Industry shifts, security alerts, hardware, and AI/ML Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 29-2026bolt5 CRITICAL
article
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
TAG: SECURITY
wp2shell is a two-bug unauthenticated RCE chain in WordPress core: CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) lets an anonymous HTTP request reach arbitrary code execution with no plugins required. WordPress shipped 6.9.5 and 7.0.2 on July 18, 2026 with forced auto-updates; 6.8.6 patches the injection alone since the batch-route confusion only exists from 6.9 onward. A working proof-of-concept is now public on GitHub, and Rapid7 adds authenticated scanner checks July 20 — no confirmed exploitation yet, but Cloudflare has deployed WAF rules. Sites without a persistent object cache (Redis/Memcached) face the full RCE path; update immediately or block /wp-json/batch/v1 at the WAF as a stopgap.
AsyncAPI npm packages backdoored via GitHub Actions
TAG: SECURITY
On July 14, 2026, an attacker exploited a pull_request_target workflow in the asyncapi/generator repository — a fix PR (#2092) had been open since May 17 and was never merged — to steal an npm publish token via a dead-drop at rentry[.]co. The attacker then published five trojanized packages: @asyncapi/specs@6.11.2, @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1, combining for roughly 2.9 million weekly downloads. The malicious code — identified as the M-RED-TEAM v6.4 / Miasma framework — fetches an encrypted Node.js loader from IPFS and installs a persistent remote shell beaconing to hxxp://85[.]137[.]53[.]71:8080 every 30 seconds; credential harvesting and propagation are present in code but toggled off. Downgrade to the previous clean versions immediately and rotate all credentials accessible from any affected developer machine or build host.
Next.js Security Release and Our Next Patch Release
TAG: SECURITY
Vercel announced that Next.js is moving from ad-hoc security patches to a formal monthly security release program, citing a sharp rise in LLM-assisted vulnerability discovery — Mozilla recently disclosed 271 issues in a single Firefox release found by Anthropic's Mythos Preview. The inaugural scheduled release, targeting July 21, 2026, covers patch releases for Next.js 16.2 and 15.5 and addresses 4 high and 5 medium severity vulnerabilities; CVE details will publish alongside the patch. Advance notice gives hosting providers time to deploy platform-level firewall mitigations before users upgrade. For urgent zero-days or actively exploited issues, ad-hoc patches will still ship immediately. Researchers can report via Vercel's Open Source Bug Bounty at security@vercel.com.
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
TAG: SECURITY
CVE-2026-42533 is a heap buffer overflow in nginx's two-pass script engine, scoring 9.2 CVSS v4, patched July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline) and NGINX Plus 37.0.3.1. Every nginx version from 0.9.6 through 1.31.2 — a range reaching back to 2011 — is vulnerable when a regex-based map variable appears in a string expression after a numbered capture ($1, $2). Researcher Stan Shaw argues the flaw supplies its own ASLR bypass: on a default Ubuntu 24.04 build, a single unauthenticated GET recovers heap addresses, and he confirmed a second code path that F5's named-capture mitigation does not close. Shaw will publish his proof-of-concept 21 days post-patch; no public exploit or CISA KEV entry exists yet. This is the third heap overflow in nginx's expression evaluator in two months — upgrade, don't rely on the mitigation alone.
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
TAG: SECURITY
Security firm Stripe OLT discovered a hidden browsing-history collector inside the official Chrome/Edge build of ModHeader (extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, v7.0.18), a header-editing extension with roughly 1.6 million installs. The collector builds a device fingerprint, encrypts visited domains with a hardcoded key, stores up to 1,000 domains locally, and beacons them once daily to api.stanfordstudies[.]com — but only fires when an internal allow-list is populated, which it never was. Google pulled the Chrome listing on July 10; Microsoft removed the Edge listing on July 3. Automated risk scanners rated ModHeader as low risk because the data is encrypted and the upload is gated — a design that defeats sandbox analysis. Defenders should block stanfordstudies[.]com and extensions-hub[.]com at DNS and proxy, and rotate any API keys, tokens, or session cookies that were pasted into the extension's header editor.
