Anthropic's Catastrophic Risk Report & Safari Gets `using` Keyword & SAP Commerce Cloud Zero-Day Exploited

AI & ML

• Anthropic releases August 2026 catastrophic risk report — Evaluates AI systems across threat models including CB-1/CB-2 capabilities, catastrophic biosecurity risks, and research acceleration dynamics. Report notes AI models lack research taste for hypothesis generation despite PhD-level comprehension; physical data acquisition remains a major bottleneck. Highlights AI's impact on military R&D (coding agents enabling 5–10× team compression) while assessing mitigation posture against frontier capability risks. Read more

Frameworks & Libraries

• Kotlin ecosystem experiments with Compose HTML server-side rendering — JetBrains blog explores bringing Compose HTML to server-side contexts via JVM target, solving the current JS-only limitation for web development. Framework maintainers from Kobweb, Kilua, and Summon are engaged; Spring team expressed interest in supporting SSR once JVM target lands. Enables type-safe, reactive HTML generation server-side with same component model as browser-side Kotlin UI. Read more

Browser & Web Platform

• Safari ships using keyword, closing cross-browser gap — WebKit STP 250 adds JavaScript explicit resource management support, making Safari the last major browser to implement the feature. Also ships SVG clipboard API support (read/write via image/svg+xml MIME type with auto-sanitization), streaming upload in fetch() with duplex: "half" option, and five new CSS text decoration properties. Read more
• CSS Custom Highlight API now cross-browser supported — All major browsers now support the Custom Highlight API for styling arbitrary text ranges via ::highlight() pseudo-element. Driven by JavaScript (despite CSS naming), enables design tools and text-heavy apps to highlight content without DOM changes. Read more

DevOps & Cloud

• AWS RDS for Oracle supports APEX 26.1 — Amazon RDS now supports Oracle Application Express (APEX) version 26.1, Oracle's low-code platform for building enterprise applications. Available in all regions where RDS for Oracle operates. Simplifies setup and management of APEX options for cloud-hosted Oracle instances. Read more
• AWS Billing and Cost Management adds managed dashboards — Five preconfigured, read-only dashboards auto-populate with account data: Cost Overview & Trends, Compute, Database, Reservations, and Savings Plans. FinOps teams get instant visibility into spend patterns, forecasting, and commitment utilization without manual widget configuration. Read more
• Cloudflare detects and controls MCP traffic, adds pre-registered OAuth support — New Cloudflare One capabilities identify Model Context Protocol traffic, track which users/servers generate it, and control connections on managed paths. MCP Portals now support pre-registered OAuth clients, allowing admins to configure static credentials instead of dynamic registration (which MCP deprecated). Agents can now use approved tool-access paths or be detected bypassing them. Read more

Security

• Microsoft August Patch Tuesday fixes 400 flaws, 3 zero-days — 42 of 398 patches earn critical rating; sole known in-the-wild zero-day is CVE-2026-68820 (privilege escalation in afd.sys, the Windows socket driver). Two other zero-days include CVE-2026-62832 (Windows User Profile Service privilege escalation, likely exploited) and CVE-2026-72971 (low-impact local tampering, unlikely exploited). Microsoft attributes surge to AI-aided vulnerability discovery. Read more
• SAP Commerce Cloud RCE actively exploited 3 days post-patch — CVE-2026-58231 (CVSS 10.0, improper authorization in Data Hub Adapter) now hits honeypots despite no public PoC or pre-patch disclosure. Unauthenticated attackers exploit default auth clients and missing input validation to execute arbitrary code. Shadowserver tracks 4,200+ exposed Commerce Cloud instances; Clop gang claims data theft from Shell, GE, and Philips via same flaw. Read more
• macOS Screen Sharing vulnerability actively exploited to deploy Monero miner — CVE-2026-65400 (fixed in macOS Tahoe 26.6.1) allows unauthenticated remote attackers on exposed port 5900 to gain root access via VNC. Dutch NCSC reports multiple systems compromised with root access and crypto miners deployed. Attackers can open apps, access files, change security settings remotely. Read more
• Dell Wyse Management Suite authentication bypass — CVE-2026-66272 (versions before 2605.0.2) allows unauthenticated remote information disclosure via missing authentication for critical functions. CVSS 4.3, CWE-200. Read more
• Grav API plugin scope-cap bypass grants super-admin access — CVE-2026-72829 (CVSS 9.8 critical) in grav-plugin-api before 1.0.13: api.users.write-scoped keys can bypass scope caps, grant access.api.super, and mint or promote full super accounts via UsersController create/update methods. Read more
• Netis router firmware unauthenticated firmware update — CVE-2026-73673 (CVSS 9.0) in Netis NC63 V3.0.0.3327: missing auth enforcement in Boa web server + netis.cgi allows unsigned firmware upload via multipart POST to /cgi-bin/upload_fw.cgi without valid session cookie. Read more

Open Source

• GitHub releases official MCP Server — github-mcp-server (Go, MIT) is GitHub's native Model Context Protocol server (4.8k stars, 32k forks). Enables agents to discover and invoke tools backed by GitHub APIs and workflows. Read more
• OpenScience: open-source AI workbench for research — Browser-based workspace with file tree, editor, terminal, session history, and inline rendering for molecules/genomes/plots. Extensible via LSP, MCP servers, plugins, and TypeScript SDK. Goal-driven agent reads literature, writes/runs code, runs experiments, writes findings. Read more
• OBS Studio 30.2 release fixes OAuth corruption and group bugs — Fixed OAuth and dock state save corruption, group bounds not resizing, canvas mixes not restoring after video reset, display capture black frames, virtual camera reset failures, and erroneous crashes. Read more