Search the archive

A FRAMEWORK FOR FINTECH IDEAS: TURN SOMETHING COMPLEX INTO AN API

The best way to find new fintech ideas is to ask how a complex product can become an API.

S&P GLOBAL LAUNCHES AAA-STYLE RISK SCORES FOR DEFI LENDING VAULTS

S&P Global Ratings launched a "Vault Risk Assessment" that grades on-chain lending vaults.

ETH STAKING HITS AN ALL-TIME HIGH OF 36% OF SUPPLY

36% of all ETH is now staked, up from 29% at the start of the year, with about 8.2 million ETH (around $22 billion) staked in 2026 alone.

OPENAI LAUNCHES VISUAL ADS THAT APPEAR ALONGSIDE IMAGE GENERATION RESULTS

OpenAI is adding visual display ads alongside images generated in ChatGPT, starting later this month in the US with a small group of advertisers. The ads will be clearly labeled and, according to OpenAI, will not influence ChatGPT's answers. The company is also expanding ad measurement partnerships and developing brand suitability evaluations as it builds an ad-supported business for users on free and low-cost plans.

JOHN TERNUS IS TAKING A MORE ‘HANDS-ON' ROLE IN APPLE'S DESIGN TEAMS AS CEO

Apple CEO John Ternus has reportedly become deeply involved with the company's industrial design and human interface teams, working in the design studio several times a week and sometimes visiting multiple times per day. Rather than appointing a new chief design officer, Apple has Molly Anderson leading industrial design and Steve Lemay leading human interface design, with Ternus acting as the overarching decision-maker. Apple is also rebuilding teams depleted by departures to companies including Meta and OpenAI through internal promotions and external hires.

THE BRISBANE 2032 OLYMPICS LOGO IS HIDING A TRIPLE DESIGN IN PLAIN SIGHT

The Brisbane 2032 Olympic emblem combines three ideas in a single vivid form: an Olympic flame, the crest of Australia's native cockatoo, and the shape of Queensland. Its pink-and-red form gives the identity an energetic, playful character intended to feel distinctly connected to the host region. The identity was accidentally revealed early through an explainer uploaded to Brisbane 2032's YouTube channel.

WHAT ARE THE PRINCIPLES OF PROTOTYPING?

A prototype is a way to learn something before making a bigger commitment, in any form, from an email or text message to an event. Nine principles, refined by 124 people at Services Week 2026, hold that a prototype answers a question, is tested with future users, and can be archived. The tools have changed, with AI-assisted ones now in the mix, but the purpose and principles of prototyping have not.

10 UNCOMFORTABLE UX LESSONS FROM REAL DESIGN MISTAKES

Ten uncomfortable lessons from real design mistakes offer a way to make better design choices before running more UX tests. Minimalism failed on an ERP shipment form, and a standard landing page beat an artistic, scroll-snapping one in an A/B test. Other lessons favor preventing errors over recovering from them, and giving users an opt-out instead of forcing AI into manual workflows.

TRAINING AI TO PAINT WITH CODE

A language model was trained with reinforcement learning to create watercolor images by writing editable p5.brush JavaScript rather than generating fixed image files, giving people direct control over the resulting artifact. Early training exposed problems with overly complex reward systems, while switching from absolute scores to pairwise comparisons against a hand-rated reference pool produced better images with dramatically shorter code. The experiment shows that applying reinforcement learning to creative work is fundamentally a design problem: subjective qualities like taste need carefully constructed reward structures that provide direction without forcing the model toward a single aesthetic.

INSPECT ANY PAGE WITH NO SITE ACCESS REQUESTED

A free, open-source browser extension that inspects layout, styles, color, type, and assets on any page.

TURNING PRODUCT MANAGERS AND PRODUCT DESIGNERS INTO PRODUCT BUILDERS

AutonomyAI lets PMs and designers create production code changes for engineering approval, so engineers stay focused on what only they can build.

