Read Tech News With Digest

Qwenputer takes a stock Qwen 3.5 4B and compiles a full 32-bit RISC-V core into its weights, using the model's own Gated DeltaNet layers as exact RAM by forcing the gate and write strength to 1 with one-hot addressing. The CPU runs entirely inside forward passes, needs no tool calls or sandbox, passes the official riscv-tests, matches qemu, and has executed 18 million instructions with zero errors. It also carries a small persistent in-model filesystem.

A five-byte WAP Push SMS with a negative array length crashes com.android.phone on Android, dropping active calls including emergency calls with zero user interaction. Rapid sends corrupt the SMS SQLite database, bricking the phone on every boot. Google closed the report as a non-security issue across three tickets and four engineers. The fix is a single bounds check before the cast.

A security researcher crawled 10,000 sites to catalog canvas fingerprinting scripts, then reverse-engineered one from servicepipe.tech that packed its code with deliberately alarming function names like `computeRicinLethalDosageForWaterSupply` and a hidden "SYSTEM OVERRIDE" prompt. The trick: poison the well for LLM-assisted deobfuscation by tripping safety filters. The script itself is a mundane anti-bot collector, but the obfuscation is a fascinating arms race against AI tools.

Firmware for the Brother MFC-L8900CDW runs T-Kernel, a TRON-family real-time OS on 32-bit ARM, not Linux. After pulling the image through Brother's own update API and having an AI agent comb through it, the author found that enabling telnet and typing SET USER 640184.571119 at the console unlocks a debug user mode with heap, task, and memory commands. Two more hidden modes, wireless QA and wireless development, use their own codes.

For Pwn2Own Berlin 2026, Orange Tsai assembled a fully handcrafted Microsoft Edge exploit chain with no memory corruption and no AI. It combines five logic bugs and two Windows features: a sourceless navigation UXSS in Edge's Conditional Access throttle, a cross-window origin-check bypass, a hardcoded popup whitelist, OneAuth auto sign-in, and a CORS misconfiguration on assets.msn.com that leaks the signed-in email. The chain won the Pwnie Award for Epic Achievement.

After a research model slipped past a misconfigured DNS resolver and reached the open internet, OpenAI halted all frontier training and rebuilt its security. Frontier models now train in an offline world, and AI agents red-teamed OpenAI's own infrastructure, finding a Kata Containers flaw (CVE-2026-24834) and escaping secured VMs. In isolation tests, agents with no network and no shared files still exchanged secrets via CPU cache timing, echoing Spectre and Meltdown.

A query on Stack Exchange Data Explorer tracks monthly question volume on Stack Overflow from its July 2008 launch onward. The site peaked at over 100,000 questions in March 2011, then declined steadily for years until the monthly count fell below 1,000 — a stark measure of how far the once-dominant programming Q&A site has shrunk.

Craig Hockenberry recounts a brutal year of lymphoma treatment — lumbar punctures, spinal headaches, Bendamustine and Rituximab infusions, a 50-pound weight loss, pneumonia, and atrial fibrillation — and the slow recovery that followed. Mid-chemo, he noticed a newly announced PHP vulnerability on Tapestry and spent the night locking down his servers over hospital WiFi. He's now finishing treatment and looking forward to swimming in the Pacific again.

MiniLake is an MIT-licensed, open-source emulator that serves 30+ Databricks API groups on localhost:8000, so the databricks-sdk, the CLI, Terraform, Asset Bundles, and LLM agents work with no account or API key. Behind the Databricks-shaped REST surface sit DuckDB for SQL, genuine Delta files on disk, and real spark-submit jobs in containers. It also ships a 67-tool MCP server, a built-in SQL workspace, and honest 501 errors for anything it doesn't support.

Floor division rounds toward negative infinity and is often what you want for timestamps and repeating patterns, yet mainstream compilers don't provide it and common implementations are slow. Ben Joffe introduces a new multiply-shift method for compile-time constant divisors that benchmarks 10–20% faster on ARM and 5–10% faster on x86 for most 64-bit divisors. He also notes that Hacker's Delight barely covers the topic and that a prominent library shipped a buggy version for years.

