October 17, 2026
Today's top tech stories, deduped across the newsletters I read and briefly summarized. Click a source to open the original article.
AI
NVIDIA RTX Spark: code, test and deploy on one machine
NVIDIA describes how developers who direct AI agents can code, test and deploy software on a single machine with RTX Spark. Developers no longer write every line themselves; they direct agents that write most of the code.
90% of US working hours fall on tasks AI benchmarks cover poorly
A Mercor analysis finds that 90% of US working hours go to tasks that AI benchmarks cover poorly. That raises questions about how well current tests measure AI's usefulness at work.
Apple: Muse Spark runs open with MLX on Mac Studio
Apple's ML researchers demonstrate distributed inference with MLX, running Muse Spark openly on Mac Studio. The post drew 281 points on Hacker News.
Security
Anthropic: Claude sheds light on the origins of the ECDSA curves
Anthropic publishes research that uses Claude to investigate where the ECDSA curves came from. The post drew 742 points on Hacker News.
Critical BlockStrap flaw lets attackers run code on Magento servers
A maximum-severity vulnerability (CVE-2026-103849) in Magento and Adobe Commerce could let attackers execute arbitrary PHP code on store servers. Researchers warn exploitation may begin soon.
Targeted ads installed Candiru spyware in zero-click attacks
Attackers delivered Candiru spyware to devices at Al Jazeera Media Network through targeted online ads. The attack needed no click, only that the malicious ad rendered on the victim's device.
BeyondTrust patches zero-day exploited since August
BeyondTrust told customers to patch a critical flaw in Remote Support (RS) that attackers have exploited as a zero-day since late August.
"Big Fish": exploiting a 37-year-old kernel bug in OpenBSD
Calif details how a 37-year-old bug in the OpenBSD kernel can be exploited. The post drew 170 points on Hacker News.
Dev
How the Claude Code team does code review
The Anthropic team argues that "did a human read the code?" is an imprecise proxy. The better question is what could go wrong with a change, and which check, automated or human, is best placed to catch it.
Web
JPEG XL vs. AVIF for web use cases
Jake Archibald compares JPEG XL and AVIF across web use cases. The post drew 218 points on Hacker News.
IT
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing the KB5127648 security update for Windows 11.
Other
Waymo comes to Toronto
Waymo announces it is coming to Toronto. The post drew 298 points on Hacker News.