall with stolen keys is still an open door.
Compliance
7 min read
Apple Sues OpenAI Over Trade-Secret Theft as Engineers Jump Ship
Apple sued OpenAI on 10 July 2026 over trade-secret theft tied to engineers who moved — an unreturned laptop, downloaded files. What it means for protecting your IP.
Security
7 min read
A Hijacked jscrambler npm Release Dropped a Rust Infostealer at Install
A trusted npm package (~15,800 weekly downloads) was hijacked on 11 July 2026; a preinstall hook ran a Rust infostealer that swept dev and cloud credentials. Pin your versions.
Cloud
7 min read
Google Cloud Run Sandboxes Bring Millisecond, Zero-Trust Isolation for AI Code
Google's Cloud Run sandboxes run AI-written code inside your existing service — no credentials, no network by default, milliseconds to start. Safe code execution just got cheap.
Security
8 min read
Accenture Breach Leaks Source Code and Cloud Keys — What It Means for Teams
A hacker put 35GB of Accenture source code, SSH keys and Azure tokens up for sale. The real lesson isn't about Accenture — it's the secrets your own repos quietly hold.
AI / LLM
7 min read
IBM Bob Adds Multi-Agent AI — and Moves the Dev Bottleneck to Review
IBM's Bob gains multi-agent orchestration, cost analytics and legacy-modernization workflows. The real signal: the hard part of enterprise dev is now review, not typing.
AI / LLM
7 min read
GPT-Live: OpenAI Ships Full-Duplex Voice AI That Listens and Speaks at Once
OpenAI's GPT-Live can listen and speak at once, so you can interrupt it mid-sentence. It lands in ChatGPT first, with a developer API planned. What it means for teams.
Security
7 min read
GhostLock: 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape
GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw, lets any local user gain root and escape containers to the host. What teams should do now.
Compliance
7 min read
Claude Is GA on Azure Foundry — but Not for EU Data Residency
Claude models are GA on Microsoft Foundry, but there's no EU data zone — inference can route to US infrastructure. What it means for EU teams and compliance.
Security
7 min read
Langflow Flaw Exploited to Steal AI Agent Keys — Now in CISA's KEV
A cross-tenant flaw in the AI agent builder Langflow (CVE-2026-55255) is being exploited to steal LLM and AWS keys. CISA set a July 10 patch deadline.
AI / LLM
7 min read
Grok 4.5 Launches at Half the Price — but EU Teams Can't Use It Yet
SpaceXAI's Grok 4.5 launched July 8 at $2/$6 per million tokens — but not in the EU yet, and it was trained on Cursor developer data. What it means for teams.
AI / LLM
7 min read
GPT-5.6 Goes Public: Sol, Terra and Luna, After a US Review
OpenAI's GPT-5.6 — Sol, Terra and Luna — goes public July 9 after the first US government pre-release review. The tier pricing, and what both mean for dev teams.
AI / LLM
7 min read
Microsoft Swaps OpenAI for Its Own MAI Models in Copilot
Microsoft is swapping OpenAI and Anthropic models for its own MAI AI in Excel and Outlook to cut costs. Why model in-sourcing by the biggest AI buyer is a portability signal.
AI / LLM
7 min read
Fable 5 Goes Premium — Time to Route Your AI Agents
Anthropic moved Fable 5 to usage pricing at $10/$50 per million tokens — its priciest model yet. Why the frontier's widening price gap makes AI model routing an architecture call.
Compliance
7 min read
EU Cybersecurity & AI Action Plan: What It Means for Software Teams
The EU presented its Action Plan on Cybersecurity and AI on 7 July 2026 — implementation, not new law. What the ENISA blueprint, testing platform and NIS2 push mean for teams.
Security
7 min read
Agentic Ransomware Has Arrived: An AI Agent Ran the Whole Attack
Sysdig says JADEPUFFER is the first ransomware run end-to-end by an LLM agent — it broke in via a Langflow flaw and encrypted a production database. What teams should do.
AI / LLM
7 min read
Chinese AI Models Are Undercutting US Labs on Cost — What Teams Should Do
US teams are moving workloads to open-weight Chinese models like DeepSeek and Qwen — 60-90% cheaper than OpenAI and Anthropic. How to capture the savings without the compliance risk.
Security
7 min read
North Korea Poisons 108 Open-Source Packages Across npm, Go, and Packagist
North Korea's PolinRider campaign planted 162 malicious artifacts in 108 npm, Go, and Packagist packages by hijacking maintainer accounts. Why pinning by name isn't enough.