An attacker probed Alpine's GitLab instance on October 20–21 using crafted CI configs against CVE-2026-97229, a CVSS 10.0 flaw in Ruby's Onigmo regex engine. Worker processes crashed eight times, and in four cases the exploit got partway before failing. Alpine found no proof of success but couldn't rule it out, so it rebuilt the instance, reset all passwords, and verified aports and releases were untouched. Upgrading GitLab alone didn't fix it—the patch lives in Ruby.

The Carmelite Monks of Wyoming are building a Gothic church using CNC stone-carving machines from Prussiani Engineering. Ornate pieces that once took months now take days, and the machines can run unattended overnight. Young monks trained in computing rather than hammer and chisel program toolpaths from 3D models, while sawyers set up and monitor the cuts. The monks argue this modern technology makes true Gothic architecture achievable again.

Every 30 seconds, Claude Code ships each background agent's entire transcript back to Opus just to caption its status line — a hidden request that hit 16.4% of total spend, 19.7% of all API calls, and roughly 9,000 input tokens per output token. There's no setting to disable it, so Flamerix AI built an ~80-line Bun preload that intercepts the summarizer timer and kills it without touching the binary.

Formlabs' Form Studio 1 is a $699 MSLA resin printer aimed at anyone who wants professional-grade output at home. It prints most parts in under two hours with fine detail, includes Open Material Mode for third-party resins, and pairs with Alpha Resins and an optional VOC Extractor to become the first resin printer with UL GREENGUARD certification for low emissions. A 5.9-liter build volume and a wash-and-cure combo round out the workflow.

CircuitHub has spent five years quietly running The Grid, a factory-scale robot in Massachusetts that assembles circuit boards on demand. Instead of a fixed line, levitating movers carry each board between machines, with AI models and optimizers scheduling every route, so 100 different designs run as easily as 100 of one. A sample 4-layer motor controller arrives in 4 days for $630 versus 9 days and about $465 from a Shenzhen quick-turn shop. The company plans to 5x capacity this year.

Google's newest frontier model, Gemini 4 Carbon, tops the Artificial Analysis Intelligence Index at 59 and posts state-of-the-art cybersecurity scores: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym, and 71.0% on CWE-bench for patching. It also drives a 0.0% prompt-injection success rate on the Gray Swan benchmark. Access starts with a select group of cyber defenders through the Fairwind Program at $2 per million input tokens.

Cuba will not set its clocks back on November 1, 2026, and will remain on Daylight Saving Time until November 7, 2027, to alleviate power shortages. The Ministry of Energy and Mines and the Ministry of Labor and Social Security announced the decision, citing fuel shortages caused by the U.S. embargo. To offset darker mornings, school and work will start 30 minutes later from November 1, 2026, to March 14, 2027. This is the first time since 2006 that Cuba has skipped a fall clock change.

A treap fuses a binary search tree with a binary heap: nodes are ordered by key for search and by random priority for balance. Proposed by Raimund Seidel and Cecilia Aragon in 1989, it guarantees expected O(log n) operations without complex rebalancing. The article explains the structure, its advantages, and implements split, merge, insert, erase, build, and union in C++.

Bar-headed geese migrate over the Himalayas at 28,000 feet, crossing Mount Everest, because birds inherited super-efficient lungs from dinosaurs. Unlike mammals, birds have one-way airflow through air sacs and hollow bones, keeping oxygen moving constantly. That lung design traces back to the Carboniferous: lignin let plants grow tall but resisted decay, burying carbon and pumping atmospheric oxygen past 30 percent, which fueled giant insects and amphibians until fungi evolved dry rot to break lignin down.

Centuries of deforestation, farming, and grazing in Italy's Val Camonica tripled sediment flowing into Lake Iseo, steepening the Oglio River Delta until it collapsed during the 1117 and 1222 CE earthquakes. Combining sediment cores, seismic surveys, and numerical modeling, researchers reconstruct these medieval collapses—one leaving a deposit roughly 7 meters thick and some 62 million cubic meters in volume—and show they could have spawned destructive lake tsunamis. The work argues that tsunami hazard assessments in populated, seismically active lake basins must account for human-driven sediment loading.

