Alvaro Lopez Ortega / 2026-08-16 Briefing

Created Sun, 16 Aug 2026 19:16:27 +0000 Modified Sun, 16 Aug 2026 19:17:13 +0000
5042 Words

A cyberattack on Sogang University leaked personal data of nearly 180,000 people, including former President Park Geun-hye. Researchers also exposed a real-time phishing kit impersonating PayPal and Apple, intercepting card numbers and codes. A critical n8n vulnerability (CVE-2026-33696) allows editor-level remote code execution via a single HTTP request.

🔒 Security & Privacy

Data of 180,000 exposed in South Korean university hack, including ex-president

A cyberattack on Sogang University exposed personal data of nearly 180,000 students, alumni, and staff, including former President Park Geun-hye. Leaked information included names, IDs, emails, phone numbers, and encrypted passwords, but no resident registration or financial data. The university urged affected individuals to change passwords and be alert for phishing scams.

Hackers impersonate PayPal and Apple with new real-time phishing kit

Cisco Talos discovered a new phishing kit called JWR that impersonates PayPal, Apple, Shopify, and other brands, letting attackers view victims’ card numbers, passwords, and verification codes in real time before submission. The kit can dynamically control fake checkout and verification pages, and is linked with medium confidence to the Outsider phishing service tied to $1.9 billion in losses.

CVE-2026-33696: From a Schema Name to RCE in n8n

A vulnerability in n8n’s GSuiteAdmin node lets an attacker with editor access use a schema name of “proto” to pollute Object.prototype with attacker-controlled properties. This can be chained with the Git node via GIT_SSH_COMMAND to achieve remote code execution in a single HTTP request, and also causes denial of service by breaking all database queries.

Cloudflare silently injects its analytics when you switch nameservers

After switching nameservers to Cloudflare to enable R2 bucket serving, a user discovered Cloudflare had silently injected a JavaScript analytics snippet into their HTML-only, JS-free site. The user had to manually disable it via the Analytics dashboard, criticizing the move as invasive and arguing that such features should be opt-in rather than opt-out.

Ordinary WiFi can now identify you with near-perfect accuracy

Researchers have demonstrated that ordinary WiFi signals can identify individuals with nearly 100% accuracy, without needing cameras, special sensors, or the person carrying any connected device. The system works by analyzing how radio waves propagate through a space, recognizing people even from different angles and walking styles. This capability turns ubiquitous WiFi networks into potential invisible surveillance tools, posing a significant privacy risk.

Firefox for iOS now has a native adblocker

Firefox for iOS has introduced a native adblocker, allowing users to block ads directly within the browser. This built-in feature eliminates the need for separate ad-blocking extensions on Apple devices.

Access to telemetry data: Automotive industry criticizes intelligence reform

The German automotive industry is criticizing a planned intelligence reform that would require automakers and workshops to share vehicle telemetry data with intelligence agencies upon request. Industry associations are demanding clearer, legally secure rules and warning against precautionary data collection, while rejecting any direct access to vehicles and stressing that workshops must not become an extended arm of the secret services.

Leave your screen unlocked, meet developers paypal.com

A PayPal office prank punished unlocked workstations by sending embarrassing emails from the offender’s account to the company developer list, delivering an immediate, peer-driven security lesson. The author argues this visceral, zero-damage consequence was far more effective at teaching screen-locking habits than modern abstract compliance training, which lacks the memorable feedback loop.

Laptop is the last place your secrets are still in plaintext

jitpass is a macOS-only security tool that moves secrets from plaintext files into an encrypted vault gated by Touch ID, replacing them with decoys on disk and releasing real values only to authorized processes in memory. It works via execve, native credential protocols, or named-pipe mounts, and is installed through Homebrew with Apple-notarized binaries.

21,000 MCP servers exposed: the protocol reaches a security inflection point

Over 21,000 internet-facing MCP servers are exposed, with 91.8% of audited production servers lacking OAuth and growing critical CVEs. The security community disputes Anthropic’s defense of the STDIO transport as “by design” despite widespread vulnerabilities. With governance now under the Linux Foundation, the industry must choose between architectural hardening or continued developer-side mitigation.