RUNEICONS - BEAUTIFUL ICONS FOR YOUR NEXT PROJECT

Rune Icons is a free, open-source library of more than 900 hand-drawn icons available in outline, duotone, fill, pixel, and glass styles, with browser-based controls for editing paths, stroke, size, color, and motion before copying them as SVG or JSX.

WORKFLOW LAB: FROM DESIGN SYSTEM TO CAMPAIGN IN FIGMA WEAVE

A product designer at a fictional museum uses Figma Weave to turn the museum's design system into campaign collateral for a new exhibition. Image Describer nodes read existing designs and color families, and the Gen Effect node gives every image a shared look through color grading and hazy edges. The Figma node stays connected, so design-system updates flow downstream, and the node graph can be reused for future shows or published as a Weave tool.

DESIGN IS A NICE-TO-HAVE

Design feels like a nice-to-have again, according to a designer who now builds software himself and finds news about design craft and tools flat. Once programming became trivial, design lost the spotlight it briefly held when SaaS commoditized software and distribution was the hardest part. Craft still matters, but a "good enough" UX suffices, since usefulness to the market was always what mattered most.

BRAND IDENTITY: KOTO'S STACK OVERFLOW REBRAND

Koto has repositioned Stack Overflow as a source of human-validated knowledge in an AI-first world, consolidating its portfolio and building the identity around the concept “Always in Build.” A simplified stack-shaped logo expands into a generative visual language of geometry that continuously reformats and rebuilds, supported by an expanded orange-led palette and the custom Stack Sans typeface with distinctive notched letterforms. A custom generative tool lets Stack Overflow's team produce new compositions at scale, while the system stays restrained inside the product and becomes more expressive across campaigns and the Developer Survey.

SEVEN REASONS NON-ARTISTS NEED A DRAWING PAD ON THEIR DESK

Non-artists can put the handmade Japanese Drawing Pad to seven uses, from brain-dumping to-do lists and mind-mapping to journaling and doodling away stress.

TÉLIO PÉRON BLENDS PHOTOREAL DETAIL WITH SUPERNATURAL IMAGINATION TO CREATE 3D ENVIRONMENTS THAT NEVER FULLY EXPLAIN THEMSELVES

French 3D artist Télio Péron grounds slightly impossible elements, from glowing artifacts to folklore creatures, in photoreal forests, moss, and weathered wood.

Read the step-by-step tutorial.

BUILD AN AGENT LOOP A SMALL MODEL CAN FINISH

A reliable agent loop depends less on model size than on a trustworthy check that turns progress into a score or pass condition. In two visual tasks, small models improved dramatically when they received repeatable feedback across varied examples and holdout cases, while weak checks encouraged overfitting or shortcuts.

HOW WE BUILT THE FASTEST, CHEAPEST BROWSER AGENT WITH JEV

IronBee Express uses Jev as a fast classifier for bounded browser decisions, calling an LLM only for writing, recovery, or failure explanations. Explored runs cost about $0.0042 for 20 actions, recordings can replay with no step decisions, and narrow verification questions helped a 130-run replay test reach 130 correct outcomes.

CHAT IS AI'S COMMAND LINE

Chat is useful for rough direction, but it becomes awkward when people need to make precise edits or understand the state of ongoing work. The piece argues for AI interfaces built around direct manipulation, visible state, and reversible experimentation, much like spreadsheets and graphical desktops expanded computing beyond the command line.

EPHEMERAL TESTING

Ephemeral testing evaluates a software component by asking an AI agent to build disposable applications or layers on top of it, then judging how well those downstream projects work. Repeating the exercise with different agents and tasks can expose hidden state, unstable invariants, surprising defaults, and weak documentation.

because contract language is often inconsistent. This guide

explains how the Docusign Agreement Manager API and MCP Server use AI to surface relevant insights, and how to choose the right approach for

your task. Start building with a free developer account

TANSTACK CHARTS 1.0

TanStack Charts 1.0 offers a composable, type-safe charting system built from marks, scales, axes, and interactions instead of rigid chart types. It supports custom marks and renderers, optional SVG or Canvas output, modular animation and scale packages, and a stable API intended to evolve without forcing applications to rebuild their visualizations.

