Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-15 · source-backed
semantica-agi/semantica surged +1,181 stars to 7,761 today, and the release driving it is a security release from August 11 fixing six externally-reported flaws across the Explorer API and the graph store backends, plus a CodeQL-flagged ReDoS. GitHub A missing-authentication gap on a graph explorer is not a hardening nice-to-have. Anyone who deployed a Semantica Explorer before August 11 must upgrade now, then check access logs.
Each link below shares sources, entities, or timing with this story.
Released July 11, it adds static-analysis queries that flag prompt-injection vulnerabilities in JavaScript and TypeScript, plus Kotlin 2.4.0 support (GitHub). Treating untrusted-input-into-LLM flows as a first-class security defect class is the right call. If you're wiring LLM...
A Chinese lab shipped a runtime that manages two American coding agents as subagents, and it went from repo creation to 145,439 stars in four days. deepseek-ai/deepseek-harness published dsh-v0.1.0-rc.7 at 12:01 UTC today, its first tagged release since the repo appeared on Au...
ChaoMixian/dsh2shell, created August 21, is a Python PoC for unauthenticated remote code execution against dsh web instances reachable on the network (GitHub). It arrives while the plugin ecosystem scales fast, with dshplugin/dsh-plugin-hub advertising 4,000+ community plugins...
High-performance GraphRAG reimplemented in Rust. Achieves ~200ms query times vs ~500ms for Python equivalents (2.5x faster). Multi-pass gleaning catches 15-25% more entities. SDKs in TypeScript, Python, Rust, Java, Kotlin. For production RAG builders who need speed. GitHub
Zed 1.16.2 and 1.17.1-pre, both published August 24, raise the workspace minimum wasmtime-wasi to 36.0.14 so cap-primitives resolves to the patched 3.4.6 instead of 3.4.4, which had a trailing-slash symlink handling bug that could bypass capability filesystem confinement (GitH...
Before v4.1.15 on August 23, it only applied to tools also opted in individually, so flipping it appeared to do nothing. Anyone who left it on assuming it was inert has just widened their unattended tool surface across every connected server. (GitHub) Same release train fixed...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.