Stopping a cyberattack while walking your dog - defensive AI security CEO says it’s not ruff to do

Corma’s CEO says its defensive AI enables security teams to stop cyberattacks even while walking a dog. The company aims to give defenders a unifying “one ring” to consolidate power against threats.

🤖 AI & Machine Learning

On Knowledge Representation

The article examines the difficulty of knowledge representation in computers, using the example of storing a phone number with complex contextual conditions to illustrate the challenge. It distinguishes between model knowledge (how the world works) and state knowledge (how things are at a given time), linking these to conceptual and instance memory. The author advocates for developing a better “machine language” for AI by analyzing common knowledge representation paradigms.

Fields Medalist Gowers: LLM-solved math problems mostly counterexamples, not proofs

Timothy Gowers explains how academic journals can undergo “fission” when an editorial board resigns to start a new journal, leaving the original publisher to assemble a new board and creating a name-only “zombie” successor. He cites his own experience with the math journal ERA-MS, an open-access, no-fee journal whose low submission numbers indirectly led to a dispute and eventual split.

Hugging Face: Qwen tops with 151K+ derivatives, a top open-model foundation

Hugging Face reports continued rapid growth in open model repositories and datasets, but downloads remain extremely concentrated, with 1.5% of repositories accounting for 99.2% of all downloads. Qwen has become one of the largest foundations in the open ecosystem, with over 151,000 derivative models, more than any other. Chinese labs now lead frontier-scale open releases, while U.S. activity is driven largely by hardware companies like AMD and NVIDIA publishing models to promote their chips.

A public AI whose memory is shared across all users

A new public AI concept features a single, shared memory across all users, enabling collective experiences. The AI can suggest what is worth remembering when users are unsure what to say.

Is the industry ready for tokens-constrained work?

A developer who exhausted his AI token allowance was told to “make do,” highlighting the difficulty of manually taking over from parallel AI agents mid-task. The article argues that token limits create idle time, and companies should encourage useful activities like learning during such downtime rather than simply granting more tokens, which could lead to sloppier work.

Claude: System Prompts

Claude’s web interface and mobile apps use a system prompt to supply current information, such as the date, and encourage behaviors like providing code snippets in Markdown, with periodic updates that do not apply to the API. Starting with the Claude 4.6 generation, each model ID is a single fixed snapshot, so those models have one entry.

AI Coding Without the Vibes

The article advises students to avoid both ignoring AI and fully delegating work to it, since either extreme prevents genuine learning. Instead, users should split tasks—such as writing code while AI checks it, or vice versa—rather than letting AI handle both stages. Fully trusting AI to write and verify code, or “vibe-coding,” is unrealistic and leaves developers with poor skills and unmaintainable code.

What happens when an LLM never sees material beyond fifth grade?

LittleLearner is a set of language models (0.6B–5B) trained from scratch on an 88B-token corpus limited to U.S. elementary-school (K–5) material, alongside matched unfiltered control models. Experiments found that scaling, post-training, and in-context learning amplified in-curriculum skills but did not meaningfully improve out-of-scope performance, indicating that the pretraining data filter sets the capability ceiling.

Has the hallucination problem in AI been solved?

The article questions whether AI hallucination problems have truly been solved, with the author asserting that all AI can and will hallucinate. Despite receiving downvotes for this view, the author notes that no one has provided counter-evidence or sources, prompting a request for clarification or nuance.

Patterns and problems in emerging multi-agent systems

As AI agents increasingly operate in shared codebases and social systems, agent-agent interactions may soon outpace human ones, yet current institutions assume human-speed oversight and multiagent behavior at scale remains poorly understood. Individual quirks like confabulation and reward hacking could compound into systemic failures. In a software vulnerability detection experiment, a coordinating swarm of 45 agents with peer review found vulnerabilities at a roughly constant rate compared with independent parallel agents, with no clear advantage established.