Grok Build uploaded your entire Git repo to xAI storage - what developers need to know
TAG: SECURITY
Researcher cereblab found that Grok Build version 0.2.93 sent entire tracked git repositories — not just agent-opened files — to a Google Cloud Storage bucket (grok-code-session-traces) operated by xAI. Traffic analysis showed 5.10 GiB of storage upload versus only 192 KB of model API traffic, a ratio of roughly 27,800×. The bundle included all tracked files, full commit history, and unredacted .env secrets — even from commits where secrets had since been deleted. Critically, disabling "Improve the model" in settings did not stop the upload; that toggle controls training use only, not data transmission. xAI server-side disabled the upload on July 13, 2026, but analysis of build 0.2.99 shows the upload code still present in the binary and re-enablable without a client update. If your team ran Grok Build before July 13, rotate every credential that appears anywhere in commit history.
Anthropic extends Fable 5 again — and won't talk about what developers found inside Cursor
TAG: BREAKTHROUGH
Anthropic extended enhanced access to Claude Fable 5 through July 19 for Pro, Max, Team, and qualifying Enterprise subscribers — its third extension in five weeks — after export controls forced a worldwide disable on June 12 following the initial June 9 launch. Simultaneously, developer @chetaslua spotted an undocumented model called Claude Honeycomb EAP inside Cursor's model picker on July 8; the listing disappeared within hours but revealed a one-million-token context window, an "extra high effort" reasoning mode, and a safety fallback that routes sensitive prompts to Claude Opus 4.8 — the same fallback mechanism documented for Fable 5. Many developers interpret the Opus 4.8 routing as a signal that Honeycomb sits above Fable 5 in capability and may be an early preview of Claude Opus 5. After the promotion ends, Fable 5 is priced at $10/M input tokens and $50/M output tokens, reducible via prompt caching (90% off cached inputs) and the Batch API (50% off both).
Dex Horthy — founder of HumanLayer and the person who coined "context engineering" days before Andrej Karpathy popularised it — explains that context engineering means de-abstracting RAG, memory, and agentic history down to their common root: tokens in, tokens out. Every LLM call has an information budget and an instruction budget; stuffing either degrades quality because frontier models struggle to attend reliably past roughly 150–250 instructions. Dex argues for building loops incrementally — his team runs nightly cron-triggered Claude Code slow loops that wake to a single focused PR each morning — and warns against fully "lights-off" software factories after his own team shut theirs down in November 2025, four months after launch, when accumulated unread LLM-generated code became impossible to debug. The core takeaway: harness engineering (optimising the environment an agent runs in) plus specdriven development before handing off to an implementer dramatically reduces PR review latency and avoids the architectural rot that loop-only factories produce.
Theo covers Bun creator Jared Sumner's decision to port 500,000 lines of Zig to Rust in 11 days using ~50 parallel Claude Code dynamic workflows — reaching 1,300 lines of code per minute at peak with Fable 5, at an API cost of roughly $165,000. The method: a language-independent TypeScript test suite, adversarial multi-agent review (implementer and two reviewers with separate context windows), and a detailed porting.md guide that pre-mapped Zig patterns to Rust idioms. Bun 2.0 on Rust fixed 128 reproducible bugs from the Zig build, reduced peak memory 10×, and shrank the Linux/Windows binary by 20%. The second half of the video is an extended reaction to Zig language creator Andrew Kelly's blog post criticising the port and Jared personally, which Theo argues fatally damages Zig's credibility as a production language and demonstrates why language creators must value users over ideological purity.
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
wp2shell is a two-bug unauthenticated RCE chain in WordPress core: CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) lets an anonymous HTTP request reach arbitrary code execution with no plugins required. WordPress shipped 6.9.5 and 7.0.2 on July 18, 2026 with forced auto-updates; 6.8.6 patches the injection alone since the batch-route confusion only exists from 6.9 onward. A working proof-of-concept is now public on GitHub, and Rapid7 adds authenticated scanner checks July 20 — no confirmed exploitation yet, but Cloudflare has deployed WAF rules. Sites without a persistent object cache (Redis/Memcached) face the full RCE path; update immediately or block /wp-json/batch/v1 at the WAF as a stopgap.
Dex Horthy — founder of HumanLayer and the person who coined "context engineering" days before Andrej Karpathy popularised it — explains that context engineering means de-abstracting RAG, memory, and agentic history down to their common root: tokens in, tokens out. Every LLM call has an information budget and an instruction budget; stuffing either degrades quality because frontier models struggle to attend reliably past roughly 150–250 instructions. Dex argues for building loops incrementally — his team runs nightly cron-triggered Claude Code slow loops that wake to a single focused PR each morning — and warns against fully "lights-off" software factories after his own team shut theirs down in November 2025, four months after launch, when accumulated unread LLM-generated code became impossible to debug. The core takeaway: harness engineering (optimising the environment an agent runs in) plus specdriven development before handing off to an implementer dramatically reduces PR review latency and avoids the architectural rot that loop-only factories produce.
