13–Jul 19, 2026

A devastating zero-click attack chain, rated CVSS 9.8, targets millions of budget Android phones. Security researchers uncovered “Operation Silent Rescue,” exploiting an unpatchable BootROM flaw (CVE-2022-38694) in Unisoc T606/T616 chipsets combined with a modem RCE triggered by rogue LTE signals. Affected devices include Motorola’s Moto G04s, G24, G34, and E24 running Android 11–13, requiring no user interaction. Separately, a critical pre‑authentication SQL injection vulnerability in WordPress Core (CVE-2026-63030, CVE-2026-60137) stems from array‑index desynchronisation in the REST batch endpoint, enabling privilege escalation via nested batch requests.

AI‑powered engineering made headlines as Bun shipped a 535,000‑line codebase migration from Zig to Rust in hours, not a year. Creator Jarred Sumner used Anthropic’s Fable model and 64 AI agents, guided by a 600‑line porting guide, to eliminate persistent memory leaks. In infrastructure, a field report on porting Google’s Gemma‑4 (2B/4B/12B) to AWS Inferentia2 found that the model’s cross‑layer KV‑sharing and mixed attention heads clash with the vendor stack, requiring a raw Hugging Face trace to bypass static graph builders. Meanwhile, a Mozilla report shows open‑weight models now handle the majority of OpenRouter tokens, with the capability gap narrowed to about 3%, yet only 51% of developer teams using them reach production.

Security audits of over 200 multi‑tenant AI tools revealed 78 products leaking tenant data via missing authorization on read endpoints (84 confirmed exposures, 31 GitHub advisories). In AI agent reliability, an investigation identified four distinct causes behind vanishing memory writes—key mismatches, lossy compaction, and concurrency races—where standard logging shows a successful write. An evaluation of 6 MCP servers attached to a single agent logged 41,200 tool calls; tool schemas consumed 41% of the context window, and prompt cache hit rates dropped from 92% to 48% as servers were added, making vendor‑shipped tool description rewrites the most cost‑effective fix.

On the language and compiler front, Julia introduced UnifiedIR, a single IR spanning parsing, lowering, and optimization, built as a flat statement table over a shared AttrGraph and shipped with a verifier and reference interpreter. In authentication, the WebAuthn PRF extension was used to derive encryption keys from a passkey login, eliminating master passwords in the end‑to‑end encrypted notes app pknotes through an HKDF‑derived key‑encryption key that unwraps an AES‑256 master key.