Sponsored
Buildkite, the pro-tool that hands you building blocks for CI orchestration and then gets out of the way.
Enough with constant downtime. No more band-aids or burden.
We provide programmable primitives you co-ordinate, running only what changes, across any cloud, any chip, your secrets, your infra.
Control without compromise. Build faster, more securely, more reliably, with the CI engineered for frontier scale, used by the teams setting the pace.
Kubernetes v1.37 makes horizontal pod autoscaling to zero replicas a Beta feature, enabled by default. A HorizontalPodAutoscaler can now scale a workload all the way down to zero pods and bring it back up based on object or external metrics, without requiring an add-on or Alpha feature gate as previous versions did. The feature works for queue consumers and batch processors but requires at least one object or external metric, since CPU and memory metrics disappear once no pods are running. The first Alpha version shipped in Kubernetes v1.16, and SIG Autoscaling plans to collect operational feedback before considering a GA graduation.
An unauthorized BGP announcement diverted traffic for a Softaculous-owned /24 for roughly 33 hours, allowing the attacker to intercept requests and obtain valid Let's Encrypt certificates because ACME validation traffic was hijacked too. A small number of Virtualizor systems later downloaded a malicious update package, showing how routing attacks can cascade into software supply-chain compromise.
Managed PostgreSQL services reduce the operational tax of self-hosting by transferring infrastructure, patching, backups, high availability, and platform security responsibilities to the provider. Self-managed PostgreSQL remains preferable when organizations need deep control, specialized configurations, unsupported extensions, or have mature platform engineering and operational capabilities.
KubeVirtBMC can be paired with Metal3, a CNCF incubating project, to provision KubeVirt virtual machines as if they were physical bare-metal servers. Metal3 uses OpenStack Ironic under the hood to handle hardware inspection, boot device control, and OS image writing via standard IPMI or Redfish interfaces. KubeVirtBMC creates virtual BMC endpoints for KubeVirt VMs, so Metal3 has no way to distinguish them from real hardware. This post walks through a full end-to-end setup that configures Redfish virtual media boot without PXE or DHCP and provisions a VM with a live ISO image.
A Kubernetes engineer describes how to move a service out of the default namespace without downtime, using an ExternalName service as a DNS-level forwarding address. The approach lets dozens of dependent services keep calling the old cluster-internal DNS name while traffic silently routes to the new deployment, with no code changes required from other teams. A temporary policy exception handled the ingress side, allowing both the old and new ingress rules to coexist briefly while traffic was confirmed on the new deployment before the old one was removed.
Magnitude is an open source inference server that runs AI models locally on your own hardware, with no internet connection required after setup. It profiles your machine, recommends models that fit your available memory, then downloads and runs them. The tool works with Pi, OpenCode, Hermes, OpenClaw, Codex, Claude Code, Oh My Pi, and Cline, and also supports custom GGUF models from Hugging Face.
Semantica is an open-source context and knowledge-graph layer for AI systems that turns enterprise data, agent decisions, and provenance into a structured, queryable graph. It supports deterministic reasoning with Datalog, SPARQL, Rete, and forward chaining, plus W3C PROV-O audit trails, SHACL/OWL ontology governance, conflict detection, and integrations with graph stores, vector databases, Databricks, Snowflake, LangChain, CrewAI, MCP, and other agent frameworks.
Agent optimization reduces AI costs by optimizing model selection, deployment, caching, prompts, agent configurations, and observability at runtime. Microsoft Foundry combines these capabilities into a continuous optimization loop that measures cost per successful outcome while maintaining quality, latency, and reliability.
Cloudflare has prototyped a system called Cache Transcoding that compresses eligible cached assets using the Zstandard algorithm before writing them to disk, shrinking those assets to roughly one-third of their original size on average. The system targets compressible text content like HTML, JSON, CSS, and JavaScript, which made up 67.3% of requests in Cloudflare's traffic sample but arrived uncompressed about 71% of the time. Encoding happens once when an asset enters the cache, while the CPU cost of decoding is paid on every serve at approximately 1.56 nanoseconds per byte. In testing across 10 cache servers with more than a million requests, the architecture stayed within its CPU budget at zstd level 3 with a 4 kibibyte minimum object size.
Go's newer map implementation uses a Swiss Table design that groups entries in small blocks with compact control bytes, allowing many candidate slots to be checked before doing full key comparisons. SIMD can compare multiple control bytes at once on supported CPUs, while the layout and growth strategy improve cache locality and lookup performance.