It’s How You Ask: Gender-Associated Linguistic Bias in LLMs

Prompts using linguistic features more common in women’s speech—such as hedges, tag questions, and collective reference—consistently produce shorter, less sophisticated, and less formal responses from LLMs across various document types and models, even after controlling for prompt complexity. Explicit gender cues like sign-off names had no effect, while linguistic register was highly influential, suggesting shared mechanisms but a dominant role for dialect. Mitigation is difficult because these patterns are culturally embedded, operate outside conscious control, and are entangled in early transformer layers.

🛠️ Development & Open Source

A Third World Embedded Engineer Responds to “RISC-V: They Should Have Known Better”

A third-world embedded engineer responds to Dmitry Grinberg’s RISC-V critique by acknowledging some technical flaws but arguing he misses the key point: RISC-V enables ultra-cheap microcontrollers that are accessible to students in developing countries. A ten-cent chip can mean the difference between each student getting hands-on hardware versus having nothing at all. The author notes that Grinberg’s own derivation of a cheap RV32EC core validates the importance of these low-cost parts.

nokia-dct3-emulator: Open-source emulator + analysis toolkit for Nokia DCT3 phones

An open-source emulator and analysis toolkit models Nokia DCT3-era phones (3310, 3210, etc.) at the silicon level, booting real, unpatched firmware in a browser or native GUI. It supports GSM registration, voice calls, SMS, WAP browsing, and identity provisioning, while requiring users to supply their own legally obtained flash images. The project focuses on preserving and documenting the behavior of roughly 25-year-old phone hardware for offline educational analysis.

Every Fucking Website

The article satirizes the cookie-cutter design of modern startup websites, mocking their predictable typography, italicized text, and overused em dashes. It also pokes fun at clichéd elements like useless install commands and generic “Trusted by” sections featuring the same few companies.

I thought I was building a C replacement. I was wrong

The author realized that marketing his language C3 as a “C alternative” was misleading, because the term means something different today than it did when C was an application language. Reflecting on his early productivity with procedural languages like Pascal and PHP, he found that OOP’s demand for up-front design and coupling slowed development. He concluded many OO programs could be written in C using an arena allocator and dynamic arrays, without needing OOP at all.

Protecting the Rust standard library from accidental breakage

The Rust standard library now uses cargo-semver-checks to automatically detect accidental API breakage, after multiple historical incidents where changes to stable traits broke downstream crates. Implementing this required months of work, numerous pull requests, and over 15,000 lines of code to integrate stability information into rustdoc JSON and adapt the tool’s linting model. The tool can now catch issues such as destabilization of stable APIs and breakage from unstable trait methods.

Monitoring SystemD services with Healthchecks.io

The author describes using healthchecks.io to monitor scheduled systemd services, triggering curl-based pings via OnSuccess/OnFailure hooks. They later updated their SystemD template file to support start and logging options, noting that explicit :failure, :success, and :start suffixes are required for passing $MONITOR_* environment variables.

A Tour of Magit’s Status Interface

Magit, an Emacs Git client, features an intuitive main interface called Magit Status that displays key repository information such as head, merge, push, and tag, along with recent commits and sections for changes that appear only when relevant. The interface is highly interactive, with a hidden commands menu accessible via the “?” key that lists nearly all Git operations, making them easy to discover and execute.

The essence of architectural work - Part 5

The article outlines two key principles of architectural work: every decision involves trade-offs, and decisions can only be judged within their context. It then introduces the 4E framework for organizing architectural activities, beginning with “Explore,” which emphasizes designing multiple solution options rather than committing to a single one.

The SDLC Was Designed for Humans

Companies are shifting from LLM-based code generation to agentic development, emphasizing skills, MCP, standardized environments, and evaluation to make AI work repeatable and trustworthy. The existing software pipeline assumes human speed and accountability, which breaks when multiple agents operate quickly. To adapt, organizations are converting human knowledge into machine-readable documentation and paved paths, effectively making the developer platform serve agents as a new persona.

Grafana agent observability for Hermes Agent

The grafana-agento11y-hermes plugin records LLM calls and tool executions for Hermes Agent, emitting OpenTelemetry traces and metrics to Grafana Cloud’s Agent Observability. It is installed via pip, enabled by editing ~/.hermes/config.yaml, and configured with environment variables from the Grafana setup page. By default it captures full content; setting AGENTO11Y_CONTENT_CAPTURE_MODE=metadata_only prevents prompts, responses, and tool I/O from leaving the machine.