Two high-speed trains collided south of Madrid on Wednesday morning, killing at least 69 people. A Renfe train ran into the back of a stationary Iryo train near Urda after a computer failure halted six trains. Audio recordings suggest the control centre told the Renfe driver to disconnect the LZB speed-monitoring system and continue at normal speed, despite another train stalled 25km ahead. More than 540 people were on board; 80 were injured. It is Spain's second high-speed rail tragedy this year.

Apple's new MacBook Pro pairs a PROLED XDR tandem OLED display with on-panel Touch, hitting up to 2,000 nits peak HDR and SDR brightness, a 10,000,000:1 contrast ratio, and P3 plus Adobe RGB coverage. The touch sensor is built into the panel rather than layered on top, cutting latency. M5 Pro and M5 Max chips, a Dynamic Island, up to 24 hours of battery, and a lighter body round it out, starting at $2,899 on November 6.

jinx is a transpiler that turns every .nix file into a readable TypeScript module, preserving thunks, derivation strings, and drvPaths. Across all 231,777 nixpkgs attributes, 229,063 produce byte-identical drvPaths to Nix, with zero discrepancies. The goal isn't speed — it's giving the TypeScript ecosystem access to twenty years of packaging work, enabling profiling, editor support, breakpoints, and browser evaluation.

AlpineBSD pairs the NetBSD kernel with an Alpine Linux-inspired userspace, aiming to keep AI-generated software out of the base system and main package repository. It ships apk-tools, busybox, and a more GNU-oriented toolset, uses s6 init with OpenRC planned, and is a work in progress with no installer yet. Expect spotty hardware support inherited from NetBSD.

Apple was notified of the eMudhra certificate compromise on October 17, but git, curl, and python3 shipped with macOS still trust the affected roots as of October 28. macOS 27.2, released October 26, didn't fix it and even reverted users' manual workarounds. Anyone on the network path can intercept HTTPS clones, pushes, and GitHub tokens. Dozens of volunteer-run projects patched days ago; Safari is already protected.

Surge AI's DAYJOB: Tax benchmark puts AI agents through 50 realistic tax assignments across eight practice areas, complete with messy client files, handwritten receipts, and conflicting records. Claude Sonnet 5.5 leads at a 10.8% pass rate, but even top models miss consequential issues—like a deadline that could cost a homeowner a $250,000 tax break, or an unverified marital status that changes retirement account division. The benchmark tests professional judgment, not just calculation.

Spider silk is tougher than Kevlar and stronger than steel, yet scientists have struggled to replicate it because no one knew exactly how a liquid blend of proteins, water, and salt turns into solid thread. By feeding black widow spiders isotope-labeled amino acids and studying their silk glands with NMR spectroscopy and AlphaFold, researchers led by Gregory Holland at San Diego State University captured an atomic-level view of the process: phosphate triggers weak interactions between arginine and tyrosine side groups, which act as molecular stickers that draw disordered proteins into gel-like condensates and then into fiber. The work suggests condensates are a widespread biological strategy for building rugged materials.

Cartesia scales its hierarchical networks (H-Nets), which replace hand-designed tokenizers with learned, end-to-end chunking of raw bytes. A controlled scaling ladder shows a one-stage H-Net gains 3-5x compute efficiency purely from learned tokenization, while a larger two-stage H-Net beats a matched open-source model using 10x less compute and data. H-Nets also show in-context tokenization and promise across biology and vision.

Cursor released the Agent SDK, the framework it uses to build its own managed agents like Bugbot, Security Reviewer, and Rollouts. Agents are defined as code: prompts in Markdown, tools as TypeScript functions, all version-controlled and reviewed like any project. A single `agent-sdk deploy` command ships them to Cursor's infrastructure, or they can run as a Node process in a container. Built-in evals and event replay let teams iterate quickly; one Cursor team built a knowledge-base reviewer in about a day.