» curated · synthesized
Skip the noise.
Read the signal.
Curated tech news and synthesis for developers and technology professionals.
» Latest posts
357 postsPython library verifies OpenAI's signed AI agent traffic (RFC 9421)
regent-httpsig is an open-source Python library that verifies and signs OpenAI-style AI agent HTTP traffic per RFC 9421 and Web Bot Auth drafts.
Spectre Flaw Leaks JWT Tokens on Cloudflare Workers via Remote Timers
A new Spectre attack bypasses Cloudflare Workers' DyPrIs defense, leaking JWT tokens via microarchitectural timers; Cloudflare responded with MPK-based isolation.
Linux Kernel Bridge STP Timer Use-After-Free Vulnerability
Linux bridge STP timers vulnerable to use-after-free via dellink teardown gap, enabling potential kernel control-flow hijack. Patched upstream.
New API integer overflow turns $0.10 balance into $16.9 trillion
CVE-2026-71479 lets one request overflow New API's billing math, turning a $0.10 balance into $16.9T. CVSS 9.1, fixed in v1.0.0-rc.18.
Agent Control Plane: The LLM Proposes, It Never Authorizes
Agent Control Plane keeps AI agent authorization outside the model, blocking prompt injection with signed policy and human sign-off for risky actions.
ChainDrop worm crawls into npm supply chain, evades standard defenses
ChainDrop, a Shai-Hulud npm worm variant, infected 444 packages and spreads via tarballs, evading standard repository-based defenses.
CAKE: Compiler-Agent Co-Design Lets AI Write Faster GPU Kernels
CAKE pairs AI coding agents with a hardware-explicit compiler IR, beating tuned GPU kernel baselines on B200 with verifiable, evolving toolchains.
Prefill/Decode Disaggregation Can Worsen Tail Latency, Not Fix It
Splitting prefill and decode across GPU pools adds queues and KV transfer overhead that can worsen tail latency without careful control-loop design.
IETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
MCP Security: Trust Boundaries and the Attacks the Spec Won't Stop
A breakdown of MCP's four trust boundaries, stdio server risks, OAuth 2.1/PKCE/CIMD updates, and the confused-deputy attack class engineers must handle.