today's signal · no scroll
the brief
Open weights and practical tooling drove the day. Moonshot’s Kimi K3 (2.8T params) and Thinking Machines’ Inkling push the open frontier, while NVIDIA’s Nemotron 3 Embed took the RTEB crown for retrieval. On the dev side, Claude Code added session controls, Vercel surfaced cache miss reasons, and Next.js shipped a meaningful canary, with a neat Firefox-in-WASM demo for good measure.
CVE‑2026‑25089 (unauthenticated command injection) is now in CISA’s Known Exploited Vulnerabilities catalog—prioritize patching FortiSandbox instances exposed to untrusted networks.
CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV — Article URL: https://hellorecon.com/blog/cve-2026-25089 Comments URL: https://news.ycombinator.com/item?id=48940895 Points: 26 # Comments: 0
Moonshot AI announced Kimi K3 with 2.8T parameters, available via site/API now and promising open weights by July 27, claiming the first open “3T‑class” model.
Kimi K3, and what we can still learn from the pelican benchmark — <p>Chinese AI lab Moonshot AI <a href="https://www.kimi.com/blog/kimi-k3">announced Kimi K3</a> this morning, describing it as their "most capable model to date, with 2.8 trillion parameters". It's currently available via their website and API, but an open weight release is promised "by July 27, 2026".</p> <p>Moonshot are calling this the first "open 3T-class model" (I guess they're rounding 2.8 trillion up to 3 trillion), taki...
Inkling debuts as an Apache‑2.0 multimodal MoE (975B total, 41B active) trained on 45T tokens, with a smaller 276B/12B active variant on the way.
Inkling: Our open-weights model — <p><strong><a href="https://thinkingmachines.ai/news/introducing-inkling/">Inkling: Our open-weights model</a></strong></p> Mira Murati's Thinking Machines Lab just released their first open-weights model. Inkling is "a Mixture-of-Experts transformer with 975B total parameters, 41B active" - an Apache-2.0 licensed multimodal model trained on 45 trillion tokens of text, images, audio and video.</p> <p>They're also promising Inkling-Small, a 276B (12B active) m...
v2.1.212 introduces /fork for background sessions, an auto‑mode reset, and session‑wide web search caps to curb runaway agent loops—useful guardrails for agent developers.
v2.1.212 — What's changed /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip) Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops Added a per-session ...
Runtime logs now show why a response wasn’t a fresh cache hit (e.g., time/tag revalidation), helping debug ISR, Partial Prerendering, and CDN caching behavior.
Runtime logs now show cache reasons — Runtime logs now show a Cache Reason explaining why a request wasn't a fresh cache hit, for example a time-based or tag-based revalidation. Use cache reasons to debug misses and improve your hit rate. Cache reasons appear for any response the CDN can cache, including ISR, Partial Prerendering, and functions that set a header with directives like . Responses rendered dynamically on every request don't have a cache reason.Cache-Controlstale-while-revalidate...
Canary.88 unifies appShells with partial prefetching, expands test coverage under cacheComponents, and trims client chunk metadata to streamline builds.
v16.3.0-canary.88 — Misc Changes Run more test suites under cacheComponents flag: #95878 Unify appShells flag with Partial Prefetching: #95415 Fix Request Insights span collection: #95818 Revert "Replay same-document traversals that happen before hydration": #95853 [ci] Allow running all deploy tests with builds from a private registry: #95784 [turbopack] Only ship pages-router routes in the client chunk-group bootstrap manifest: #94671 [turbopack] Inline the chunk group bootstrap in Next.js ...
Puter’s demo runs full Firefox inside another browser via WebAssembly, showcasing heavy native app virtualization that hints at new sandboxed tooling and UI possibilities.
Firefox in WebAssembly — <p><strong><a href="https://developer.puter.com/labs/firefox-wasm/">Firefox in WebAssembly</a></strong></p> This is absurdly cool: Puter compiled Firefox to WebAssembly such that the whole browser runs in another browser.</p> <p>Here's my blog, running in Firefox, running in WebAssembly, running in Chrome:</p> <p><img alt="A Chrome window. The tab has the Firefox UI and has loaded my blog. On the right is the Chrome network panel showing that it loaded resources that ...
A compact C library offering normalization, case conversion, segmentation, bidi, collation, and confusables across major OSes—aiming to be a portable Unicode core.
Show HN: Mojibake – A low-level Unicode library written in C — I've written Mojibake because I don't like the other Unicode libraries for Unicode support. It consists of only two amalgamation files: mojibake.h and mojibake.c. I've added all the most important Unicode algorithms, such as normalization, case conversion, segmentation, bidirectional text, collation, confusable, and others. I regularly test it in these OSes: Linux, macOS, FreeBSD, OpenBSD, NetBSD, and Windows 11. You can find a WA...
NVIDIA’s embedding model ranks #1 overall on the RTEB benchmark, signaling stronger retrieval quality for agentic systems; Hugging Face details methodology and availability.
NVIDIA Nemotron 3 Embed Ranks #1 Overall on RTEB, Advancing Agentic Retrieval
Paper proposes direct on‑policy distillation to elicit stronger behaviors from weaker policies, reporting empirical gains across cs.LG/AI/CL tasks and outlining a reproducible training setup.
[27/30] 208 Likes, 3 Comments, 2 Posts 2607.05394, cs․LG | cs․AI | cs․CL, 08 Jul 2026 🆕Weak-to-Strong Generalization via Direct On-Policy Distillation Shiyuan Feng, Huan-ang Gao, Haohan Chi, Hanlin Wu, Zhilong Zhang, Zheng Jiang, Bingxiang He, Wei-Ying Ma, Ya-Qin Zhang, Hao Zhou
Pragmatic Engineer breaks down how Bun’s Zig→Rust migration cost ~$165K but compressed 1–2 years into 11 days—and why exhaustive tests made that speed viable.
The Pulse: What can we learn from Bun’s rapid Rust rewrite with AI? — To a sceptic, spending $165K to migrate Bun from Zig to Rust sounds very expensive. But to a realist, shortening a 1-2 year migration down to 11 days opens amazing new opportunities for devs. However, a thoroughly-tested project is required to pull it off.
Thibault Sottiaux reports deletions arise when codex runs unsandboxed in full‑access mode with no auto‑review and $HOME overrides; lock down agent permissions accordingly.
Quoting Thibault Sottiaux — <blockquote cite="https://twitter.com/thsottiaux/status/2077630111499882637"><p>On file deletions. We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files. </p> <p>What we have found is that this most commonly occurs when:</p> <ul> <li>Full access mode is enabled and codex is run without sandboxing protections, including without auto review being enabled</li> <li>The model attempts to override the $HOME env var to define a temporary directo...