Feed aggregator

Beer Thirty celebrates 12 years with a Soquel beer festival as its family of local taphouses expands with live music, poolside events and new dining plans.

Brothers Joel and Brayden Estby built 11th Hour Coffee into a Santa Cruz gathering place fueled by creative drinks, housemade food and community connection.

La Bahia Hotel’s High Tide restaurant pairs Pacific Rim-inspired seafood and ocean views with a pale-pink Flowers Sonoma Coast Rosé.

A reluctant hot-yoga convert explores the potential benefits of saunas, steam rooms and other forms of therapeutic heat available around Santa Cruz County.

Airbus yesterday flew the latest variant of its A350 widebody jet from Australia to France, non-stop, on a route that saw it remain aloft for over 24 hours. The variant is called the A350-1000ULR, which stands for Ultra-Long Range. The plane earns its name thanks to its use of an additional rear center fuel tank that can carry 20,900 liters of fuel capacity. That tank gives the plane a range of almost 10,000 nautical miles, or 18,500km/11,500 miles. The launch customer for the plane is Australia’s largest airline, Qantas, which wants it so it can fly non-stop from to and from Europe, and to New York. Australia-Europe flights will take up to 22 hours, just two or three hours less than is possible to make the same journey with an intermediate stop. Qantas thinks there’s a market for the direct route and that passengers will pay a premium for the privilege of remaining in a carbon fiber tube for almost an entire day, instead of stopping to stretch their legs or buy some duty free en route. Airbus sent the first A350-1000ULR out of the factory and down the runway in June. Several test flights followed, culminating in a 19-hour Toulouse to Melbourne flight that spanned July 23 and 24. Qantas and Airbus went into PR overdrive after that flight, suggesting it was a decent proof of concept for direct Europe-Australia flights. That conveniently ignored the fact that a week earlier, one of Qantas’ A380s flew nonstop to Sydney from Dresden, Germany. Dresden is home to one of the few facilities capable of conducting major maintenance on the A380. When Qantas uses it, the airline sends its superjumbos home on a nonstop itinerary but without passengers. The A350-1000ULR carries hardware that simulates the presence of passengers, so is perhaps doing a bit more work than an empty A380. It’s harder to quibble about the return Melbourne-Toulouse flight, as it lasted 24 hours and 24 minutes, and saw the plane traverse 23,076 km. That’s a distance record for a commercial airliner. Flightradar24 has data about both flights, here. Qantas plans to buy a dozen of the long-legged Airbuses, and to use them for daily nonstop flights from Sydney to London and New York – starting in 2027. The carrier plans to pack the planes full of premium seating, with even economy class divided into three distinct offerings – premium economy, economy with extra legroom, and conventional economy, plus a zone dedicated to standing and stretching. The airline plans special menus, and cunning use of lighting, to make ultra long-haul travel less miserable. In 2015, your correspondent took what was then the world’s longest commercial flight, a seventeen-hour hop from Dallas to Sydney – and lived to tell the tale. I’ve crossed the Pacific about 20 times since and made it to Europe five or six times too. All that flying led me to devise techniques involving strategic use of over-the-counter sleeping pills and making sure I get outdoors to minimize jet lag – mostly with decent success. Yet a 22-hour flight seems daunting. Maybe I’ll get to try it one day. ®