PyScrappy, self-healing web scraping selectors plus an MCP server

PyScrappy is an AI-native Python web scraping toolkit that can be used as a library or as an MCP server for AI agents, featuring adaptive self-healing selectors and stealth capabilities to bypass anti-bot filters. It converts websites into structured, LLM-ready formats like Markdown, JSON, and DataFrames, and includes JavaScript rendering, concurrent scraping, proxy support, and 20+ built-in scrapers for common sites.

The quirky personal homepages of programming language creators

Breck Yunits compiled a collection showcasing the quirky personal homepages of programming language creators, using data from PLDB. The project highlights the unique and often unconventional web presence of these developers.

Mic Drop, a real-time multiplayer karaoke game

Mic Drop is a real-time multiplayer karaoke game. The app’s page currently indicates that JavaScript must be enabled to run the game. Users need to enable JavaScript in their browser to access it.

I built a native app for coding agents with Rust and GPUI

Waku is a native, keyboard-first desktop app that unifies coding agent CLIs, providing sessions, transcripts, tool activity, and checkpoints in one timeline. Built with Rust and GPUI, it runs locally without accounts or telemetry, and supports rollback of both code and provider conversations via hidden git refs. It auto-updates via Sparkle and interfaces with agents over native protocols like stream-json and JSON-RPC.

The what, why, and how of pull requests and source comments

The article explains the purpose and mechanics of pull requests and source comments, drawing on insights from a Microsoft veteran. It highlights the importance of understanding the difference between the two and offers advice on convincing approvers to accept a code change.

💼 Business & Industry

Sony CEO Hiroki Totoki aims to transform Sony into music, movies, games, and tech.

Sony built its empire on consumer electronics, but CEO Hiroki Totoki is focused on the company’s future in entertainment—music, movies, video games, and the technology behind them. He is not sentimental about selling off the television business, despite his long history with the company.

Malaysia Q2 GDP grew 6% on 7.5% manufacturing (chips) and 6.6% construction (data centers)

Malaysia’s Q2 GDP grew 6% year-on-year, fueled by a 7.5% expansion in manufacturing led by chipmaking and a 6.6% rise in construction supported by data center development. The country is benefiting from the global data centre boom.

BlackBerry reports first cash-positive Q1 since 2017, boosted by QNX and Secusmart

BlackBerry reported a cash-positive first quarter for the first time since 2017, driven by growth in its QNX and Secusmart products. A decade after exiting the handset market, the company now relies on automotive and security software for its future.

Pathway raises $30M seed at $500M valuation for its Post-Transformer BDH AI models

Pathway raised a $30M seed at a $500M valuation to scale its post-Transformer BDH architecture, with funds going toward expanded compute capacity including NVIDIA GB300 systems. The company also reported its BDH-CQ reasoning model scored 29.5% on ARC-AGI-1 at an inference cost of $0.0007 per task, highlighting its focus on architectural efficiency over brute-force scaling.

The AI Credit Resale Economy

Token brokers are buying and reselling unused AI inference credits, offering steep discounts through direct email outreach, credit marketplaces, and bulk-pricing routers. The market is sizable, with tens of millions of dollars in credits available, but this pseudo-currency invites abuse, likely leading to crackdowns.

Anthropic revenue reportedly jumps to more than $11.5B in second quarter

Anthropic reported preliminary Q2 revenue of over $11.5 billion, a 14-fold jump from $787 million a year earlier, along with positive adjusted operating income. The company is preparing for a potential IPO as soon as this fall, which would be among the first major private AI public listings. Its growth comes as it competes with OpenAI and gains traction among professionals for coding tasks.

Stripe 2.9% vs. Adyen 0.6% vs. Braintree 2.59%: 2026 Fees

Adyen offers the lowest enterprise cost via interchange-plus pricing, while Stripe excels in developer tooling and embedded finance at a higher default rate, and Braintree differentiates through native PayPal/Venmo acceptance. The best choice depends on factors like annual volume, business type, and desired ownership of the payments stack.