Cloud-native environments make periodic GRC checks obsolete because infrastructure and configurations change continuously.
HCP Vault Dedicated audit logs can reach Microsoft Sentinel through a Terraform-provisioned Azure pipeline using a generic HTTP sink, Azure Functions or Logic Apps, and Azure Monitor Logs Ingestion.
Sponsored
8 million tech professionals read TLDR to stay on top of the news, ideas, and tools shaping their work. Put your brand in front of them. Become a TLDR sponsor [4].
Venture capital in the US skews towards scaling over profitability, with significant implications for startups. Founders face a choice: build a smaller, profitable business or pursue rapid revenue growth, often giving up control and delaying profit. Market dynamics, industry structure, and access to capital heavily influence these critical decisions, leading to diverse outcomes from successful scale-ups like Google to flawed models like WeWork.
2026.09.04·aswathdamodaran.substack.com·33 min read·TLDR Founders 74% of 150 enterprise IT professionals in a survey plan to expand their AI budgets in the next 12 months, and the rest plan to hold spending steady. However, these same enterprises say that fewer than half of their AI pilots ever make it into full production. Even when an enterprise does roll out the AI tech, it doesn't commit to it long term. Enterprise revenue remains insecure, even after a startup's AI product graduates out of a pilot phase and gets adopted by a company.
Forward-deployed engineering can teach you which workflows to own, how to institutionalize them, how to price the value you create, and give you the customer perspective and language to understand how to sell and market. Companies that use FDE as a crutch risk becoming consulting firms. Using FDE with reckless abandon may result in a sprawling roadmap and an incoherent product without compounding value. The best Vertical AI founders use FDE to parse granular customer operations, iterate to a generalizable product, and unearth the action layer of an industry.
Warm investor introductions work best when founders first create value and credibility around a fund's thesis. Portfolio founders, useful content, helping portfolio companies, and advice relationships can turn outreach into trust before any fundraising ask.
A founder who took GojiberryAI from nothing to about $3.5M ARR in twelve months, and got into YC, wrote up what he would do from zero. His answer is that reply rates come down to who you send to. He sold with a six-slide deck and made his first $10K before writing code. His customer was painfully specific: founders at 20-person SaaS companies about to hire a first sales rep. Outbound went only to people showing intent, and he puts the reply rate at 25-40% against the usual 1-2%. One channel at a time, priced at $99 a month.
Agents need identities and credentials. This usually means handing them a long-lived API key or letting them borrow a user's session. Agent Auth gives agents real identities in AuthKit. Users define blueprints for what an agent is allowed to do, and the agent gets short-lived, tightly scoped tokens every time it runs.
Google has added three new voice-activated features to its Google Workspace products. Users can now speak naturally to draft documents, locate important information from their inbox, and capture fleeting thoughts quickly. The new features are rolling out this week. They will be available in Gmail and Keep for Google AI Plus, Pro, and Ultra subscribers, and in Docs for Pro and Ultra subscribers. They are also coming soon for Google Workspace business customers.
AI productivity may raise quality rather than reduce human effort. In one writing workflow, editing volume stayed constant while AI lifted the quality floor, suggesting automation lets knowledge workers concentrate on craft and produce better work with the same effort.
Series A rounds are growing larger, with median sizes quadrupling over the last decade, pushing many funds out and refocusing investments into pre-seed and seed stages. The market now features fewer Series A investors, leading to less liquidity and an emphasis on companies with extreme growth or ambitious narratives. Small funds struggle as they must adapt to these expectations while focusing on higher concentration strategies and potential exits in the changing landscape.
Prepare for Silicon Valley fundraising by adjusting to its faster pace and intense urgency. Seek feedback from current, local founders or spend 2-3 weeks in San Francisco for real-time insights. This approach helps bridge the velocity gap between Silicon Valley and other regions.
AI tools are masking critical growth issues in startups by making operational workarounds too easy, preventing necessary organizational changes for scaling.
65% of startup failures result from co-founder conflicts, making solo founding an attractive alternative despite its own challenge of isolation.
Doug Leone, after 26 successful years at Sequoia, says he will consider retiring if he feels irrelevant in nine months.
People love to say build something people want, but a seed fund estimates that about 5% of its early-stage portfolio has a demand problem, while the other 95% have a customer-acquisition problem.
