o0o0o0o / 006 6 Nov 2026
The battle for code
AI no longer just writes software. It finds vulnerabilities, develops patches and changes the infrastructure on which the next generation of applications is built.
Editorial
Last issue asked who controls AI. This one starts a step lower, where control is actually carried out: in the code.
In just six days OpenAI showed a system that produces 948 working exploits in a single pass through the Linux kernel, presented a Git backend built because the old one could no longer keep up with agents, and announced the purchase of a company that makes change review tools. Meta bought Conductor, GitHub is changing the default rules for Actions, Vercel is introducing an automatic security review of every push, and Anthropic has published a cryptographic proof that an answer really came from the declared model.
In this issue
Contents
- 04EditorialEverything after the code is expensiveWhy code is the theme of issue six.
- 05Cover storyThe battle for codeFive fronts around one question.
- 06Cover storyCode has become infrastructureWhy the bottleneck now comes after writing code.
- 07Cover storyControl has become the main costFive fronts and what each one costs.
- 08SecurityAI has entered a new phase of cybersecurityGPT-6 Cyber, Critical and restricted access.
- 09SecurityWhat the tests show, and what they do notExploitGym and staying in scope.
- 10Security948 paths to rootWhat a systematic vulnerability hunt looks like.
- 11SecurityFrom candidate to patchThe five stages and what each costs.
- 12SecurityWhat 948 does not meanThe difference between a finding and a fix.
- 13SecurityFirefox: 81 new vulnerabilitiesMozilla, reports and fix status.
- 14SecurityWho may hold the strongest modelLayers of access and protection.
- 15BuildCode is no longer the bottleneck. Infrastructure is.Four moves in one week.
- 16BuildGit built for agentsWhy OpenAI changed what sits behind Git.
- 17BuildThree decisions behind PandoCausal consistency and pack reuse.
- 18BuildOpenAI buys the code review layerThe announced purchase and the strategy.
- 19BuildConductor joins MetaDates and what to do.
- 20BuildFour layers, four kinds of productWhere each system sits.
- 21BuildCopilot in Xcode, BYOK and agent skillsThree changes for developers.
- 22BuildWho gets the message when a key leaksPartner secrets and user alerts.
- 23BuildEvery push goes through an AI reviewHow it works and what it does not do.
- 24BuildBetter Auth: 12 advisories at onceThe security release and what to check.
- 25BuildSmall changes at VercelA look at smaller updates.
- 26Model watchImages 2.6: pictures start to moveGIF, SVG and more precise editing.
- 27Model watchFlare or SunburstComparing the two API models.
- 28Model watchGoogle Meet breaks language barriers63 languages and automatic detection.
- 29Model watchWho can use it and what can go wrongConditions, limits and Serbia.
- 30Model watchMuse gets a voice and a faceVoice, avatars and availability.
- 31Model watchModels of the weekWhat arrived, where and on what terms.
- 32Model watchFrom sketch to app, from test to lifeGemini Canvas and LifeVal.
- 33Security signalGhostMap: an app with no code that breaks a phoneA crash without launching the app.
- 34Security signalWhen two parsers disagreeAPK life cycle and the service crash.
- 35Patch nowPatch this nowWordPress, Zyxel, Better Auth, Android.
- 36Security signalWhen a cyberattack changes the temperature in the fridgeAn attack on the blood service's supply chain.
- 37Security signalAn alarm that does not depend on the attacked systemLessons for healthcare and OT.
- 38Security signalZyxel: three sources, three different thingsWho confirmed what.
- 39Security signalWhen the trusted source is the problemmSecure and the NIKKE launcher.
- 40Security signalPaying people to find what models missBug bounty and the DreamHost follow-up.
- 41Security signalShort security roundupPhishing, tokens and code analysis.
- 42LabCan it be mathematically proven that AI really did what it claims?A zero-knowledge proof for a model's answer.
- 43LabProof of origin is not proof of truthWhat FlashProve checks, and what it does not.
- 44LabClaude and the mystery of hollow particlesThe first structure and the role of AI in the lab.
- 45LabWhat scientists really use Claude for207,049 sessions under the lens.
- 46LabUp to 15 times faster, in one imagined worldThree scenarios for faster science.
- 47LabAn hour of chemistry, not an hour to a drugAgents and cheminformatics.
- 48LabFrom CAD model to real partCAD, PCB, Mazda and Ganassi.
- 49MoneyAMD: Data Center almost doublesA record quarter and Data Center.
- 50MoneyAMD in four chartsRevenue, segments, margin.
- 51MoneyApple: a record with no AI story in the numbersFourth fiscal quarter results.
- 52MoneyArm sells blueprints, and now more than thatLicences, royalties and data centers.
- 53InfraWhat a 401-megawatt guarantee looks likeGuarantees, debt and 401 MW.
- 54InfraA compute campus as a grid reserveFlexible demand and the power bill.
- 55MoneyWho is making money in this phaseFigma and where the money goes.
- 56WorkHow to turn on translation in Google MeetStep by step, with WhatsApp, Fitbit and learning.
- 57OrbitSwift has ended its missionEnd of the mission after almost 22 years.
- 58OrbitTwenty-two years on one lineTimeline from 2004 to 2026.
- 59OrbitX-70 Fractal: an aircraft that swaps its equipmentA new experimental platform.
- 60OrbitTwo flybys, one photo, one landingESCAPADE, Hera and SPLICE.
- 61Use thisCheck your workflows before 9 NovemberA guide for public repositories.
- 62Use thisDo not remove protection for one workflowAssessment, exceptions and documentation.
- 63ShippedShipped this weekWhat is really available, with status.
- 645 minutesIn briefShort news worth knowing.
- 65NumbersThe week in numbersSecurity, Linux and products.
- 66NumbersMore numbers of the weekScience, money and space.
- 67NextWhat we are watchingDates ahead.
- 68SourcesAll sources in this issuePrimary sources first.
