News
What happened, and why it matters.
OpenAI's Astra Just Crossed the Critical Cyber Threshold and Found Two Zero-Days on Its Own. It Won't Be in Your Hands, and That's the Point.
Astra is the first model OpenAI has placed at the Critical cybersecurity capability level in its Preparedness Framework, after it independently found and chained two zero-day vulnerabilities during evaluation. Access is gated behind a vetted-defender program, not a signup form.
Alibaba's Wan3.0 Video API Is 30% Off Through September 23. Price Your Feature at the Real Rate, Not the Launch Rate
Wan3.0 turns a slide deck into a 30-second video and costs $0.05 to $0.20 per second, minus a launch discount that expires September 23. Here's the math before you build a pricing page around a promo.
Apple's New EU App Store Terms Land October 1. The Fee That Got Killed Never Touched a Small Developer Anyway
Apple replaced the per-install Core Technology Fee with a flat 5% commission, effective October 1. The real news for a solo iOS developer is who now qualifies for alternative distribution, and it isn't you.
A Researcher at OpenAI's Codex Security Got Named Credit in a Chrome Advisory, Then in Firefox's, Same Day
Chrome 151's August 18 update credits OpenAI's Amy Burnett for a WebGL bug. Firefox 154 credited her the same day for five more. Neither of Chrome's two Critical bugs was hers.
Bun 1.4 Rewrote a 535,000-Line Codebase From Zig to Rust in 11 Days. 64 Claude Agents Did the Port.
Bun 1.4 shipped on August 19 as the first version of Bun written in Rust instead of Zig. The published benchmarks (5x less idle CPU, 7x faster CI installs) are the boring, verifiable part. The claimed 64-agent, 11-day porting workflow is the part worth reading carefully.
An AI Cloud Provider Just Borrowed Another $1 Billion to Buy Chips From Its Own Investor
Lambda raised roughly $1 billion in private debt this week, arranged by JPMorgan, to buy more Nvidia GPUs. It's the company's third debt-financed chip purchase since May. Nvidia is both Lambda's supplier and one of its investors, which is worth understanding if you rent compute from any neocloud.
OpenAI Is Cutting Cursor Off on November 12. The Number That Matters Is 5%, Not the $60B Price Tag.
OpenAI told Cursor on August 29 it's ending direct model access on November 12, because SpaceX now owns the company. Cursor's CEO says it barely matters: OpenAI models handle about 5% of its traffic. That number is the actual lesson for anyone routing their stack through a single vendor.
htmx 4.0 Shipped and the Team Refused to Make It the npm Default. That Decision Is Your Upgrade Plan.
htmx 4.0 landed on August 28 after eight months of work, and 2.x stays as npm latest until early 2027. The one change worth acting on today is attribute inheritance, because it silently breaks CSRF headers.
Next.js Pulled Its Security Release Forward a Day Because a Second Critical Showed Up. The One That Hits You Fires on an AVIF.
16.3.3 and 15.5.24 shipped 25 August with two critical RCEs. The CVSS 9.0 headline only fires on Windows filesystems. The other one lives in your image optimizer, and that is the one most indie deploys are actually exposed to.
Sponsored Google Ads for OpenAI Codex Lead to a Terminal Command That Installs Mac Malware. It Starts With a Real npm Install.
Cato Networks found a fake Codex download page running above the real results as a paid ad. There is no installer, only a command to paste, and the legitimate-looking first half is the entire trick.
Paint Generates Images on Your NPU. It Still Asks Microsoft for a GUID First, and Bakes It Into the Pixels.
Windows Paint's on-device image generation sends your prompt to an Azure endpoint, gets back a per-generation GUID, and quantizes it into the image itself. The visible watermark toggle does not control it, and stripping metadata does not remove it.
DeepSeek Shipped a Vision Model at Flash Prices, Then Made Weekends Off-Peak Starting Today. Your Batch Jobs Have a New Schedule.
DeepSeek-V4-Flash-Vision-Exp costs exactly what the text model costs. As of 00:00 Beijing time today, Saturdays and Sundays bill at the off-peak rate all day, which halves the cost of anything you can defer.