The 37signals Manager Playbook

The 37signals Manager Playbook is a guide for people managers at 37signals, detailing expectations, leadership philosophies, and how to balance management with individual contributor work. It covers team growth, performance management, and team development, including hiring, feedback, reviews, and coaching. Managers with questions are directed to the People Ops team.

US Space Force gives Rocket Lab $397M to build threat-tracking ‘Flatellites’

Rocket Lab has been awarded a $397 million US Space Force contract to design, manufacture, and launch a fleet of flat “Flatellites” for real-time airborne threat tracking under the SB-AMTI program. The flat design maximizes satellites per launch and is optimized for orbital constellations, with launches planned aboard the upcoming Neutron rocket. This is Rocket Lab’s largest national defense contract this year, part of a combined $943 million in recent defense deals.

ChatGPT lost 22 points of web share in a year

ChatGPT’s share of worldwide AI-chatbot web visits fell from 76% to 54% year-over-year, while Gemini rose from 6% to 28% and Claude from 1% to 9%. These figures reflect web-visit share only, not monthly users or revenue, and Gemini’s heavy app-based usage explains its relatively lower web share.

🌐 Society & Politics

Anti-Social Media

The article argues that mainstream social media has been weaponized into a machine for distraction, propaganda, and outrage, prioritizing engagement over genuine interaction. It contrasts this with early niche platforms that had an emotional core, concluding that today’s platforms turn everyone into influencers, which ultimately makes social media meaningless.

AI concerns become key midterms issue as candidates add AI, data center policies in ~40% of US races

According to a Washington Post analysis, artificial intelligence has emerged as an unprecedented midterms issue, with candidates in roughly 40% of U.S. races adding AI and data center policies to their platforms. The candidates are responding to voter concerns about AI’s impact on the economy, job prospects, and corporate power.

Chinese more optimistic about AI than Americans, seeing it as practical tool affecting fewer people

Chinese citizens are far more optimistic about AI than Americans, with 84% expressing excitement compared to 38% in the US, and 72% trusting AI versus 32%. This gap stems from differing views on whether AI’s benefits will reach them and whether the technology is being controlled, as Chinese see AI as a practical tool that disrupts a smaller share of their population.

Amodei defends policy, open weights won’t decentralize, backs pre-vetting, trust via accomplishments

Dario Amodei defended his policy proposals, arguing that open-weight AI models will not decentralize power as some claim. He endorsed pre-launch vetting for AI systems, stating that earning trust through real accomplishments is more important than relying on open release alone.

The weekend is 100 years old

The Soviet Union abolished traditional weekends from 1929 to 1940, assigning workers random staggered days off to keep factories running, but the policy caused social disruption and was eventually abandoned. The article notes the weekend is only about 100 years old, popularized by Henry Ford in 1926, and is now evolving with trends like remote work and four-day weeks.

GPS and the Lost Art of Getting Lost

GPS, originally a U.S. military technology, has become an essential civilian tool, but society’s heavy reliance on it creates vulnerabilities such as jamming and spoofing, which can send false location data. This dependence has also altered people’s spatial awareness, making them trust a digital “blue dot” over physical landmarks and raising concerns about what happens when GPS fails.

Our Reality Is Shifting and It’s Just the Start

Science currently explains only about 5% of the universe, meaning our technological progress is built on a very limited understanding of reality. With AI achieving recursive self-improvement, scientific and technological advancement is set to accelerate exponentially, forcing us to radically rethink what is possible. This shift could ultimately lead to the realization of phenomena once dismissed as impossible, such as advanced UFOs.

US oil reserves are so low, the caverns holding them could be damaged

The U.S. Strategic Petroleum Reserve has fallen below 300 million barrels for the first time since the early 1980s amid withdrawals linked to the Iran war, raising expert warnings that repeated rapid drawdowns could destabilize the salt caverns storing the crude, though the Energy Department denies any collapse risk. The strain coincides with record late-summer gas prices, with the national average hitting $4.07 per gallon.