South Korean memory-maker SK Hynix has revealed that it’s struck “around ten” long-term supply deals with key customers, many of them AI players, and hopes the deals smooth out volatile memory prices. The company revealed the deals today, along with Q2 results that saw quarterly revenue reach ₩79.3 trillion ($54.5 billion), a 257 percent year-over-year increase. Operating profit grew by an even larger number: 557 percent year-over-year to ₩60.5 trillion ($41.6 billion). The memory-maker even achieved the unusual feat of delivering more net income than revenue, thanks to asset sales. Underlying all that growth was an average 30 percent increase in the average price customers paid for DRAM, a 50 percent rise in the prices paid for NAND memory, along with increased shipments. But the company predicted slow growth in Q3, with NAND shipments rising by a low single-digit percentage and about ten percent more DRAM to leave SK Hynix’s factories. Some of that memory will be HBM4, which execs said will ship in increased volume and mean average selling prices rise higher still, as will earnings. Execs pointed to the company’s colossal expenditure on additional manufacturing capacity but said they see no risk of creating oversupply because the AI industry has a voracious appetite for memory and will do for the foreseeable future. Indeed, company president Song Hyeon-jong said SK Hynix’s relationship with customers “is evolving beyond transactional relations into more strategic long-term partnerships” and said that behavior “serves as the evidence of the sustained demand coming from the AI ecosystem.” SK Hynix’s big customers are therefore typically doing deals that last up to five years and structuring those arrangements to keep prices steady. “The objective is to reduce uncertainty arising from short-term market volatility while enhancing long-term business stability for both our customers and SK Hynix,” Song said. “At the same time, it is equally important to secure effective purchase commitment, given the impact that demand volatility can have on the memory cycle,” he added. “In addition to long-term volume commitments, the agreements include mechanisms such as deposits that can strengthen contract implementation and demand visibility.” All of which sounds rather like SK Hynix’s big customers are trying to keep memory prices as low as possible, by helping the Korean company to manage its cashflow so it can keep cranking out more chips. Head of investor relations Park Seong-hwan argued that demand for memory and storage will remain strong for years to come, even if major AI companies find themselves with more datacenter capacity than they need. Park said hyperscalers leasing their datacenters is a sign of increased utilization rates for existing AI infrastructure. He also brushed aside adoption of more efficient models as a trend that could be bad for memory sales, suggesting better models spur demand for AI services and therefore also for more infrastructure. “This view is also supported by the medium-to long-term demand outlook we have discussed with our key customers,” Park said. The company also argued that agentic AI will spur demand for more memory, including in servers. “We are witnessing a structural shift in demand where both AI memory and conventional memory are growing together,” the company wrote in its earnings release. Investors appear not to have been impressed by those arguments, or SK Hynix’s profits, as the company’s share price has dropped around five percent at the time of writing. ®

Christian Chavez was struggling with anxiety while attending Pajaro Valley High School and frequently refused to go.

“I was just staying home,” he said.

Christian, 15, was eventually placed at Sequoia High School, a smaller campus tailored for students struggling academically and emotionally.

He also joined Aztecas Youth Soccer Club, a Watsonville nonprofit operated by the Santa Cruz County Probation Department that was created nearly two decades ago to give young people positive outlets centered around soccer.

That was the catalyst that changed his life.

At Aztecas, Christian found the routine and camaraderie he had been missing.

“I just started coming here every day,” he said. “It helped me go back to school. It’s helped me a lot with my daily routine. They give me food, they take us places, they give us a lot of activities to do here, like cooking classes.”

On Tuesday, Christian joined dozens of community members, supporters and public officials to celebrate the opening of Aztecas’ new clubhouse on Prospect Street—a place program leaders say will allow them to expand the support they provide to local youth.

The renovated clubhouse is the first dedicated facility of its kind for a California probation-operated youth soccer program, according to Santa Cruz County Chief Probation Officer Sandra Mendez.

“It stands as a model for what proactive, compassionate intervention can look like,” Mendez said during the ribbon-cutting ceremony.

Founded  by Probation Department employee Gina Castañeda, Aztecas began with a simple mission: use soccer to reach young people involved in the juvenile justice system.

“We started with mainly all wards of the court, all kids that were on probation,” she said.

In those early years, that meant bringing together rival gang members on the same team.

“I did gang intervention, negotiations and a lot of education with them to get them to see each other as people and not as rivals,” Castañeda said. “And then a lot of support from their parents.”

The program steadily expanded.

“One team turned into two indoor teams, then all of a sudden we had an outdoor team,” she said.

But as participation grew, Castañeda realized soccer alone wasn’t enough.

“Even though they were part of our program, they were not graduating from high school,” she said.

The organization added education and mentoring, building what Castañeda describes as a wraparound support system.

“We knew that if we could get kids to graduate and get either into the workforce or into higher education, they would be more successful in life,” she said.

Today, about 98% of the program’s participants graduate from high school and go on to college or careers, she said.

The free program is supported by the Community Foundation Santa Cruz County, Driscoll’s, California Giant Berry Farms, local Rotary and Lions clubs, the 1440 Foundation and individual donors.

The 1440 Foundation contributed $8,000 toward the clubhouse’s $17,000 renovation.

