Jul 19, 2026

On July 2, 2026, the FBI, together with Google, Lumen, and Shadowserver, seized the domains behind NetNut, a large residential proxy provider tied to the Popa botnet that hijacked over two million smart TVs and streaming devices as exit nodes. Independent monitoring by Layer3 Intel tracked the shutdown in real time: the network’s pool of distinct IPs drained over roughly 60 hours, eventually dropping by more than 99.9%. However, 28% of the seized IPs remained active on Bright Data, another proxy service, highlighting that the underlying device inventory wasn’t fully eliminated.

A forensic report alleges a serious supply chain compromise in devices using Unisoc T606/T616 chipsets and Longcheer ODM designs, such as the Motorola Moto G04s. According to the report, manufacturer-signed system applications (fmradio, IMS, sgps) surreptitiously establish WireGuard-based C2 tunnels, exfiltrate audio via VoLTE and FM radio functions, and trigger deliberate kernel panics on headset or Bluetooth events to wipe volatile memory and thwart forensics. An embedded Longcheer root certificate is also said to enable man-in-the-middle attacks. This suggests a persistent, deeply embedded backdoor in low-cost Android devices.

The open source world is feeling the strain of AI-generated contributions. A new study introduces the term “AI-DDoS” for the deluge of plausible but low-quality pull requests and issues generated by AI tools that overwhelm maintainers. Analyzing 294 repositories and over two million PRs and issues, researchers found that while overall PR volume rose in 2025, merge rates fell — first-time contributors saw an 18.18% drop in merge probability. Separately, a Show HN project demonstrates a safer way to use LLMs for database schema changes: a CRM that maps natural language requests to a limited set of typed tools (create tables, add column, rename column, change column type), letting the application generate SQL instead of the model, thereby preventing SQL hallucination and disallowing dangerous operations like DROP.

On the language and systems front, Julia’s compiler team revealed UnifiedIR, a single intermediate representation that spans parsing, lowering, and optimization, replacing separate IR formats. It is built as a flat statement table with hybrid regions over an AttrGraph core, requires no dependencies, and includes a verifier and GC-like compaction. MemoryPack, a new binary serializer for C# and Unity, takes a zero-encoding approach that copies memory directly, achieving 10–200x performance gains over existing serializers. For constrained environments, Subrust provides a #![no_std], heap-free interpreter for a strict subset of Rust, ensuring any accepted program compiles and runs identically under rustc. In a reflective piece, the pitfalls of treating retries as simple loops are unpacked: for streamed operations, naive retry logic can silently reorder events, corrupting timelines or audit trails; the article argues that retry should be modeled as a data structure, not a loop. Finally, the Neutrality Project released a Political Neutrality Benchmark that uses 3,987 public-opinion questions to map AI model answers onto six ideological axes, calibrating neutrality by having each model role-play extreme political stances.