The ‘Country Hicks’ Who Refused $26M from an AI Data Center

A Kentucky family, Delsia Bare and her mother Ida Huddleston, rejected a $26.48 million offer for their farmland after learning it would be used for a 2.2-gigawatt data center. They initially accepted the deal but changed their minds because their family had farmed the land for nearly 200 years.

Court Rejects Fair Use Claim, Orders YouTube to Unmask Anime Recap Channels

A Japanese publisher, KADOKAWA, sought DMCA subpoenas to unmask three Korean YouTubers known for anime recap and commentary videos. The creators filed motions to quash, arguing fair use and claiming their videos drive traffic to licensed streaming platforms. A court responded by ordering supplemental fair use briefing before deciding on the subpoenas.

South Korea proposes talks to officially end war with North

South Korean President Lee Jae Myung proposed talks with North Korea to formally end the ongoing technical war, offering a multi-layered security system and discussions on curbing Pyongyang’s nuclear program. North Korea has not yet responded and has previously rejected similar overtures. The two countries remain technically at war because only an armistice, not a peace treaty, was signed in 1953.

🔬 Science & Medicine

Patients, families, doctors, nurses increasingly turn to AI tools like Face2Gene for rare diseases

Patients, families, doctors, and nurses are increasingly using AI tools like Face2Gene to help diagnose rare and hard-to-find diseases. This technology can shorten the often years-long diagnostic journey for patients with rare conditions.

NIH is ending a key grant for budding clinical researchers

The NIH is discontinuing a key grant program that supports early-career clinical researchers. This move could reduce funding opportunities for budding investigators in clinical research.

St Lucie Nuclear Reactor Unit 1 manually shutdown, 3 control rods drop into core

Unit 1 at the St. Lucie Nuclear Power Plant was manually shut down on Aug. 13, 2026, after three control rods dropped into the reactor core while operating at 100% power. The NRC classified the event as a non-emergency, and the plant was stabilized in Hot Standby (Mode 3) with decay heat removed normally. Unit 2 was not affected, and Unit 1 remains shut down.

A U.S. Strategy to Prevent the Creation of Mirror Life

A RAND report outlines a proposed U.S. strategy to prevent the creation of “mirror life”—hypothetical organisms built with reversed molecular chirality that could evade immune defenses and disrupt ecosystems. Experts warn such life could become feasible within decades and pose unacceptable global risks, so the strategy calls for proactive governance and prevention efforts before meaningful action becomes impossible.

Research papers using “kidney disappointment” instead of “kidney failure”

The article highlights that various research papers use the phrase “kidney disappointment” instead of “kidney failure,” likely due to translation errors. Examples appear across studies on chronic kidney disease detection, antioxidant status, and related medical topics. The term is consistently used in place of “kidney failure” in these academic contexts.

Health benefits of Tai Chi

Tai chi is a low-impact, mind-body exercise that improves strength, flexibility, and balance, with growing evidence it helps treat or prevent many health problems. It is easily adapted for various fitness levels and can complement standard medical treatment, especially for age-related conditions.

Falstad Math and Physics Simulations

Falstad Math and Physics Simulations provides a collection of interactive simulations covering topics such as oscillations, electromagnetism, quantum mechanics, and linear algebra. It also includes links to other educational sites with math and physics resources, as well as some fun content.

Government sponsored study on alcohol doesn’t stand up to scrutiny

A government-commissioned study claiming low-level drinking has no protective health effect is criticized for flawed and opaque statistical methods. The article points to unexplained confidence intervals, improper risk aggregation, and overreliance on a highly uncertain elderly age group, concluding the study is too sloppy to overturn existing drinking recommendations.

Zapping Rocks Unlocks Stimulated Geologic Hydrogen

Eden GeoPower is testing electrical reservoir stimulation, which uses high-voltage pulses from underground electrodes to fracture rock. This method could enable artificial geologic hydrogen production by allowing water to reach iron-rich rock and release hydrogen. It offers a potentially cleaner alternative to conventional hydrogen manufacturing, which is currently expensive or fossil-fuel-dependent.