2026.09.04·thefounderplaybook.hustlefund.vc·4 min read·TLDR Founders Uber began deploying Wayve-powered autonomous vehicles across London on Thursday, marking Wayve's first commercial public service anywhere in the world and making London only the second European city with robotaxis, after Zagreb. The initial fleet, fewer than 20 Ford Mustang Mach-Es with plans to add Nissan Leafs later, keeps a licensed safety operator behind the wheel for now, and riders booking UberX, Comfort, or Electric may get matched with one at no extra cost.
Figure signed a deal with Nscale to deploy up to 100,000 Nvidia Vera Rubin GPUs, starting in Barstow, Texas, in the second half of 2027, an initial $3.5 billion compute commitment with intent to scale past $6 billion, with Nscale also making a strategic investment in Figure. It follows last week's launch of Index, Figure's crowdsourced humanoid training dataset now generating 35 minutes of data every second, addressing the other half of the bottleneck: Figure says it's now largely constrained by data and compute rather than robot hardware itself in training its Helix model.
Micron is reportedly investigating near-GPU NAND, high-endurance flash modules placed right on the GPU package where HBM sits today, aiming to fill the massive latency and bandwidth gap between HBM and a system's SSD. The pitch is memory-bound inference: large models buy extra accelerators purely to hold weights and KV cache, an expensive way to add capacity since HBM is the priciest, tightest-supplied memory around, so a cheaper flash tier fast enough to keep compute fed could let the same model run on fewer GPUs.
Nvidia's RTX Spark superchip fuses a 20-core Grace Arm CPU with a Blackwell RTX GPU on one 3nm package, delivering up to 1 petaflop of AI performance and 128GB of unified LPDDR5X memory, enough to run 120-billion-parameter models locally with up to a 1-million-token context window. It's Nvidia's first true client SoC for Windows, pairing native CUDA support with full RTX graphics tech, so the same chip targets AI development, creative work, and gaming. Jensen Huang promises at least 100fps at 1440p in modern AAA titles.
Bimo is an open-source, 3D-printable bipedal robot kit built with custom quasi-direct drive actuators, ROS 2 integration, and simulation-ready environments for reinforcement learning locomotion policies. The repository provides complete mechanical models, electronics schematics, and training pipelines to enable reliable sim-to-real transfer on a desktop-sized robot. It offers an accessible, affordable testbed for experimenting with legged locomotion dynamics, custom motor control schemes, and modern reinforcement learning algorithms without requiring high-cost industrial hardware.
Arduino trained a generation of young engineers, and now, post-Qualcomm acquisition, they are professionalizing the framework. The recent Arduino Core on Zephyr 1.0.0 release bridges the familiar, beginner-friendly Arduino API with the industrial-grade Zephyr Real-Time Operating System. This integration allows developers to leverage enterprise capabilities like preemptive multi-threading, advanced power management, and standardized networking stacks while writing standard Arduino code.
As multi-agent AI workflows spawn dozens of independent model calls from a single task, all competing for one local GPU's execution queue, Nvidia's new open-source PAIR router spreads those calls across every eligible RTX GPU, RTX PRO workstation, DGX Spark, or Apple M4+ device already sitting on a home network. It doesn't split one inference request across multiple GPUs or pool VRAM into a bigger virtual accelerator - each request still runs whole on one node, but it proxies existing Ollama and LM Studio interfaces so agents keep using the connection they already expect while PAIR handles discovery (via mDNS), MTLS-secured pairing, and live scheduling based on which paired node is actually ready.
Dyson's CameraJet packs a 100,000-pixel macro lens camera into the brush head, running its "Gap Optical Targeting" machine learning system to detect and predict gaps between teeth in real time, triggering a jet of water within 100 milliseconds of spotting one.
TSMC Senior VP Jeffrey Hou revealed at SEMICON Taiwan 2026 that AI-driven demand has pushed the company's equipment purchase forecasts to nearly double what they were just six months earlier, as it simultaneously builds roughly 13 fabs in Taiwan and 5-6 overseas, 4-5 times its historical pace.
AGS-PlantSeg is an open-access 3D point cloud dataset and benchmark designed for semantic segmentation in complex agricultural environments across varying plant growth scales.
HTC's Vive Eagle glasses go on sale in the US, Europe, and Australia at $499 (or $599 with photochromic lenses).
Broadcom guided to $34.8 billion in fourth-quarter revenue, below the $35.1 billion analysts expected and well under some estimates that topped $36 billion, sending shares down about 4% after hours.
