Jul 18, 2026

WordPress core is affected by a pre-authentication SQL injection vulnerability (CVE-2026-63030, CVE-2026-60137) in the REST batch endpoint. An array-indexing bug in `serve_batch_request_v1()` desynchronizes validation and dispatch arrays when a URL parse fails, allowing nested batch requests to route a categories query through the posts handler and inject SQL without authentication.

TP-Link Kasa Spot EC71 cameras leaked precise GPS coordinates over an unauthenticated UDP protocol for six years due to a hardcoded fleet-wide RSA private key and unsalted MD5 password storage. The underlying flaw was public since 2016 and had been patched in TP-Link smart plugs in 2020, but never extended to cameras until now. A separate longitudinal study found that 80% of Qubes OS security bulletins originate from upstream Xen and CPU microarchitecture issues, with disclosure rates plateauing since 2015.

Bun creator Jarred Sumner used Anthropic’s Fable model to rewrite 535,000 lines of Zig to Rust. After a three-hour briefing, Claude produced a 600-line porting guide; 64 AI agents then carried out the migration, which would have taken a human team a full year. The rewrite eliminates persistent memory leaks and adds borrow-checker safety for the project’s 22 million monthly downloads.

On the AI front, a developer ran the 120B-parameter gpt-oss-120b MoE model on a OnePlus 15R phone using only four CPU cores, streaming experts from flash storage to reach 1.3–2.2 tok/s. The same method delivers usable 5.2 tok/s for Qwen3-30B and 4.1 tok/s for Gemma-4-26B. In benchmarking, Claude Fable 5 outperformed GPT-5.6 Sol on an NP-hard optimization problem, but the `/goal` persistence feature worsened average results for both models in most trials.

Several new tools emerged: Celly provides a 100% conformance-keeping C# implementation of Google’s Common Expression Language, now available for .NET policy evaluation. Sigilgraph demonstrates real-time audio synthesis in C# through a pull-based graph evaluator that avoids heap allocations and uses SIMD. DOOMQL turns SQLite into a full game engine, using SQL queries for raycasting, collision, AI, and pixel rendering, with a live audit terminal.

Finally, the concept of “review-loop engineering” gained attention, urging teams to design review packets, escalation rules, and feedback paths that let human engineers meaningfully oversee autonomous coding agents instead of merely approving opaque diffs.