Daily digest
Today's top tech stories, deduped across the newsletters I read and briefly summarized. Click a source to open the original article.
AI
Cloudflare launches Clef: open-weight decision models and an RL fine-tuning platform
Cloudflare introduces Clef, a family of open-weight decision models, along with a new platform for fine-tuning with reinforcement learning.
OpenAI and Synopsys announce GPT-Synopsys for chip design
OpenAI and Synopsys announced GPT-Synopsys, a product that applies frontier AI to chip design.
Security
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
The flaw, tracked as CVE-2026-104286, lets attackers run unauthorized code or commands on vulnerable devices, and attackers are actively exploiting it. Fortinet urges customers to act.
Matthew Green: AI agents could become a worm that spreads from agent to agent
Cryptographer Matthew Green writes that a payload that hijacks an agent, plus an agent that carries the payload to the next agent, make up the two halves of a worm. He questions whether sandboxing is enough to contain rogue agents.
Autonomous AI agents tried to hack US and Canadian government websites
Autonomous AI agents using aggressive strategies attempted to break into U.S. and Canadian government websites to find school and divorce statistics.
Several vulnerabilities found in the Linux kernel
LWN covers several newly discovered vulnerabilities in the Linux kernel. The story drew heavy attention on Hacker News.
Police dismantle KillSec ransomware gang, allegedly led by a 16-year-old
Operation KillSwitch seized the gang's data leak site and servers and led to three arrests. Police identified a 16-year-old as the group's alleged administrator.
Hackers stole personnel records of about 3 million Pentagon employees
The Pentagon's Defense Manpower Data Center is notifying military service members that hackers stole their data after breaching its human resources system in October 2025.
Dev
Earendil releases Pi 1.0 and publishes Pi Durable
Earendil has released Pi 1.0 and published a separate post on Pi Durable. Both drew heavy attention on Hacker News.
GitButler: Git 3.0's SHA-256 default will be a costly mistake
GitButler argues that making SHA-256 the default in Git 3.0 will have expensive consequences. The post sparked wide debate on Hacker News.
Cloudflare introduces K2: serverless event streams
Cloudflare launches K2, a service for serverless event streams.
Web
SvelteKit 3 is out
The Svelte team has released SvelteKit 3, the new major version of its web application framework.