A George Mason University study finds a software task's difficulty for AI coding agents can be predicted from patch and repository structure before the agent ever runs.
Rust's security team removed a malicious proc-macro1 crate and the arrayref, internment, and append-only-vec crates it compromised, each pulled from crates.io within about 90 minutes.
A type confusion bug in isolated-vm's ExternalCopy let sandboxed JavaScript corrupt host memory, up to control-flow hijack; patched in 7.0.1 and 6.2.0.
Go 1.27 reached general availability on August 19, 2026, finalizing generic methods and shipping encoding/json/v2, crypto/mldsa, and new go fix modernizers.
Researchers found one threat actor ran typosquatting campaigns on RubyGems and npm days apart, sharing an identical Rust loader and Go infostealer.
Cerebras unveiled its CS-4 rack-scale inference system, claiming 30x faster performance than GPUs, though independent analysis finds the chip inside is an overclocked WSE-3, not a new design.
GitHub now feeds Dependabot malware alerts from OpenSSF's malicious-packages data across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
A Google study finds AI agents that first write a semi-formal specification before generating tests catch 9.8 percentage points more real bugs than agents that generate tests directly.
Cloudflare open-sourced @cloudflare/ci, a CI/CD SDK that replaces YAML pipelines with TypeScript running on Cloudflare Workflows.
An open-source Rust vector index built on Google Research's TurboQuant algorithm reports beating FAISS on speed, memory and insertion latency in benchmarks published alongside its 1.0.0 release.
GitHub's stacked pull requests feature exits private preview, adding a gh-stack CLI extension that lets developers split large changes into independently reviewable layers.
JEP 540 has reached Targeted status for JDK 28, adding a standard JSON API to the JDK itself, twelve years after a similar 2014 proposal was never delivered.