Jul 30, 2026

Wiz Research disclosed CosmosEscape, a critical sandbox escape in Azure Cosmos DB’s Gremlin API that allowed arbitrary code execution on the multi-tenant DB Gateway using .NET reflection. The foothold uncovered a platform-wide Cosmos Master Key capable of retrieving the primary key for any Cosmos DB account across tenants, regions, and API types, combined with a queryable Config Store for enumerating every account. In a separate deep-dive, researchers showed how to independently reconstruct the proprietary UEFI firmware measurements needed to verify Intel TDX confidential VMs on Google Cloud without trusting the provider.

On the performance and tooling side, metaljax arrived as an open-source PJRT plugin that runs unmodified JAX code on Apple Silicon GPUs by interpreting compiled StableHLO onto MLX arrays; it passes 98.4% of the upstream test suite. A DuckDB investigation found that paging through a Parquet file using `file_row_number` ranges was 2.53× faster than `LIMIT/OFFSET` when many row groups exist, but highlighted a subtle correctness trap in DuckDB’s internal offset-to-row-number rewrite when columns contain nulls or files change.

In AI‑assisted development, an engineer working on a 150k‑line Rust/TypeScript project reported an 83% reduction in agent token costs after breaking a 17,000‑line monolith into 19 Rust files, measured via controlled experiments with fresh sub‑agents. For .NET, Celly debuted as a pure‑managed C# implementation of Google’s Common Expression Language (CEL), achieving full conformance without WASM or native bindings, opening the door to expression‑driven policy logic on .NET.

Other notable releases: a developer demonstrated a 56M‑parameter LLM running distributed across three ESP32‑S3 microcontrollers over ESP‑NOW with 4‑bit quantization and a PSRAM‑backed KV cache. Rust’s types team advanced the Polonius alpha borrow checker toward stabilization, solving NLL problem case #3 and passing crater runs with no regressions, though performance work remains. Netflix introduced GenRec, an LLM‑native recommendation ranker that replaces thousands of hand‑engineered features with natural‑language prompts, and Emboss surfaced as a pure‑Python PDF engine that keeps documents as structured, diffable data with embedded source CSV and byte‑identical output.