Two intrusion clusters targeting Latin American critical infrastructure accidentally exposed their operations by leaving a self-hosted NextChat instance open to the public on TCP 3000. The exposed prompt history and staging scripts revealed a heavy reliance on AI tools to rapidly iterate through failed SAM and NTDS.dit credential dumps using volume shadow copy workarounds. To detect this infrastructure, defenders should actively hunt for the m-doxa on duckdns[.]org subdomains and monitor for multi-SAN Let's Encrypt certificates rotated between February and June.
2026.09.04·unit42.paloaltonetworks.com·8 min read·TLDR InfoSec Manifold Security found eight flaws in seven coding agents. A received repository can use .git/config to trigger commands through core.fsmonitor, and the commands run with the developer's account permissions, outside sandbox controls and without approval. Fixes exist for goose, Codex, and one Claude Code path. Hermes Agent, Qwen Code, Grok Build, and another Claude Code path remained exposed.
An attacker added unauthorized IPs to Coder's Cloudflare pool for registry.coder.com and served credential-stealing Terraform modules between 07:35 and 21:45 UTC on August 31, exfiltrating cloud, CI/CD, OIDC, and SSH secrets to coder-infra[.]com. Patched releases are 2.37.0, 2.36.4, 2.35.7, and 2.34.9.
Modified ScreenConnect clients recovered by Huntress watch the EndPointStatusMessage.Connections collection for newly observed Host sessions, then register 1.vbs through 4.vbs with ScreenConnect's virtual file-transfer system and queue them with the action set to Run, so merely connecting to an infected client can hand the Host the same four-stage VBScript chain. The loader profiles first: 1.vbs writes a three-bit state to %TEMP%\value.txt covering existing ScreenConnect installs, whether Defender is the only endpoint protection present, and whether RAM exceeds 5GB, and that value selects a user-level backdoor, an access package with a ComputerDefaults.exe UAC bypass and AMSI tampering, or a combo branch carrying wstunnel disguised as Themes.exe and XMRig renamed SearchIndex.exe. Defenders should treat RunFiles or RanFiles entries in ScreenConnect server audit logs showing those scripts executed from Process: Guest as indicators of compromise, check for the WindowsServiceHost Run key pointing at WindowsServiceHost.vbs in AppData, and note that Huntress recommends reimaging affected hosts rather than cleaning them.
Kev Breen used Claude Code against a patched PaperCut NG zero-day, spotting SQL injection IoCs in error logs and finding the patch blocked CALL/EXEC/SYSCS_ calls in the SQL lookup template. Claude decompiled the JARs, found an auth-bypass filter flaw using a matrix parameter, then a second bypass in pageValidate letting an unauth service parameter reach admin pages. Chaining both gave unauthenticated RCE via arbitrary file write as the papercut user, confirmed with a working Python PoC. A guardrail swapped the model mid-session when it probed exploitation logs. Breen later found a third bypass defeating the emergency patch and reported it to security@papercut.com, who said they were already aware.
Despite recent takedown efforts by Google and the FBI, the ChenLun Outsider Phishing-as-a-Service platform has proven highly resilient, with over 700 new phishing pages deployed in a single month. The platform operates a sophisticated kill chain that utilizes WebSockets to stream victim keystrokes in real time while allowing affiliates to manually push contextual 2FA prompts on demand. Defenders can hunt for this infrastructure across all known templates by looking for the unique GetSyncSetting configuration file and an alphabetical page prefix convention that maps directly to the victim exploitation stage.
AIR Security launched a firewall that inventories and evaluates skills, plugins, MCP servers, and add-ons. It detects malicious instructions, hidden behavior, excessive permissions, typo-squatted packages, and risky updates, then revokes access across dependent workflows.
The open-source safety and control layer for personal AI agents: Engine, Desktop, Mobile, proxy, and shared contracts. Leash sits between your AI agents and the actions they take. Safe work keeps moving. Sensitive work becomes a clear decision you can understand and control.
AWSHound is a self-hosted open-source collector that maps AWS environments into BloodHound OpenGraph datasets to visualize attack paths. Unlike existing mapping tools, AWSHound performs strict offline IAM evaluations by intersecting identity policies with permissions boundaries and SCPs to ensure relationships are only drawn where effective permissions resolve to an explicit allow. Operating securely through standard AWS SDK credential chains, the tool demonstrated massive scalability during internal testing by mapping a 500-account organization into 10.5 million edges in approximately 15 minutes.