Theo covers Bun creator Jared Sumner's decision to port 500,000 lines of Zig to Rust in 11 days using ~50 parallel Claude Code dynamic workflows — reaching 1,300 lines of code per minute at peak with Fable 5, at an API cost of roughly $165,000. The method: a language-independent TypeScript test suite, adversarial multi-agent review (implementer and two reviewers with separate context windows), and a detailed porting.md guide that pre-mapped Zig patterns to Rust idioms. Bun 2.0 on Rust fixed 128 reproducible bugs from the Zig build, reduced peak memory 10×, and shrank the Linux/Windows binary by 20%. The second half of the video is an extended reaction to Zig language creator Andrew Kelly's blog post criticising the port and Jared personally, which Theo argues fatally damages Zig's credibility as a production language and demonstrates why language creators must value users over ideological purity.
AsyncAPI npm packages backdoored via GitHub Actions
On July 14, 2026, an attacker exploited a pull_request_target workflow in the asyncapi/generator repository — a fix PR (#2092) had been open since May 17 and was never merged — to steal an npm publish token via a dead-drop at rentry[.]co. The attacker then published five trojanized packages: @asyncapi/specs@6.11.2, @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1, combining for roughly 2.9 million weekly downloads. The malicious code — identified as the M-RED-TEAM v6.4 / Miasma framework — fetches an encrypted Node.js loader from IPFS and installs a persistent remote shell beaconing to hxxp://85[.]137[.]53[.]71:8080 every 30 seconds; credential harvesting and propagation are present in code but toggled off. Downgrade to the previous clean versions immediately and rotate all credentials accessible from any affected developer machine or build host.
Next.js Security Release and Our Next Patch Release
Vercel announced that Next.js is moving from ad-hoc security patches to a formal monthly security release program, citing a sharp rise in LLM-assisted vulnerability discovery — Mozilla recently disclosed 271 issues in a single Firefox release found by Anthropic's Mythos Preview. The inaugural scheduled release, targeting July 21, 2026, covers patch releases for Next.js 16.2 and 15.5 and addresses 4 high and 5 medium severity vulnerabilities; CVE details will publish alongside the patch. Advance notice gives hosting providers time to deploy platform-level firewall mitigations before users upgrade. For urgent zero-days or actively exploited issues, ad-hoc patches will still ship immediately. Researchers can report via Vercel's Open Source Bug Bounty at security@vercel.com.
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
CVE-2026-42533 is a heap buffer overflow in nginx's two-pass script engine, scoring 9.2 CVSS v4, patched July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline) and NGINX Plus 37.0.3.1. Every nginx version from 0.9.6 through 1.31.2 — a range reaching back to 2011 — is vulnerable when a regex-based map variable appears in a string expression after a numbered capture ($1, $2). Researcher Stan Shaw argues the flaw supplies its own ASLR bypass: on a default Ubuntu 24.04 build, a single unauthenticated GET recovers heap addresses, and he confirmed a second code path that F5's named-capture mitigation does not close. Shaw will publish his proof-of-concept 21 days post-patch; no public exploit or CISA KEV entry exists yet. This is the third heap overflow in nginx's expression evaluator in two months — upgrade, don't rely on the mitigation alone.
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
Security firm Stripe OLT discovered a hidden browsing-history collector inside the official Chrome/Edge build of ModHeader (extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, v7.0.18), a header-editing extension with roughly 1.6 million installs. The collector builds a device fingerprint, encrypts visited domains with a hardcoded key, stores up to 1,000 domains locally, and beacons them once daily to api.stanfordstudies[.]com — but only fires when an internal allow-list is populated, which it never was. Google pulled the Chrome listing on July 10; Microsoft removed the Edge listing on July 3. Automated risk scanners rated ModHeader as low risk because the data is encrypted and the upload is gated — a design that defeats sandbox analysis. Defenders should block stanfordstudies[.]com and extensions-hub[.]com at DNS and proxy, and rotate any API keys, tokens, or session cookies that were pasted into the extension's header editor.
