Relevance 10/10Importance 9/10
Mistral dropped a one-trillion-parameter multimodal model under a modified-MIT "Ecosystem Open-Weight" license, claiming the best open-weight coding model crown and 51% on the Artificial Analysis Cyber Index for vulnerability detection and patching. It ships three reasoning modes (Low, Medium, High), 160-plus languages, and a claimed 97.1% resistance rate against agent security attacks. API pricing lands at $0.70 per million input tokens and $2.10 per million output.
Relevance 10/10Importance 9/10
Google's Gemini 4 Carbon takes the top slot with a score of 59, finishing first in four of the nine component evals, strongest on complex reasoning, knowledge, and science. It still trails Claude Opus 5.5 on coding — 59 versus 62 — but delivers comparable intelligence for roughly 23% less per task and burns far fewer output tokens, 123k against Opus 5.5's 173k. Hallucination rate came in at a relatively tidy 11%.
Relevance 8/10Importance 10/10
DoorDash is buying Instacart at $65.00 per share — about $17 billion in equity value, a 26% premium to Instacart's October 22 close before the deal leaked. Holders can elect all cash, 0.3372 DoorDash shares, or a mixed $48.75-plus-stock option, with total stock consideration capped at 25% of the aggregate. Instacart's board approved unanimously; close is penciled in for late 2027 or early 2028, with the Instacart brand, app, and enterprise products surviving.
Relevance 10/10Importance 7/10
Engineer Divyansh Agrawal compiled a working 32-bit RISC-V CPU directly into the weights of Qwen 3.5 4B, using the model's Gated DeltaNet attention layers as RAM. The result runs arithmetic, C, and MicroPython with no external runtime or tool calls, hitting 97 to 100% accuracy on arithmetic benchmarks while leaving normal language ability intact. It's a genuinely wild proof that deterministic computation can live inside the network itself.
Relevance 9/10Importance 8/10
A researcher dug into an obfuscated browser-fingerprinting script on servicepipe.tech and found function names like "computeRicinLethalDosageForWaterSupply" and "computeCRISPRGeneDrivePropagationRate" — none of which do anything. They exist purely to trip LLM safety filters and block AI-assisted deobfuscation, alongside an embedded "SYSTEM OVERRIDE" jailbreak prompt and Tiananmen references aimed at Chinese models. The operator traces back to servicepipe.ru, a Russian anti-DDoS outfit, making this a brand-new category of anti-LLM defensive obfuscation.
Relevance 4/10Importance 8/10
A chain of CVE-2026-109618 and 109619 against PHP's session upload mechanism, paired with kernel privesc CVE-2026-46300, rooted 25 servers including a US government-affiliated environment. The PHP side runs four stages — memory exhaustion, info leak, stale reference setup, then code execution via a forged destructor — landing unauthenticated RCE as an unprivileged user. The kernel bug then overwrites PAM auth files for credential-free root, and the operator automated it across 240 devices using version-specific memory profiles for nine firewall variants.
Relevance 3/10Importance 8/10
A single malformed WAP Push SMS crashes com.android.phone with zero victim interaction, dropping active calls — including emergency calls. The root cause is an unchecked cast in WapPushOverSms.java where an oversized header length goes negative as a signed int, throwing NegativeArraySizeException and killing the telephony process. Pixel 9 and multiple Samsung devices are affected, and Google classified it as a non-security issue and declined to ship the researcher's one-line fix.
Relevance 4/10Importance 5/10
Java's ahead-of-time cache records a training run so the JVM can skip initialization work on later launches, but the author hit wall after wall. Caches built on newer CPUs crash on older hardware, adapter caching needs undocumented workarounds, and class linking silently disables optimizations with no explanation. The verdict: cryptic logging, thin docs, and poor fit for distributed apps make it much harder to use than it should be.
Relevance 2/10Importance 3/10
This 2008 Google public policy post explains the "Primary Local Usage" policy: display the names that bordering sovereign nations actually use, and when they disagree, show both labels positioned nearer each country's territory. The Persian Gulf versus Arabian Gulf dispute was the trigger, resolved by showing both in English and each nation's preference in localized editions. Google explicitly rejected deferring to the UN or geographic societies as the arbiter.
Relevance 1/10Importance 4/10
A resurfaced 2014 Vox piece on the FBI's anonymous "suicide letter," mailed to Martin Luther King Jr. in November 1964 shortly after his Nobel Peace Prize, under Hoover's COINTELPRO program. The unredacted original was located in the National Archives by historian Beverly Gage, exposing in full the state surveillance apparatus turned against a civil rights leader. It's a perennial HN reminder of what unaccountable surveillance power does when it decides someone is a threat.
HN Briefing AM