INTRODUCING BEAM: REFLECTION'S 501B OPEN-WEIGHT MODEL

Beam is a sparse Mixture-of-Experts model with 501 billion total parameters and 23 billion active parameters aimed at coding, reasoning, and agentic workloads. Reflection trained it on 23.8 trillion tokens and more than 100 million reinforcement learning rollouts, with Apache 2.0 weights and developer artifacts planned for release later this month.

HOW BOOKING.COM CUT NODE.JS COSTS BY 38% WITH WATT

Booking.com moved a major Node.js rendering service from pm2 clustering to Watt worker threads, cutting compute costs by 38% with 30% fewer pods, 20% less memory per pod, and up to 10% lower tail latency. The migration required no service code changes, and production tests showed 40% to 50% more throughput within the same latency target.

WORTH BUILDING

Cheaper software development makes small tools worthwhile even when they solve one person's annoyance and never become a business. As more people can ship, the story behind a project and the choices that shaped it become increasingly important reasons for others to care.

editor. Try the playground

INTRODUCING WEB SEARCH API

Cloudflare's beta Web Search API lets agents search through Ceramic.ai, Exa, or Linkup via AI Gateway with Zero Data Retention, gateway logging, and provider list pricing without added markup.

THE PERFORMANCE COST OF RWLOCK IN A READ-HEAVY WORKLOAD

A Rust benchmark found that replacing 16,384 per-item RwLock acquisitions with one Crossbeam epoch guard and atomic pointer loads raised read throughput from 15.93k to 229.07k operations per second, while a simple lock still worked well around an infrequently changed collection.

CSS DOES YOUR TOOLTIP POSITIONING NOW

CSS anchor positioning, position fallbacks, popovers, and anchor-size() can now handle responsive tooltip and dropdown placement with little or no JavaScript, though component-scoped anchor names and accessible DOM order still matter.

TWO ROOM-TEMPERATURE ANTIFERROMAGNETIC SEMICONDUCTOR CANDIDATES

AI agents identified two candidate room-temperature Luttinger-compensated semiconductors for spintronic memory, but one may be difficult to synthesize, and the other still needs direct measurement of its band gap and spin sorting.

appearing in your inventory

* Most organizations cannot say who approved an agent's decision, or who was responsible for the policy behind it

Download your report

BOUNCY CASTLE CVE-2026-71885 HARVESTED THE CREDENTIAL BINDING THAT AUTHENTICATES AGENT-TO-AGENT CHANNELS

A critical vulnerability in Bouncy Castle for Java versions before 1.86 lets attackers spoof legitimate participants and decrypt messages within Messaging Layer Security groups. Improper certificate validation in the protocol implementation lets threat actors bypass core security objectives by presenting arbitrary credentials. Developers must upgrade to version 1.86 to enforce cryptographic binding between end-entity certificates and LeafNode signature keys.

ROUNDCUBE WEBMAIL SQL INJECTION VULNERABILITY CVE-2026-48842 UNDER ACTIVE EXPLOITATION

Unauthenticated attackers are actively exploiting a pre-authentication SQL injection vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 to execute arbitrary database commands and access sensitive data. The flaw, tracked as CVE-2026-48842, resides in the built-in virtuser_query plugin. Administrators must immediately update to versions 1.6.16 or 1.7.1, or disable the vulnerable plugin.

NEW DELL SYSTEM UPDATE FLAW LETS HACKERS GAIN ROOT PRIVILEGES

A critical path traversal flaw in Dell System Update (CVE-2026-86360) allowed unauthenticated remote attackers to execute code as root on PowerEdge servers using the DSU deployment tool. Dell's advisory also addressed four other high-severity DSU vulnerabilities: two that enable remote code execution (CVE-2026-63697 and CVE-2026-71168) and two that enable privilege escalation (CVE-2026-86361 and CVE-2026-86362). None have been reported as exploited so far. Admins should upgrade to DSU 2.3.0.0 or later.