The new headquarters includes a kitchen, lounge, internet access and study space. But Castañeda said the building represents much more than a place to gather.

Youth can receive help writing résumés, preparing for job interviews and searching for employment. Those in need can also receive clothing, shoes and backpacks.

“It really is a safe place where kids can come, be seen and heard,” she said. “They can be believed in, and we’re going to meet their needs with wraparound services.”

For Ceiba College Preparatory Academy sophomore Chris Robles, 15, Aztecas has simply become a place where he belongs.

A member of the club for about four years, he said he first joined because he loves soccer.

“I just do it for the love of the sport, honestly,” he said.

But with the opening of the new clubhouse, he now has another place to spend time with teammates off the field—a place designed to help young people build not only stronger soccer skills, but stronger futures as well.

For Castañeda, the philosophy is simple.

“This is truly about rehabilitation and meeting kids where they’re at,” she said. “Once you work with them and show them respect, and they know somebody cares about them, they’re going to be invested in you as much as you’re invested in them.”

That investment goes both ways, she added.

“I’m inspired by them,” she said. “They’re the kids that keep me going because I know there is a need. A lot of those kids are forgotten and thrown away.”

The US government has decided to effectively ban the sale of advanced robots made in other nations. The decision trickled out over two days with publication of a National Security Determination [PDF] and an update [PDF] to the list of banned devices set by the Federal Communications Commission (FCC). The national security document observes “Advanced robotic devices will be critical to creating efficiencies in our economy, dominating on the battlefield, and securing our homeland” and notes that modern bots are now constantly connected to networks “which creates broad attack surfaces and leaves them vulnerable to data exfiltration, remote disruption of the physical robot, and dependencies on unsecure over the air updates.” One example of those vulnerabilities mentioned in the document is the UniPwn flaws that made it possible for attackers to take over humanoid robots made by Chinese company Unitree. “If the United States continues to rely on foreign sources of advanced robotic devices and critical components, it will subject the parts of the U.S. economy and national security enterprise that are reliant on these robots to the whims of foreign entities that could disrupt or degrade the supply chains at a time of their choosing,” the document states. To respond to those threats, the FCC decided the foreign-made advanced robotic devices belong on its Covered List of products for which imports are banned because they pose an unacceptable risk to the national security of the United States and its residents. The regulator offered a single exception: if the Department of War vouches for a device, it can have it. Foreign-owned companies that make their bots in America are also exempt, an important exemption because one of the leading robot-makers is Boston Dynamics – a company backed by the USA’s DARPA that is now majority-owned by South Korea’s Hyundai, but continues to manufacture its machines stateside. The decision does, however, apply to all future foreign-made devices. Vendors of clankers already approved for sale in the USA can continue to import them, and users are also free to use any bots they already own. But the intent of the documents is clear: from now on, only robots made in America are welcome in America. One entity that stands to benefit from this decision is Tesla, which Elon Musk claims will one day produce one million humanoid robots a year. In true Muskian style he has also said Tesla will go into “high production” of the bots in 2026, but there’s no evidence of that happening although the occasional trillionaire did recently show off the production line for Tesla’s “Optimus” bot. ®

A dramatic weekend rescue at Seabright State Beach has caught the attention of the White House, with President Donald Trump announcing Tuesday that he plans to honor a lifeguard involved in the rescue, a 16-year-old Santa Cruz local, for saving a young boy from hazardous surf.

After video capturing the rescue went viral, Trump’s son, Eric Trump, shared the video on X with a caption praising the teen for his heroic actions, and calling for him to receive “the highest civilian honor.”

The president agreed, also posting about the young lifeguard on Truth Social.

“We’re going to bring this heroic young man, and his family, into the White House with, perhaps, the boy he saved, to give him a High Civilian Honor. Very brave, he deserves it!” Trump wrote on Truth Social.

Rough ocean conditions led to over 29 people having to be saved from rip currents and sneaker waves in Santa Cruz this past weekend, including the one that involved the 16 year-old who works with California State Parks lifeguards.

View this post on Instagram

The video prompted viewers to ask if the young guard had a GoFundMe, as well as calls for him to be awarded with things like a key to the city or a full ride to college for his bravery. His mother responded to one of the videos on Instagram saying that he’s just doing the job that he loves. Instead of a GoFundMe, she pointed people toward supporting the Santa Cruz County Parks Junior Guards program that trained him.

