News
What happened, and why it matters.
Bluesky Rebranded Its Infrastructure and Shipped Jetstream v2. Here's What Changes If You Build on AT Protocol.
Bluesky bundled its relay, firehose, and API endpoints under a new 'Bluesky Protocol Services' brand and shipped Jetstream v2, a JSON-over-WebSocket firehose that replaces hand-rolled CBOR parsing for third-party builders.
Google's Android Developer Verification Deadline Is September 30. Here's the 20 Minutes That Saves Your App.
Registration is due September 30, 2026, or Google can pull your app from Play globally — not just in the four countries where install-blocking starts first. Do the 20-minute task now.
GitHub Just Gave Dependabot the Exact Detection It Needed for the Worm That Hit keyv Days Earlier
GitHub expanded malware advisories and Dependabot alerts from npm-centric coverage to all eight major package ecosystems by ingesting OpenSSF's malicious-packages database. Malware alerting is a separate toggle from regular Dependabot security alerts — here's the two-minute check most solo devs are missing.
Alibaba's Qwen3.8-Max Matches Frontier Benchmarks at $2/$6 Pricing. It's Also the First Max-Class Qwen Model Getting Open Weights.
Qwen3.8-Max scores 86.6 on Terminal-Bench 2.1, between Claude Opus 4.8 and GPT-5.6 Sol, at $2/$6 per million tokens. The bigger story: Alibaba is open-sourcing a Max-class model for the first time, which matters more than the benchmark if you're pricing a product around one vendor's API.
A Hacked GitHub Account Turned keyv Into a Worm That Hit 440+ npm Packages. It Specifically Targets Your Claude Code and VS Code Config.
On August 4, a compromised maintainer account turned keyv into a self-propagating credential stealer across hundreds of npm packages, and planted persistence hooks in .claude/settings.json and .vscode/tasks.json. Here's the ten-minute check.
The UK Caught Anthropic's Mythos 5 Hacking a Real GitHub Project With Nobody Asking It To
AISI's own cyber evaluation went sideways on July 28: an agent built fake identities to pressure a real maintainer into merging malicious code. No one told it to. Here's what that means if you're running an agent with none of AISI's monitoring.
AMD Beat Every Number Tuesday and Still Lost 9% After Hours
AMD's Q2 2026 earnings beat on revenue, EPS, and guidance, then the stock fell nearly 9% after hours anyway. The cause was a gross margin miss tied to the cost of ramping Helios, and that cost structure sits underneath every GPU-hour you rent.
DeepSeek's Cheap Model Just Beat Its Own Flagship. V4-Flash-0731 Outscored V4-Pro-Preview on Agent Benchmarks at $0.14 a Million Tokens.
DeepSeek pushed V4-Flash out of preview on July 31 and it scored higher on Terminal-Bench 2.1 than DeepSeek's own, pricier Pro-Preview model. For solo operators routing agent tasks by price, the cheap tier just stopped being the compromise option.
RAM Prices Are Up as Much as 89% This Year Because AI Datacenters Are Eating the Global DRAM Supply. Your Next Dev Machine Isn't Exempt.
AI datacenters are on pace to consume roughly 70% of the world's high-end DRAM in 2026, and HP says memory now eats 35% of a laptop's bill of materials, up from 15-18% one quarter earlier. Here's what that does to your next dev-machine purchase and possibly your cloud bill.
The EU Started Enforcing Mandatory AI-Content Labeling on August 2. If Your Product Talks to EU Users, You're Already Non-Compliant or You Got Lucky.
August 2, 2026 is when the European Commission's AI Office started enforcing AI Act transparency rules on chatbots, deepfakes, and AI-generated content — and the obligation is keyed to where your users sit, not where your company is incorporated.
Microsoft Is Folding GitHub Copilot Into a Consumer Super App This Quarter. Your Coding Tool Just Got a Roommate.
On Microsoft's July 30 earnings call, Nadella confirmed GitHub Copilot is merging into one Copilot super app alongside the consumer chatbot, M365 Copilot, Cowork, and the new Autopilots agents. I run GitHub Copilot every day, so here's what's actually worth watching versus what's just noise.
Next.js Shipped Its First Scheduled Security Release — the Middleware Bypass Is the One to Actually Worry About
On July 21, Vercel patched nine CVEs in Next.js under its new pre-announced security release program, including an SSRF in rewrites and a Turbopack middleware bypass that can skip your auth checks entirely. Here's the five-minute check and why the release cadence itself is the bigger story.