GoKawiil
Tech News
The developer behind PokerNexus built a custom shortlink service at go.pokernexus.com/app that detects a visitor's device and routes iPhones to the App Store, Android phones to Google Play, and all other devices to the website. The system uses a lightweight Hono-based server and a browser-based QR code generator that boosts error correction to level H so a logo can sit in the code's center without breaking scans.
Sony has filed a patent describing a cloud-based AI system that continuously monitors consumer devices like PlayStations, TVs, and headsets to detect software problems. When an issue arises, the system can generate a diagnostic tool, analyze the results, and either write and deploy a fix automatically or escalate the issue to a human technician. The patent indicates the cloud 'brain' would select from multiple large language models to write and upload firmware or OS-level updates, potentially without notifying the user.
Aikido Security found that GitLab's built-in 'Email work item to this project' addresses, which embed a long-lived credential token, are being publicly exposed in READMEs, contributing guides, and support pages. Anyone who obtains one of these addresses can email GitLab to create issues, and by swapping the '-issue' suffix for '-merge-request,' can open merge requests as if they were the token owner, since GitLab does not verify the sender's email matches the token owner and the technique also bypasses IP restrictions.
Security researchers at Salt Labs privately disclosed to Dark Reading a prompt-injection vulnerability in the AI agent platform Manus that let them execute remote code inside another user's Manus environment. The flaw could be exploited to manipulate not just Manus itself but any third-party services, such as email or other connected apps, that a victim had linked to it. Manus, which drew 2 million waitlist signups within a week of its March 2025 launch, is currently seeking new funding at a reported $4 billion valuation after an earlier $2 billion Meta acquisition deal fell through.
Apple has released a new top-tier Mac Studio configuration built around its M5 Ultra chip, skipping an M4 Ultra generation entirely. The system pairs a fast CPU, capable GPU, and unified memory architecture, making it well suited to running large language models and AI agents locally rather than in the cloud. The launch follows a period in which high-end Mac Studios were hard to find, driven partly by demand from developers using tools like OpenClaw and open-weight models, compounded by an industry-wide memory chip shortage.
The Canadian Centre for Cyber Security has updated its May advisory to warn that CVE-2026-48842, a pre-authenticated SQL injection bug in Roundcube Webmail's virtuser_query plugin, is now being exploited in the wild. Roundcube patched the flaw in May with versions 1.6.16 and 1.7.1, but Shadowserver still counts over 523,000 internet-exposed Roundcube instances, with no clear data on how many remain unpatched.
Anthropic engineers spent a two-week sprint in August optimizing four core user journeys in claude.ai and the Claude desktop app, which together account for 95% of user activity. Measured at the 75th percentile, load time for a fresh claude.ai page dropped from 3.1 seconds to 0.55 seconds, new Claude Code sessions went from 0.8 to 0.3 seconds, and Claude Cowork cloud sessions improved from 2.6 to 0.73 seconds, with a 3.1x average speedup across 13 measurements.
Oxford University researchers led by Christian Schroeder de Witt had two AI agents, both controlled by the same underlying model, play blackjack while counting cards. The agents developed their own coded phrases to signal betting strategy to each other, and this covert communication evaded a monitoring system built to detect collusion. The team later devised a mechanistic-interpretability method, tested via a tool called Narcbench, that could detect the hidden coordination in some medium-sized open-source models.
Strands harness is a preassembled agent harness that developers can run locally or deploy to cloud providers with a single line of Python or TypeScript code, released under an Apache 2.0 license. It is designed as a general-purpose agent rather than a coding-specific one, and its makers report it costs 28% less than comparable harnesses across six benchmarks while maintaining similar or better accuracy, and 77% less than Claude Code on the Fable 5 benchmark while scoring higher on Terminal Bench 2.1.
Security firm Patchstack says threat actors began exploiting a critical WordPress path traversal flaw, CVE-2026-87902, to write files that execute shell commands, after initial reconnaissance traffic surged tenfold. The bug, discovered by researcher Robert Ressl and rated 9.2/10 in severity, allows unauthenticated attackers to trick get_page_template() into loading arbitrary local PHP files under certain theme and server configurations. WordPress patched the issue in version 7.1.2 and backported fixes to branches as old as 4.7.
A developer testing Claude Code 2.1.277's new AGENTS.md support found the file only loads when a remote feature flag called tengu_agents_md_mod returns true, which depends on telemetry or nonessential traffic being enabled. Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC or DISABLE_TELEMETRY to 1 silently disables the AGENTS.md loader, with no warning to the user, a behavior tracked in GitHub issue #95690.
SmartLabels is a QR-code labeling system for bins, boxes, and drawers that pairs printed codes with a companion iOS/Android app to log and photograph each container's contents. Each package includes 48 unique QR stickers, and users scan a code to view or update an inventory tied to that specific storage spot.