Grok Build uploaded your entire Git repo to xAI storage - what developers need to know
Researcher cereblab found that Grok Build version 0.2.93 sent entire tracked git repositories — not just agent-opened files — to a Google Cloud Storage bucket (grok-code-session-traces) operated by xAI. Traffic analysis showed 5.10 GiB of storage upload versus only 192 KB of model API traffic, a ratio of roughly 27,800×. The bundle included all tracked files, full commit history, and unredacted .env secrets — even from commits where secrets had since been deleted. Critically, disabling "Improve the model" in settings did not stop the upload; that toggle controls training use only, not data transmission. xAI server-side disabled the upload on July 13, 2026, but analysis of build 0.2.99 shows the upload code still present in the binary and re-enablable without a client update. If your team ran Grok Build before July 13, rotate every credential that appears anywhere in commit history.
Anthropic extends Fable 5 again — and won't talk about what developers found inside Cursor
Anthropic extended enhanced access to Claude Fable 5 through July 19 for Pro, Max, Team, and qualifying Enterprise subscribers — its third extension in five weeks — after export controls forced a worldwide disable on June 12 following the initial June 9 launch. Simultaneously, developer @chetaslua spotted an undocumented model called Claude Honeycomb EAP inside Cursor's model picker on July 8; the listing disappeared within hours but revealed a one-million-token context window, an "extra high effort" reasoning mode, and a safety fallback that routes sensitive prompts to Claude Opus 4.8 — the same fallback mechanism documented for Fable 5. Many developers interpret the Opus 4.8 routing as a signal that Honeycomb sits above Fable 5 in capability and may be an early preview of Claude Opus 5. After the promotion ends, Fable 5 is priced at $10/M input tokens and $50/M output tokens, reducible via prompt caching (90% off cached inputs) and the Batch API (50% off both).
Week 29 arrived with a concentrated storm of critical vulnerabilities spanning every major layer of the web stack. WordPress core shipped an unauthenticated RCE chain (CVE-2026-63030 + CVE-2026-60137) affecting every 6.9 and 7.0 installation, while nginx's heap-buffer-overflow (CVE-2026-42533, CVSS 9.2) threatened a configuration class reaching back to 2011. Both exploits are now partially public and racing the patch rollout.
Supply-chain attacks escalated from theory to practice: AsyncAPI's five most-downloaded npm packages — 2.9million weekly downloads — were backdoored via a known pull_request_target GitHub Actions footgun, deploying a full remote shell under the M-RED-TEAM v6.4 / Miasma payload framework. The attack exploited a fix PR that had been open and unmerged for nearly two months.
Trust in browser extensions and AI coding tools also eroded. ModHeader's 1.6million-install Chrome/Edge extension was pulled after a dormant browsing-history collector was found baked into the official store build — already equipped with encryption, a daily beacon, and a remote switch to activate. Meanwhile Grok Build was found silently uploading entire git repositories — not just opened files — to xAI cloud storage, 27,800× the data the model actually needed.
On the AI-tooling front, Anthropic extended Fable 5 access for a third time as an unreleased model dubbed Claude Honeycomb EAP briefly surfaced in Cursor, and Bun's million-line Zig-to-Rust port — completed in 11 days with Claude Fable 5 and Claude Code dynamic workflows — demonstrated what LLM-assisted mechanical porting looks like at production scale. Next.js simultaneously formalised a monthly security release program in response to rising LLM-assisted vulnerability discovery.
The throughline: automated tooling — from CI pipelines to coding agents — is now both the attack surface and the primary defense. Developers need verified, pinned dependencies; audited GitHub Actions workflows; and explicit policies around what data AI coding tools are permitted to transmit.
Key Takeaways
Patch immediately: WordPress 6.9.x → 6.9.5, 7.0.x → 7.0.2; nginx → 1.30.4 / 1.31.3; downgrade @asyncapi/specs, @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components to their previous clean releases and rotate any credentials that touched the affected builds.
Audit your GitHub Actions workflows for pull_request_target triggers that check out external PR code with access to repository secrets — the AsyncAPI attack exploited a known, unpatched footgun to steal an npm publish token and backdoor 2.9 million weekly downloads.
Treat AI coding-tool data boundaries as a security concern: Grok Build silently uploaded full git history (including secrets in commit history) 27,800× beyond what the model needed, and the opt-out toggle only controlled training use, not transmission.