As for the President’s post, it’s unclear what he meant by “High Civilian Honor.” The Presidential Medal of Freedom is typically described as the highest civilian award of the U.S. government, and the second-highest of such awards is the Presidential Citizens Medal, which is awarded to U.S. citizens who are recognized as doing”exemplary deeds of service for their country or their fellow citizens.”

Lookout was unable to immediately confirm whether the family has received an official White House invitation, and if so whether they have accepted.

The post Viral Seabright beach rescue: Trump invites 16-year-old Santa Cruz lifeguard to White House appeared first on Lookout Santa Cruz.

The deal is Cyera's third acquisition this year.

In an administration stuffed full of the very worst, most morally vacant, reprehensible people on Earth, senior White House adviser and top hate-filled hobgoblin Stephen Miller still manages to stand out. His steadfast commitment to naked cruelty never wavers, and he seems to have an infinite capacity to get in front of a camera and say the most absurd, offensive stuff imaginable.

Source

A daily roundup of the best stories and cartoons by Daily Kos staff and contributors to keep you in the know. GOP’s fervor to restrict voting rights just might backfire The midterms won’t be a fun night for Republicans. Republicans think they can message away a terrible tax law Every now and then, voters get something exactly right. Trump gets nuclear-grade stupid in…

Source

Now more than ever, we modern-day court jesters need your support! Become a paid subscriber to any (or all!) of the platforms below to keep Keef gentleman-cartooning into the future and beyond! www.patreon.com/keefknight keithknight.substack.com ko-fi.com/… kchronicles.com/…