OPEN BUILD SERVICE, ONE YEAR LATER: COMMAND EXECUTION THROUGH MERCURIAL ARGUMENT INJECTION

Fenrisk found CVE-2026-56004 in Open Build Service's obs_scm Mercurial backend. An attacker-controlled _service revision beginning with --config could set a pre-update hook and run shell commands on the service server. A space in the value bypassed Python argparse handling of dash-prefixed arguments. Exploitation required Mercurial, a reachable HTTP(S) repository, and a successful clone. Fenrisk confirmed build.opensuse.org was vulnerable. openSUSE patched the flaw on July 2 by adding -- before the revision and recommending rejection of dash-prefixed revisions.

A PEEK INTO REDDIT'S ANTI-SPAM INTERNALS

A 2021 Reddit glitch exposed internal removal reasons in Relay notifications. Screenshots reveal domain blocks, account bans, shadowbans, Spamurai rules, and URL inspection. Spamurai logged account age, karma, reports, ISP, email domain, browser details, language headers, TLS fingerprints, and referrers. This reproduced a Perspective API score and showed that appending two letters changed a spam score from 86% to 1%. Reddit also followed redirected URLs, scanned page content, and matched a Google Analytics ID tied to a spam ring.

YOUR CAR IS A SMARTPHONE ON WHEELS. HERE'S WHO'S LISTENING

Northeastern researchers and Consumer Reports captured Wi-Fi traffic from 21 vehicles through a Raspberry Pi access point, decrypted 30 companion iOS apps with mitmproxy, and found that 19 vehicles contacted at least one third party, including ad and tracking domains. Seven apps sent VINs, emails, phone numbers, or precise location to trackers, and GM's four apps shared VINs with ten companies, including Meta, Google, and Acxiom. Pairing a companion app roughly doubled a vehicle's tracker exposure on average, and of 17 manufacturers contacted, most shifted responsibility to owners. One notable exception: Honda improved its data collection practices to avoid sending precise geolocation information to a third party involved in user tracking.

GUARDANA

Guardana is an open-source AI security verification tool for security and platform engineers. It checks code and model artifacts, live AI systems, and recorded runs. It reports what it found, what it could not verify, and what it could not check. It verifies outside the request path. Guardana is not an inline guardrail, a general SAST or CVE scanner, or a compliance certification.

DOXX.NET (PRODUCT LAUNCH)

doxx.net has launched ADN, a private network with peer-to-peer messaging, file transfers, custom domains, and DNS threat blocking. It blocks malicious destinations before connections and uses proof-of-work accounts without usernames, passwords, or personal data.

COI

Coi protects host credentials and files by isolating AI coding agents such as Claude Code or Codex inside Linux system containers during autonomous sessions. The open-source tool uses Incus, a lightweight LXD fork, to grant root access, systemd, and native Docker, alongside kernel-level threat detection that automatically pauses or kills compromised containers.

SENATE PASSES BIPARTISAN BILL TO STRENGTHEN HEALTHCARE CYBERSECURITY

The Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent. The bill moves to the House. It funds prevention, incident response, and security training. It directs HHS and CISA coordination, names ASPR as sector risk manager, and requires an HHS incident-response plan.

SHINYHUNTERS HACKER IN FBI DATA THEFT DETAINED IN JORDAN, COOPERATING WITH BUREAU, SOURCES SAY

Jordanian authorities detained alleged ShinyHunters member Saif al-Din Khader, known as Rey. Two sources said he is helping the FBI identify other members through his devices and correspondence with a sample of stolen FBI data containing employee identities, job details, and medical and psychiatric records. The group's dark-web site disappeared after another alleged member was detained in the Netherlands.