tl;dr: The new MCP 2.0 spec (2026-07-28) replaces stateful session-based requests with a single stateless HTTP call, dramatically simplifying client and server implementations and eliminating session-routing headaches. Simon Willison built three projects on it this week: mcp-explorer (a CLI for probing MCP servers), datasette-mcp (a Datasette plugin exposing SQL tools), and llm-mcp-client (an LLM plugin). He argues MCP is making a comeback because it's safer and easier to audit than giving agents arbitrary shell/curl access, especially for avoiding lethal trifecta-style exfiltration attacks.

tl;dr: Pi is a minimalist coding harness with only 4 tools and a sub-1,000-token system prompt, betting that lean context beats bloated orchestration. In Databricks' benchmarks, Pi paired with Opus 4.8 achieved the highest pass-rate at significantly lower cost than Claude Code and Codex, sending ~3x less context per turn. Its extensibility—demonstrated by Shopify building pi-autoresearch as a Pi extension—lets users add complexity only when needed, making it especially suited for local models with smaller context windows.

tl;dr: Mistral released Shieldstral, a 3B Apache 2.0 multimodal safety classifier that accepts policies as plain-language yes/no questions at inference time, eliminating the need to retrain for new taxonomies. It outputs calibrated safety scores from yes/no token logits, handles text and images, and reportedly matches or beats guard models up to 7x its size. It runs on a single 16GB GPU and was trained by unifying heterogeneous datasets, using contrastive policy pairs to teach discrimination, and merging LoRA checkpoints via SLERP.

tl;dr: The author built a custom color space (TUV) for representing diverse skin tones by manually labeling RGB colors, applying principal component analysis to align the data along meaningful axes, then hand-fitting spherical equations in Desmos to map the resulting shape. The three PCA-derived axes conveniently correspond to deep/fair, flushed/ochre, and cool/warm, and a single radius parameter (R²) lets you tune variation for pickers or procedural generation. Includes Python/JS sample code, an interactive picker, and candid acknowledgment of the unscientific "guess and check" methodology.

tl;dr: Summary not available

tl;dr: Summary not available

tl;dr: INTERPOL's African Cyberthreat Assessment Report 2026 found that 55% of cybercrime cases across 36 African countries now involve AI, with financial losses jumping from $192M in 2024 to $484M. Criminals are leveraging deepfakes, AI-generated BEC emails, and synthetic identities to scale scams, sextortion, and fraud, while 72% of surveyed countries reported scam centers within their borders. Despite gaps in law enforcement readiness, 17 countries updated cybercrime laws in 2025 and joint operations led to 1,500+ arrests and $100M recovered.

tl;dr: The maintainer of libexpat (a widely-used C XML parser) has been hired by the City of Munich for up to 6 months under their Open Source Sabbatical program, marking the first time he can work on the project as a full-time job rather than a side effort. Priorities include fixing 5 known unpatched vulnerabilities, adding XML 1.0r5 support, and improving project robustness. He's inviting serious (non-AI-generated) vulnerability reports during this window.

tl;dr: Summary not available

tl;dr: Waymo has opened its fully autonomous ride-hailing service to the general public in Dallas, following a waitlist period that served nearly 150,000 riders since February. The company is also beginning autonomous testing on Dallas freeways and at Love Field Airport terminals, with plans to add those routes for public riders soon.

tl;dr: An extended Xbox outage that started Sunday evening prevented users from playing not just digital titles but disc-based games as well, since discs today merely grant a license and require installs, updates, and network authentication to function. The author argues this exposes how modern "physical" console media isn't truly ownership—unlike old cartridges that still work standalone—and cites it as a reason to prefer PC gaming, where preservation options are more robust.

tl;dr: Summary not available

tl;dr: Domain expertise dramatically improves LLM output quality: Terence Tao's ChatGPT conversation about the Jacobian Conjecture shows how an expert can steer the model into concise, technical mode, push back on wrong answers, and extract insights a novice couldn't. The key skill isn't prompt engineering tricks but actually understanding the subject well enough to identify weird outputs, suggest alternatives, and ask specific questions. This suggests humans remain the bottleneck for many tasks—the knowledge is already in the model, but it takes expertise to pull it out.

tl;dr: Apple is seeking a preliminary injunction against OpenAI in its trade secrets case, alleging that at least 11 additional former Apple employees beyond those originally named may have been involved in taking confidential information, including screenshots of unannounced product documents. Apple wants expedited discovery targeting OpenAI, Jony Ive's device startup io, and specific engineers. OpenAI dismissed the claims as based on "false information," saying it has no interest in Apple's trade secrets and pointing to Apple's own procedural missteps and poor security practices.

tl;dr: Summary not available

tl;dr: Security researcher Troy Hunt received a FedEx SMS requesting duty/tax payment that had every hallmark of a phishing scam: typos, urgency, weird casing, a non-FedEx payment domain, and a URL where you could freely tamper with the tracking number, name, and amount via query parameters. After extensive verification through FedEx's actual support channels, it turned out to be legitimate. The takeaway: while we train users to spot phishing red flags, legitimate companies like FedEx are undermining that effort by sending messages indistinguishable from scams.

tl;dr: A production configuration for running DeepSeek-V4-Flash (304B params) on a single AMD MI300X, fitting the full 156.67 GiB model in HBM without quantization or offload, achieving 168.6 tok/s single-stream decode and 830 tok/s aggregate across 64 streams. The repo provides Docker Compose stack, SHA-pinned overlays, and AITER GEMM tuning tables that fix MI300X-specific issues including FNUZ vs OCP FP8 format mismatches, MXFP4 routing bitmatrix padding bugs, causal speculative verification, and CPU-KV synchronization gaps not yet in upstream vLLM.

tl;dr: Adform, an ad network serving 1.5 billion daily ads, was compromised on July 27 when attackers injected malicious code into its ad delivery, replacing crypto wallet addresses in victims' clipboards every three seconds to redirect transfers to the attacker. The company disclosed the breach but hasn't revealed how it was compromised or how many users were affected, and is still investigating whether browsing data was exfiltrated. Ad blockers like uBlock Origin blocked Adform's domain entirely, preventing the malicious payload from loading.

tl;dr: Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account...

tl;dr: A Turkish developer recounts moving to Hamburg in 2017 for an internship, describing how the reality of German culture—trust, flat hierarchies, inclusion, and structured rules—contrasted sharply with the stereotypes he'd grown up hearing. Over eight years he integrated through work rather than deliberate effort, learned German after deciding to stay, and eventually obtained citizenship under the recently shortened five-year eligibility rule. He acknowledges his experience was privileged (English-speaking corporate environment, good salary) and not representative of most immigrants' harder landings.