Source

History is littered with the corpses of technologies that were ahead of their time, and Intel’s Optane storage and memory products are certainly among them. Expensive, badly misunderstood, and awkwardly priced, the technology struggled to find a place in the market, surviving just five years before Chipzilla pulled the plug. Things might have been different if it were launched today. The shift from AI training to inference has driven tremendous demand for DRAM and NAND flash. In fact, the same properties that made Optane a niche product a few years ago would have made it ideally suited to these write intensive AI workloads. The rise and fall of Optane Intel and Micron co-developed Optane – or more specifically, 3D XPoint memory – and unveiled it in 2015. It promised to bridge the gap between conventional NAND flash used in SSDs and DRAM used in DDR4 and (later) DDR5. Like NAND, 3D XPoint was non-volatile, which means data persists when unpowered, making it appropriate for storage applications. But unlike NAND, 3D XPoint didn’t store data using trapped electrons and instead relied on a phase change material that was both extremely fast, achieving sub-10-microsecond latencies (even lower for later PMem modules), and absurdly write-endurant. Intel’s penultimate Optane SSDs boasted endurance of 100 drive writes a day and a mean time between failures of two million hours — specs that remain unrivaled today. Those figures are of course extrapolated, based on what we know about how 3D XPoint reads and writes data. But if anything, we suspect Intel was probably being conservative with its claims. This one-two punch of endurance and latency, particularly for random reads and writes meant that it could be used as a second tier of system memory. Optane SSDs are really, really low latency for storage-class memory, but they’re still orders of magnitude less responsive than DRAM which can hit 100 nanoseconds or lower. We should note Intel’s PMem DIMMs were capable of latencies of roughly 350 nanoseconds. Intel’s Optane persistent memory also had the benefit of capacities up to 512 GB per DIMM, at a time when the most you could expect out of DDR4 was about 128 GB – and only if you had deep pockets. These persistent memory DIMMs could be made to behave like main memory, with standard DDR4 functioning as a massive L4 cache when enabled; as a storage pool; or in an application-aware memory mode, which exposed the Optane memory directly to select applications. Despite Optane’s many strengths, it was rather awkwardly priced. For the same memory density, 3D XPoint was consistently more expensive than NAND and, while cheaper than DRAM, significantly less performant. As a result, there was rarely a scenario in which users were better off with Optane than they would be just buying more NAND or fewer, bigger DIMMs. To make matters worse, as the boffins at TechInsights noted at the time, while 3D XPoint had its merits, it wasn’t improving quickly enough to keep up with NAND flash on bit density. By 2021, Micron had had enough. The memory vendor announced it would end development of 3D XPoint products. With no source of new silicon for its SSD and persistent memory products, the writing was on the wall for Optane. Intel's then-CEO Pat Gelsinger officially pulled the plug in 2022, ending development of new products under the Optane banner. The P5810X and P5811X, the final Optane products to roll off the assembly line, launched in late 2022. Ahead of its time The same year Intel pulled the plug on Optane, a new workload was emerging that would completely turn the datacenter on its head, and might very well have been the killer app to justify 3D XPoint’s continued development. In November 2022, OpenAI, then a relatively obscure AI startup, lifted the curtain on ChatGPT, kicking off an AI arms race and sparking a massive influx of money into the tech sector. Large language models are among the most resource-intensive workloads in the world. But until 2025, most of that compute was dedicated to training bigger, smarter, and less hallucination-prone models. The arrival of DeepSeek early in that year signaled the shift toward inference, a workload that needs plenty of compute, memory, and storage. Modern inference engines are tuned to maximize efficiency. One way is by caching the key value pairs used to track model state. Chatbots and agents are inherently iterative. For multi-turn sessions, every prompt contains not only new information, but also every request and response that came before it. Recomputing all of that every time a new request is made is wasteful, so instead that information is computed, cached, and reused. The problem is at large context sizes and high concurrency, these KV caches can get rather large. A single 64,000-token sequence in a model like DeepSeek R1 can chew up four gigabytes of GPU memory. Multiply that across hundreds or thousands of users and it adds up quickly. Modern GPUs don’t have much memory, and what they do have is usually tied up hosting model weights. Many inference engines therefore support KV cache offloading, either natively or through plugins. Once GPU memory is exhausted or chat sessions stale, older chats are ejected to system memory. But DRAM is expensive, in short supply, and may not even be enough. In fact, Nvidia is reportedly cutting the amount of LPDDR5X shipped as part of its Vera Rubin platform. Because of this, KV caches where, for example, a user has walked away and the session has been idle for an hour or more, may be offloaded to flash storage arrays for longer-term storage. The problem is that KV caching is a write-intensive workload and NAND has a finite number of writes it can make before it’s shot. There's a lot of work being done to mitigate this, but the fact remains that if you write enough data to NVMe storage, eventually it wears out. Optane’s otherworldly write endurance and low latency, particularly when concerning small random writes which dominate KV-caching, would have made it a perfect choice for this workload. Optane’s successors One of the nails in Optane’s coffin was that Compute Express Link (CXL) was already on the horizon. If the primary reason for adopting Optane was to get your hands on a large pool of reasonably fast DRAM-like memory, then CXL offered all the benefits and none of the compromises. In effect, early CXL implementations were essentially a remote memory controller to which you could attach your choice of memory, DDR4 or DDR . Need more memory than your CPU supports? Just plug a CXL memory expander into a free PCIe slot and you were off to the races. Later revisions of the memory coherent protocol added support for pooling, and later sharing. However, CXL hasn’t changed the fact that DDR5 is expensive at the best of times, and we are currently living in the worst of times for DRAM prices. (With that said, while your CPU may only support DDR5, the CXL controller might still be able to use DDR4. This is exactly what Meta is doing to boost the memory capacity of its systems on the cheap.) In the absence of Optane, memory vendors have attempted to fill the void with write-optimized NAND of their own. Kioxia’s XL-Flash is one such example of storage class memory (SCM) that promises many of the same benefits as Optane, including advertised write latencies under 10 microseconds, and endurance up to 60 drive writes a day, through the use of SLC (1-bit per cell) memory. There’s also a crossover with CXL here. XL-Flash can be exposed as a CXL device to simplify memory tiering. Samsung also attempted to replicate many of Optane's qualities with its Z-NAND tech, but the tech still falls well short of 3D XPoint. Samsung is reportedly revamping the tech and aiming for a 15x performance increase over conventional NAND. Alas, neither quite lives up to Optane’s legacy. The tech was simply too far ahead of its time. Had Intel and Micron waited just a few years longer, it might have ridden the AI wave all the way to victory. ®

⚡ Quick Take

• Ryan Reynolds went undercover as… himself to San Diego Comic-Con, interacting with unknowing fans in a denim Deadpool costume.

