Aug 3, 2026

The week’s biggest security story is a newly disclosed Linux kernel vulnerability dubbed Dirty Pedit. The flaw resides in the Traffic Control (TC) packet editor, where a u32 integer wraparound in `tcf_pedit_act()` causes `skb_ensure_writable()` to leave page-cache-backed skb fragments unprotected. An attacker can corrupt the page cache to gain root access in under a second, posing an immediate threat to any unpatched system.

Hardware wallet users were hit hard as well. Galaxy Research linked a firmware bug in COLDCARD hardware wallets to three thefts totaling 1,367.05 BTC (~$88.6 million). The first wave drained 1,082.65 BTC from 1,196 addresses in just 41 minutes, with uniform fees suggesting a single operator. The root cause: a 2021 code change that silently routed seed generation to MicroPython’s deterministic software fallback instead of the device’s true random number generator, leading to predictable seeds. In a separate hardware trust crisis, researchers found that H96 Android TV boxes are being exploited through factory backdoors for ad fraud and residential proxy operations (dubbed Fuyao).

On the language and tooling front, a new Rust proposal aims to let types opt out of being moved and forgotten, enabling safe scoped spawning and more expressive async code. KernelScript, a typed domain-specific language, unifies eBPF map, program handle, and execution domain definitions into a single C-compilable source, addressing the fragmentation in existing eBPF development. Meanwhile, Cloudflare’s Workers RPC now offers seamless cross-language calls between JavaScript and Python, with Pyodide’s FFI handling type conversions automatically.

Meta’s engineering team doubled the training efficiency of its GEM ad recommendation model for Instagram and Facebook, reaching 20–25% Model FLOPs Utilization while scaling compute 4×. This advance sits at the intersection of recommendation systems and large language model training, introducing novel solutions for massive-scale distributed learning. In AI safety, a curated ranking of sandboxes for autonomous coding agents (Claude Code, OpenHands, etc.) evaluates isolation boundaries and agent access, a pressing concern as these tools execute arbitrary commands.

Also notable: a critique of content provenance argues that C2PA’s approach—binding records to the file and trusting a central authority—is structurally flawed, advocating instead for records kept beneath the asset. And a novel anamorphic, head-tracked perspective technology reprojects web page layers based on a user’s face position, allowing viewers to peek around corners while keeping their data local.