Relevance 10/10Importance 8/10
Signals Corps scanned HTTP response headers across 217 million pages — roughly 10% of Common Crawl's September 2026 crawl — hunting for text aimed at AI agents. They found about 7,959 sites talking to bots through headers, overwhelmingly benign pointers to llms.txt files and MCP servers, plus 139 detection headers and just 30 actual injection attempts. Claude models ignored the injections by default, but complied in 7 of 9 runs once a user prompt granted the server authority — the takeaway being pass only body content and enforce authorization outside the model.
Relevance 6/10Importance 10/10
Citizen Lab published the first public confirmation of mercenary spyware delivered through the real-time bidding ad ecosystem, a vector they're calling AdFection. Israeli firm Discover-Tech posed as a legitimate ad vendor while running targeting infrastructure that decides, mid-auction, whether your device gets malicious JavaScript — no click required. At least 45 devices inside Al Jazeera were infected with Candiru spyware, and four billion bidding records show the ads reaching roughly 200,000 apps and sites.
Relevance 6/10Importance 9/10
The Guardian's writeup of the same Citizen Lab findings, and the top-scoring story on the front page this morning at 294 points. It names Discover-Tech and walks through how its MyDSP buying platform and Controlium dashboard let operators pick individual targets out of the ad stream. Google, IAB Europe, Beeswax, Vungle and Eskim had all certified or served the firm's ads before cutting access post-disclosure.
Relevance 4/10Importance 7/10
JJ Maxwell, diagnosed with squamous cell carcinoma of the mouth in May 2026, wrote the operational guide he wishes he'd had — and HN pushed it to 1,704 points, the runaway discussion of the day. The advice is tactical: call back for cancellation slots, demand comprehensive genetic testing instead of waiting, read the NCCN guidelines yourself, get second opinions and independent pathology reviews early. Notably, he warns that AI models can minimize serious symptoms, even as he recommends using them to organize your records.
Relevance 4/10Importance 7/10
Libreboot's new release swaps U-Boot for EDK2 on x86, delivering full standards-compliant UEFI that can actually boot Windows alongside Linux and BSD. It also absorbs 233 Intel and AMD Chromebooks from the MrChromebox project, plus new boards including the Dell OptiPlex 5050, Supermicro X11SSH-F, and ThinkPad X280 and X270. The release also ships a strongly anti-AI policy in a new AGENTS.md file.
Relevance 5/10Importance 4/10
Unfenced cross-references about 695,000 active real estate listings against USGS PAD-US 4.1 boundary data to surface private parcels that actually touch national forest, wildlife areas, and game lands. It's turned up 13,626 verified properties across 49 regions, with acreage, price, shared boundary length, and the adjacent public land designation. Built by Philadelphia's Other Waters Studio, it's a passion project with a buy-me-a-coffee link rather than a funding round.
Relevance 3/10Importance 6/10
C++26 finally standardizes contracts, letting you declare what callers must provide with pre, what the function promises with post and a named result, and internal checks with contract_assert. Four evaluation semantics — ignore, observe, enforce, and quick-enforce — mean the same code can be strict in debug and silent in release. As of this month only GCC 16 implements it, behind the -fcontracts flag, and the author is emphatic that contracts are for documenting programmer assumptions, not for input validation.
Relevance 2/10Importance 6/10
The author just wanted to flip two sysfs toggles on a TP-Link EAP770 Wi-Fi 7 access point to stop data corruption caused by a DMA cache coherency bug in Qualcomm's qca-nss-dp driver — but TP-Link's SSH shell is unprivileged and the device is end-of-life with no updates. So they chained CVE-2022-0185, an integer underflow in legacy_parse_param, with user namespace unsharing and pipe buffer manipulation to overflow a 4 KiB slab object, leak kernel addresses, forge pipe ops, and overwrite modprobe_path for root. The reward: a permanently disabled offload, fixed reliability, and 8% slower downloads.
Relevance 3/10Importance 4/10
DEsk is a wlroots-based Wayland compositor that renders your desktop as a literal desk in a ray-traced 3D room — windows are sheets of paper, apps live in binders on a bookshelf, notifications land in a post box, and settings sit in a vintage control panel. It's written in C on wlroots 0.18 with OpenGL ES 3.0 GPU ray-tracing and a CPU fallback, wired into PipeWire, NetworkManager, and xdg-portal. Version 0.1.2 is the first public beta, MIT licensed, with a Fedora installer and an honest warning about rough edges.
Relevance 1/10Importance 2/10
The Sunnyvale, California Toys R Us at 130 East El Camino Real opened in 1970 on former Murphy family ranch land and became paranormal-TV famous via a 1980 segment on "That's Incredible," with staff reporting moving merchandise and a doll that only talked inside its box. Psychic Sylvia Browne pinned it on a ranch hand named John Johnson, supposedly killed by an axe while pining for Elizabeth Murphy. Researchers can't find Johnson in any census or newspaper record, and Browne's timeline collides with Murphy's actual 1863 marriage and 1875 death.
HN Briefing AM