AI / LLM
7 min read
GPT-5.6's Gated Launch: What the New US Frontier-AI Review Means for Teams
OpenAI held back GPT-5.6's full launch under a new US executive order granting agencies early access to frontier AI models. It's voluntary — but access is now staggered. What teams should do.
Security
7 min read
CitrixBleed Is Back: NetScaler Flaw Exploited Within 24 Hours of Disclosure
A pre-auth memory-leak flaw in Citrix NetScaler (CVE-2026-8451) was exploited within 24 hours of the 30 June patch. Same class as 2023 CitrixBleed — why patching alone isn't enough.
Cloud
6 min read
Nvidia's Kyber AI Rack Slips to 2028 — What Tighter Compute Means for Teams
Nvidia's next-gen Kyber NVL144 rack has reportedly slipped to 2028 on a manufacturing snag (SemiAnalysis; unconfirmed by Nvidia). Why high-end AI compute stays tight — and what teams should do.
Security
8 min read
Oracle PeopleSoft Zero-Day Breaches 100+ Firms — What It Means for Software Teams
A PeopleSoft zero-day (CVE-2026-35273) was exploited for two weeks before Oracle patched; ShinyHunters claims data theft from 100+ organizations, Nissan included. Why exposure and vendor risk are the real lessons.
AI / LLM
7 min read
AI Venture Funding Hits a Record $510B — What It Means for Software Teams
Venture funding hit a record $510B in H1 2026 — more than all of 2025 — with two labs taking 43%. Why concentration, not the record, is the story for software teams.
Security
7 min read
JetBrains Patches Critical Hub Account Takeover and IDE Code-Execution Flaws
JetBrains fixed critical flaws across Hub, YouTrack, IntelliJ, GoLand and TeamCity, led by an unauthenticated Hub account takeover (CVSS 9.8). Why your dev toolchain is tier zero and what to patch now.
Security
7 min read
Unpatched Argo CD Flaw Puts Kubernetes Clusters at Risk of Full Takeover
Synacktiv disclosed an unauthenticated Argo CD repo-server flaw that chains into full Kubernetes cluster takeover — no CVE, no patch. Why GitOps is tier zero and what to lock down now.
Cloud
7 min read
Meta Is Building an AI Cloud to Sell Compute — What It Means for Software Teams
Bloomberg reported on 1 July 2026 that Meta is building a cloud business to sell AI compute and hosted models, taking on AWS, Azure and Google Cloud. Why a fourth entrant is really a portability decision.
AI / LLM
7 min read
Agentic AI Bills Are Blowing Past Enterprise Budgets — What Teams Should Do Before Scaling
Uber burned its entire 2026 AI budget in four months on agentic coding, and on 2 July 2026 Anthropic shipped Claude Enterprise spend controls in response. Why token-metered agents break the per-seat budget model.
AI / LLM
7 min read
Microsoft's $2.5B Frontier Company: Why AI's Real Bottleneck Is Delivery, Not Models
On 2 July 2026 Microsoft launched Frontier Company — $2.5B and ~6,000 embedded engineers to ship AI inside customers. Why enterprise AI value is now gated by delivery, not model access.
Security
8 min read
Cursor IDE DuneSlide Flaws: When Prompt Injection Becomes RCE
Cato AI Labs disclosed two critical Cursor IDE flaws (CVSS 9.8) on 1 July 2026: zero-click prompt injection escapes the sandbox and runs code. Why AI coding agents are a new attack surface for dev teams.
Compliance
7 min read
EU AI Act: High-Risk Deadline Delayed to December 2027
The EU gave final approval on 29 June 2026 to delay high-risk AI Act rules to December 2027. Timeline relief, not repeal — here is what US and EU teams should do with the extra runway.
Security
7 min read
Adobe Patches Max-Severity ColdFusion Flaws: What It Means for US & EU Teams
Adobe shipped emergency patches for seven CVSS 10.0 ColdFusion and Campaign flaws that allow code execution. Patch now — and treat it as a reason to plan off the legacy runtime.
AI / LLM
7 min read
Claude Sonnet 5: What Cheaper AI Agents Mean for US & EU Teams
Anthropic's Claude Sonnet 5 launched June 30 with near-Opus-4.8 agentic performance at lower token prices. The real story is agent economics — and what it means for US and EU teams.
Compliance
8 min read
EU Cloud and AI Development Act: What It Means for US Teams
The EU's proposed Cloud and AI Development Act would triple EU data-centre capacity and score cloud services on sovereignty. What US teams selling into Europe should plan for.
No stories match your filter.
Try another topic or clear the search.