July 2026

Security researchers uncovered a devastating zero-click attack chain, dubbed "Operation Silent Rescue," targeting millions of budget Android phones built on Unisoc T606/T616 chipsets, including Motorola's Moto G04s, G24, G34, and E24. Rated CVSS 9.8, the exploit combines an unpatchable BootROM flaw (CVE-2022-38694) with a modem RCE bug (CVE-2025-31718) triggered over rogue LTE signals without user interaction, enabling complete device compromise via pre-installed system apps.

Linux and Redis users also face new privilege escalation and remote code execution risks. RefluXFS (CVE-2026-64600) is a race condition in the XFS filesystem's reflink support, allowing any local user to overwrite root-owned files on XFS volumes created with default settings since 2019. Meanwhile, a toolkit exploits authenticated RCE in multiple Redis versions (6.2.22 through 8.8.1) by chaining a stream double-free, a TDigest heap overflow, and a TopK memory corruption in the RedisBloom module, bypassing prior fixes for CVE-2026-25243 and CVE-2026-25589.

On the AI infrastructure front, running Google's Gemma-4 family on AWS Inferentia2 proved unexpectedly hard because architectural choices like cross-layer KV-sharing and interleaved sliding-window/global attention map cleanly to TPU/XLA but break AWS stack; engineers resorted to bypassing Neuron's ModelBuilder entirely. In a feat of desktop inference, the Krasis runtime streamed the 397-billion-parameter Ornith-1.0 MoE model on a single NVIDIA RTX PRO 6000 96GB GPU by keeping experts in CPU RAM and moving them into VRAM on demand using INT4 quantization and 4-bit KV caches, achieving over 2000 tok/s prefill. And for CPU-bound llama.cpp servers, prompt reformatting—correctly applying a chat template—yielded reliable prefill speedups, while aggressive quantization often corrupted model output or KV caches.

AI agents themselves reshaped software at scale. Bun creator Jarred Sumner employed Anthropic's Fable model and 64 parallel agents to migrate the entire 535,000-line runtime from Zig to Rust, eliminating persistent memory safety bugs that a human team would have taken a year to fix. The process was guided by a 600-line porting guide distilled from a three-hour briefing. In a similar vein, the complex FreeCAD CAD suite—1.5 million lines of C++ and 700,000 lines of Python—was ported to WebAssembly in about four days with the same Fable agent, overcoming challenges from OpenCASCADE to embedded Python.

Web platform advances included a deep dive into React 19's Server Component boundary: the Flight serializer permits Date, Set, Map, Promise, and streams but rejects RegExp, URL, class instances, and null-prototype objects due to prototype-based checks. Separately, the WebAuthn PRF extension received practical treatment: by deriving an encryption key from passkey login output, the pknotes app demonstrated end-to-end encryption without master passwords, using HKDF and AES-256-GCM to keep data secure.