Jump within the current audio brief. Story thumbnails mirror the cards below when available.
Same-day briefs for Tue Sep 22, sorted by release time. The selected date stays fixed.
Changing the date preserves the current brief type: HN Briefing PM.
HN Briefing PM
/hn-briefing-pm/2026-09-22/.Story cards stay below the sticky dock while audio, chapters, date, and brief navigation remain accessible.
Anthropic launched Claude Opus 5.5 today, claiming Fable 5.1-level performance at 40% lower cost than Opus 5. It posts 66.4% on Terminal-Bench 4.0 against GPT-6 Astra's 57.9%, and 81.8% on OSWorld 2.0 computer-use tasks — with one demo handling a 680,000-line code migration in under a day. Input drops to $4 per million tokens, output $20, cache reads down 60% to $0.20, available across AWS, Google Cloud, and Azure.
OpenAI shipped two cheaper GPT-6 tiers the same day as Anthropic's Opus release — Sol for everyday reasoning work, Luna for high-volume speed. Sol lands at $2/$10 per million input/output tokens, half of GPT-5.6 Sol, while Luna comes in at $0.10/$0.50. OpenAI claims Sol makes roughly half as many mistakes as its predecessor, and Luna is already live for Free and Go users in the desktop app.
Researcher Carter Leffer pointed GPT-6 Astra at the pile of unbroken WWII Enigma intercepts and it cracked message MVUEH, unsolved for 21 years. Astra picked its own target, noticed MVUEH was related to an already-solved neighbor, used the repeated place name "Rosenow Rosenow" as a crib, then wrote its own Python and C++ Enigma simulators to brute-force the rotor settings. The plaintext: a request for march-route orders. HN is arguing hard over whether that's real cryptanalysis or just code generation plus compute.
Artificial Analysis independently benchmarked Opus 5.5 and ranked it first out of 212 models with an Intelligence Index score of 58, against a median of 25. It tops the AA-Briefcase agentic leaderboard at 1821.85 Elo. The catch: it's #87 on cost-efficiency at $5.98 per index task, burning 260 million output tokens during evaluation versus a median of 88 million.
CVE-2026-87902 is a CVSS 9.2 critical in WordPress core, spanning 4.7.0 through 7.1.1 — 23 release branches. An unauthenticated attacker can abuse `get_page_template()` to pull in readable PHP files outside the theme directory, escalating to RCE when `pearcmd.php` is present with `register_argc_argv` on. Themes with a directory starting with "page-" are the trigger: Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney. Patch to 7.1.2 or the backport for your branch.
ShinyHunters claims it breached FBIjobs.gov and related services via an Oracle PeopleSoft zero-day, exfiltrating two to three terabytes covering every FBI employee and applicant. The data reportedly includes names, home addresses, phone numbers, birth dates, and spousal details; the group handed 404 Media a 5,000-record sample for verification. They say they're not after money — they want the FBI to retract prior allegations within a week, which they're calling coercion rather than extortion.
Trail of Bits argues SAML's problems are architectural, not implementational — XML complexity inviting XXE and entity expansion, canonicalization so hard it produced the 2018 comment-bypass bug, and enveloped signatures that sit inside the thing they're signing. They note real deployments use about 10% of a spec that absorbed four competing XML security standards. The recommendation is blunt: move to OIDC.
GeaStack Examples is an app gallery for a framework that compiles TypeScript and TSX with CSS styling down to native targets. The same codebase runs on web, ESP32 embedded boards, GeaOS, and Apple platforms, with each app declaring a manifest in its package.json. Apps are MIT licensed; the embedded board support is GPL-3.0 with a commercial option.
FoxDev Studio opens existing Visual FoxPro 9 projects, forms, tables, and databases as-is, no rewrite required. Under the hood it's a 64-bit runtime that kills the 2GB table ceiling, a WebAssembly VM running compiled bytecode on fibers, a React-rendered live object tree for the UI, and a 32-bit bridge process for legacy .fll libraries. The FoxScript language adds lambdas and an HTTP server. It's an independent open-source community project.
Solar Aquagrid's Project Nexus in Turlock tested three panel designs over working canals, and UC Merced's Roger Bales estimates 100 miles of narrow canal cover saves water for 2,700 households annually — 11,000 on wide canals. Power output runs 330 to 1,400 megawatts per hundred miles. Bonus findings: shading suppressed algae and cut maintenance, and permitting developed land takes 110 days versus 621 for undeveloped.
