Bob M

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind `keyv`, a key-value storage library with roughly 127 million weekly npm downloads. And used that access to inject a credential-stealing worm across the entire package family. International Cyber Digest reported the attack compromised at least 868 npm

On Aug. 5, 2026, the Rust project published a formal LLM usage policy for the rust-lang/rust monorepo. And it does something most dev teams still haven't: it splits AI use into two buckets with completely different rules. Five Rust teams adopted the policy, authored by contributor Jynn

LFM2.5-2.6B shipped August 4, 2026. Open-weight, on-device, built for agents that plan and call tools without touching a cloud. Phone, laptop, PC, robot. Doesn't matter. The whole loop runs local. Quantized footprint: under 2.5 GB. Context window: 128K tokens. No API means no server bill,

OpenAI published private chats from 2 former Apple employees in a blog post over the first weekend of August 2026, to rebut Apple's trade-secret theft lawsuit filed July 10 in the US District Court for the Northern District of California. The receipts show Apple's outside counsel

The Shai-Hulud npm worm compromised over 500 packages in its first September 2025 wave and eventually spread to more than 25,000 GitHub repositories by late November. The latest Mini Shai-Hulud resurgence on May 11, 2026, hit 373 malicious versions across 169 packages. And Microsoft's follow-up analysis confirmed

MiniMax H3 is a 33‑billion‑parameter omni‑modal transformer that generates 2K video clips up to 15 seconds long with native 32 kHz stereo audio. It reads text, images, video, and audio as a single context and produces synchronized output in one pass. The model’s weights were released