San Diego Comic-Con 2026 brought over a hundred thousand geeks face-to-face with their favorite celebrities, some unknowingly closer than others. This weekend, without bodyguards, without an entourage, Ryan Reynolds cosplayed as Deadpool, taking photos with fans who simply thought the outfit was cool. The Deadpool actor managed to remain anonymous until the Marvel Studios event in Hall H.

The fans got Deadpool off the ground so many years ago. Yesterday, 10 years after the first film and exactly 2 years after Deadpool & Wolverine, I felt so lucky to be on the #SDCC floor with everyone whose unapologetic devotion brings so much joy to this world. pic.twitter.com/IM7DSIjNfs

— Ryan Reynolds (@VancityReynolds) July 26, 2026

During the Marvel event, Robert Downey Jr., promoting Doomsday, called on Reynolds during Q&A. As soon as he took the mic, the auditorium roared with fans’ immediate recognition of his voice.

Reynolds replied with another post, saying, “No handlers, no security, no ropes. WHAT A GIFT.” He was able to experience the event not as a celebrity but as any other convention-goer. Fans began replying in the post’s comments with photos they had taken with the actor, not knowing his identity.

It is clear from his Canada flag pin that the original intention of the suit was to imitate a “Canadian Tuxedo,” or a denim-on-denim outfit. However, he replied to a post from DiscussingFilm with an image he had created, a fictional Pantone color called “Jean Grey,” that matched the color of his suit.

Once you see it, you can’t unsee it. pic.twitter.com/rfqw4YqPcY

— Ryan Reynolds (@VancityReynolds) July 27, 2026

This was in reference to the idea that Sadie Sink’s mystery character in Brand New Day will be Jean Grey. While nobody knows whether or not this is the case, Reynolds could either be hinting at it or playing a prank. The Pantone color is unfortunately not real, according to IGN, but the number code he created refers to September 1963, when the first issue of X-Men was published.

Marvel

There has been no solid confirmation that Deadpool will appear in Avengers: Doomsday either, though it seems the movie isn’t leaving much on the table in terms of character cameos. Additionally, Deadpool and Wolverine was a very recent film, Marvel-wise, coming out two years ago. Reynolds also made two Deadpool-related statements recently. First , he essentially shut down the idea of a new Deadpool movie. But then, he said that there will “eventually” be another Deadpool movie. Whether he meant Deadpool the character or Deadpool, referring to a movie fronted by the character, remains to be seen.

Nonetheless, he mentioned that Deadpool works best on a team. Well, Doomsday is the ultimate team-up movie, so has the time ever been better to bring the sardonic antihero back? All of this considered, there is definitely still hope for Deadpool fans.

The post Ryan Reynolds Attended Comic-Con In a Denim Deadpool Suit appeared first on Nerdist.

The Agentic AI Foundation, part of the Linux Foundation, has released an update to the Model Context Protocol (MCP) that aims to help enterprises adopt AI-based automation. Open-sourced by Anthropic in November 2024, MCP provides a way for AI applications (agents) based on models like GPT-5.6 Sol or Claude Opus 5 to connect to existing data sources, tools, or other applications. It defines how content is exchanged in a client-server architecture. "The new release is MCP’s most important since remote MCP first launched over a year ago," wrote David Soria Parra, a member of technical staff at Anthropic and co-inventor of MCP, in a blog post. "It is a leap in serving scalable MCP servers and takes all the lessons learned over the last 18 months to provide a robust foundation for MCP’s future." The latest version of the specification does away with the legacy stateful architecture, making it more like HTTP services where network requests do not need to retain the state of the session. "Historically, running MCP at scale required sticky routing or shared state to maintain continuity across sessions," explained Caitie McCaffrey, a Microsoft software engineer and core MCP maintainer, in a blog post. "This made large-scale production deployments complex to implement and operate even when the capabilities being exposed were stateless." The revised protocol changes the underlying architecture to eliminate the overhead of managing session state, which allows organizations to run MCP servers behind standard load balancers on existing Kubernetes and DevOps tooling. The version 2026-07-28 release also includes a Specification Feature Lifecycle and Deprecation Policy, because large companies want clear roadmaps and timelines when it comes to software changes. "The goal is a predictable timeline that SDK authors and implementers can plan migrations against when protocol surface area is retired," the documentation explains. The revised spec comes with a new policy that guarantees a minimum period of 12 months between feature deprecation and removal, which should please enterprise engineering teams, since they'll need to make fewer updates to MCP servers. On the security front, the latest spec revision adds Specification Enhancement Proposal (SEP) 2468, which calls for the inclusion and validation of an issuer (iss) parameter in authorization responses. This should help prevent OAuth Mixup Attacks. An attack of this sort can occur when an OAuth client connects to multiple OAuth providers via multiple MCP servers. If an attacker controls one of these servers, the miscreant could potentially obtain an access token or code from one of the other servers. Checking the iss parameter defends against that particular attack vector. Large organizations should also appreciate support for the Enterprise Managed Authorization extension, which makes it possible to manage MCP servers through a central identity provider. Another improvement involves the evolution of tasks – long-running tool calls or batch operations – into an extension. The main benefit is that tasks shift from a blocking request to an asynchronous request. "The payoff is operational resilience at scale," explains McCaffrey. "Because a task is durable and addressed by a stable handle, clients can persist task IDs to durable storage so that polling can resume after a crash or restart — no fragile, long-lived connections held open while waiting for work to finish, which the old blocking model forced on clients and servers that did not want to implement it." Other notable additions include header-based routing and cacheable list results. Some migration cost is expected, particularly for developers who implemented MCP code that relies on session identifiers. ®

