01 — Cloudflare
Cloudflare says eight eMudhra intermediate certificate keys are compromised, allowing attackers to forge certificates for any domain. It has shipped WARP and Tunnel updates and deployed service mitigations, with no active exploitation identified on its services. Developers also need to update the trust stores their applications actually use: a patched browser does not establish that a background service is protected.
Why it matters
Certificate trust spans runtimes, containers and API clients, so fixing browsers alone can leave applications exposed to server impersonation.
Read the source →02 — Scott Helme
Scott Helme reports recovering eight eMudhra certificate authority private keys in less than a second because each used a single-byte value. In local tests, curl, Python and Node accepted a forged certificate under default settings. Updated browsers have protections, he explains, but other software may still trust affected certificates until its certificate bundles are updated.
Why it matters
Attackers on a victim’s network path could impersonate trusted servers to vulnerable clients, making certificate-bundle updates a concrete engineering priority.
Read the source →03 — The Verge
Spotify’s new Android Automotive app runs on the car’s own hardware without a connected phone, The Verge reports. Launching in select Audi models, it gives Spotify control over the interface instead of using Google’s templates. Passengers can join a shared music queue by QR code, with video and lyrics available on supported passenger screens or while parked.
Why it matters
Native car apps give drivers another way to listen and give software companies more control over the dashboard experience.
Read the source →04 — NVIDIA
Nvidia says Google Cloud’s A5X instances, built around Vera Rubin hardware, will become generally available next month, with European expansion planned. Google plans infrastructure totaling up to 960,000 Rubin GPUs across multiple sites. David Silver’s Ineffable Intelligence is the first customer to access A5X, using it for large-scale reinforcement learning.
Why it matters
The rollout would give cloud customers access to another generation of AI infrastructure without owning the hardware.
Read the source →05 — Ars Technica
PHP maintainers plan emergency patches for two vulnerabilities rated 9.2 out of 10, Ars Technica reports. They are asking users to prepare to upgrade as soon as releases become available. The advisory allows an earlier release if vulnerability details become public or evidence of exploitation emerges.
Why it matters
Teams running PHP websites and applications should prepare their upgrade process so they can act promptly when fixes arrive.
Read the source →06 — Ars Technica
Elon Musk said he favors combining SpaceX and Tesla during SpaceX’s quarterly earnings Q&A, Ars Technica reports. He said shareholder support would be necessary. The comments express his preference; the saved report does not describe an agreed transaction.
Why it matters
A combination would bring Musk’s two largest companies together, but his endorsement leaves the practical terms and shareholder response unresolved.
Read the source →07 — Cloudflare
Cloudflare and VoidZero are working with Max Schwenk on tsrs, a Rust port developed with the TypeScript team and incubated in Oxc. An experimental npm package is available. Cloudflare reports up to eightfold speed gains and roughly 70% lower memory use against TypeScript 7.0 with matched worker counts; compatibility differences remain, and some optimizations have already reached upstream TypeScript.
Why it matters
Lower memory use could make full TypeScript tooling easier to run in browsers and constrained development environments.
Read the source →08 — Simon Willison
Simon Willison built Battle Drones, a browser strategy game for phones and desktops, through repeated coding-agent iterations. Its unusual multiplayer mode synchronizes nearby devices using audio; he later added online multiplayer after the sound caused headaches. His development account includes prompts, playable versions and an admission that he has reviewed almost none of the generated code.
Why it matters
The playable project offers a concrete look at agent-assisted experimentation, where repeated playtesting and design changes shape the result.
Read the source →