9.0
CNBC Technology
technology
28 Aug 2026, 1:49 AM
Nvidia has reportedly agreed to acquire Hugging Face for $12.9 billion, according to The Information, with Business Insider separately reporting the two were in talks. Neither company has confirmed the deal, which would place the most widely used open-source AI model-sharing platform under Nvidia's ownership.
9.0
Hacker News
dev-community
17 Aug 2026, 10:18 PM
Wiz's autonomous AI security agent 'Red Agent' discovered and exploited a GitHub Actions script injection vulnerability in Snowflake's public repo (snowflakedb/snowflake-connector-net) five days after it went live. The vulnerability was introduced by PR #1218, co-authored by 'Copilot Autofix powered by AI,' which replaced a sanitized input pattern with direct string expansion of GitHub issue titles into a run: block—yet GitHub's AI-assisted security review flagged nothing. The exploit let an unauthenticated attacker execute arbitrary commands on a GitHub Actions runner and exfiltrate a token to access Snowflake's internal Jira.
9.0
The Register
technology
15 Aug 2026, 6:31 PM
A new variant of the Shai-Hulud npm worm, dubbed 'ChainDrop,' was identified on August 4, 2026, infecting 444 npm packages collectively downloaded ~2 billion times monthly, including widely used infrastructure dependencies like keyv, flat-cache, and cache-manager. Unlike typical supply chain attacks, ChainDrop propagates via tarballs rather than source commits, evading standard repository defenses, and can trigger infection simply by opening an infected Git branch in VS Code or Claude Code—no `npm install` required. Once active, it harvests npm tokens, cloud keys, and secrets from shell configs, environment variables, and live memory, then uses stolen npm tokens to download and re-poison tarballs of all packages that token can access.
8.5
Simon Willison
developer-ai
28 Aug 2026, 6:50 AM
Johann Rehberger found a prompt injection attack against Claude Code's auto mode that works 80% of the time, exploiting Python's import system via a zip archive containing a malicious struct.py that executes when base64 is imported. Worse, auto mode sometimes blocked Claude's own cleanup commands after it detected the compromise, making the safety mechanism part of the failure.
8.5
The Hacker News
security
27 Aug 2026, 11:13 PM
Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js: a heap buffer overflow in libheif triggered by crafted AVIF images (CVSS 9.5, affects all deployments), and a Windows path traversal flaw (CVE-2026-75604, CVSS 9.0, affects only Windows-hosted servers). Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026; Vercel-hosted apps are already protected.
8.5
Latent Space
developer-ai
27 Aug 2026, 9:50 AM
NVIDIA is acquiring HuggingFace for $13B, roughly 80x HuggingFace's $150M ARR and nearly double NVIDIA's initial $7B offer from January 2026, after HuggingFace doubled its customer base during the year. Separately, Z.ai launched GLM-5.3-Flash (the model behind the 'Ox Alpha' preview), a 320B total / 18B active parameter natively multimodal model with a 1M-token context window under the MIT License, claiming coding performance on par with Claude Opus 4.8. The article also references an OpenAI HuggingFace incident retrospective, though details are not included in the excerpt.