Fetching from the wire…
01
02
03
04
05
06
07
08
OSS2026-09-25 · source-backed
The Fuzzing Taskflow in GitHubSecurityLab/seclab-taskflows-fuzzing works on C/C++ projects: picks entrypoints, reads the build system, writes harnesses, runs AFL++, iterates on coverage reports with plateau detection, triages every crash and writes a vulnerability report per unique bug. It includes structure-aware mutators for JSON, XML, regex and PNG. (GitHub Blog) Sonnet 5 is the default because it passed all of GitHub's internal tests. GitHub recommends running it in disposable Codespaces, since the LLM picks the build commands. No bug counts published yet, which I'd want before believing the loop closes.
Each link below shares sources, entities, or timing with this story.
Seth Larson detailed the change, and it closes a supply-chain path where an attacker with a compromised maintainer account could quietly poison a long-stable, widely-pinned release by adding a new artifact to it (Simon Willison). Nobody audits a version they pinned two years a...
1. Deploy Nemotron 3 Super for Agentic Reasoning (ml-ops, advanced) — 120B MoE activating only 12B params. vLLM with --reasoning-parser nemotron_v3. NVIDIA Blog 2. Build Multimodal RAG with Gemini Embedding 2 (ml-ops, intermediate) — Text, images, video, audio in one 3072-dim...
Willison published 8 posts on February 17 — his most prolific single day in recent memory. Key outputs: (1) Claude Sonnet 4.6 review, noting "similar performance to November's Opus 4.5" at Sonnet pricing, with SVG benchmark tests noting Sonnet 4.6 "consistently added decorativ...
A spec is a press release until someone who didn't write it implements it. GitHub made Agent Plugins 1.0 generally available on August 12 across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on all plans. The spec, published August 6, was co-authored by AWS, Anysp...
Go update. Then go read your sandbox.excludedCommands configuration, because it probably means something different than you thought it did. The bug: a single glob in sandbox.excludedCommands exempted an entire compound Bash command from the sandbox if any one segment matched....
The open-source coding agent space just got its first credible frontrunner. OpenCode, built by Anomaly, launched this week and immediately became the top technical story on Hacker News with 802 points and 359 comments — the kind of signal velocity that separates real developer...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.