Anthropic says its Claude Mythos Preview model found a mathematical weakness in HAWK, a NIST post-quantum candidate, and sped up an attack against reduced-round AES-128. A cryptographer from NIST's own process confirmed the math within the hour — but nobody outside Anthropic has independently verified the full attack yet.
CVE-2026-42945 is a critical heap overflow in NGINX — CVSS 9.8, zero credentials required, 18 years undetected — affecting roughly 34% of all websites globally. F5 patched fast; the real challenge is remediation sprawl across fragmented Docker images, Kubernetes ingress controllers, and managed CDN configurations.
TeamPCP compromised Trivy's npm package to inject CanisterWorm, a self-spreading worm that infected 66+ npm packages in 21 days by stealing publish tokens. Its C2 runs over Ethereum's blockchain and its second-stage payload includes a Kubernetes wiper with automatic activation on Iranian infrastructure.
An unauthenticated RCE in Cisco Firepower Management Center was actively exploited by the Interlock group for 36 days before Cisco released a patch. Over 4,200 instances were exposed to the internet with no official mitigation available during that window.
Google Stitch launched from Google Labs with native Galileo AI and a free tier. Figma lost 8.8% on announcement day and is down 35% in 2026. Here's what this means for enterprise teams locked into $13,200/year Figma Organization plans.
On March 19, OpenAI announced the acquisition of Astral Software Inc. Everyone's discussing uv and Ruff. Nobody's discussing pyx — Astral's only monetizable product — and that silence is exactly what deserves analysis.