The World Cup may be over, but the stench of FIFA corruption remains. That’s little surprise, given the antics of FIFA President Gianni Infantino before and during the World Cup. He sought to ingratiate himself with President Donald Trump, and he’s now continuing his efforts to sully the sport of soccer by putting it all up for sale. In an announcement that seems to have surprised many of…

Source

We now have a better idea of how OpenAI's models broke out of their cages to attack Hugging Face. The rogue models found zero-day vulnerabilities in JFrog’s universal binary repository manager Artifactory around the time they escaped, according to JFrog CTO Yoav Landman. While Landman doesn’t outright admit that the JFrog flaws were the zero-days that OpenAI’s models found and exploited, ultimately allowing them to breach the massive model mart, it definitely looks and quacks like a duck - err, frog. Landman says OpenAI's models discovered the Artifactory zero-days during a security evaluation. The AI giant notes the incident occurred while its models were being evaluated on the ExploitGym benchmark. “During a security evaluation, OpenAI’s models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access,” Landman said on Monday. JFrog Artifactory is a central platform that organizations use to store and distribute all the software artifacts across their supply chains. It supports more than 60 package formats including Docker, Maven, npm, PyPI, Helm, and AI/ML models. OpenAI “responsibly and immediately” disclosed the vulnerabilities to JFrog, Landman continued. “Our security team treated the report with the urgency it deserved, as a genuine zero-day unknown to the world, and moved accordingly. We developed, validated, and released a fix for all JFrog customers, self-hosted and cloud alike.” On Monday, JFrog released the fixed versions, and credited OpenAI researchers for reporting at least eight of the now-patched Artifactory vulnerabilities: CVE-2026-65617, CVE-2026-65925, CVE-2026-65921, CVE-2026-65923, CVE-2026-66018, CVE-2026-66014, CVE-2026-66015, and CVE-2026-65924. The Register asked JFrog whether at least some of these were abused by OpenAI’s rogue models to access the internet and compromise Hugging Face, but the DevOps firm isn’t talking. JFrog's admission comes about a week after OpenAI said two of its models, GPT-5.6 Sol and a second pre-release model, escaped their testing sandbox during a security evaluation designed to test their cyber capabilities. During this test, the models found a way to access the open internet, then broke into Hugging Face and accessed private information and stole some credentials. “While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem,” OpenAI said on July 21. “To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy.” The Register also reached out to OpenAI and asked if JFrog is the vendor referenced in its blog, but did not receive any response. Luckily, your humble vulture is headed to Vegas in a week for Hacker Summer Camp, so we will be sure to test our betting prowess in the appropriate environment. Without guardrails, of course. ®

ph @l_e_ba
#365cafésoupresque

Fox News host Trace Gallagher is trying to justify the killing of a Houston father by immigration agents—the latest example of the network’s central role in propping up the Trump administration’s most atrocious actions. Just a week after the July 7 shooting of Lorenzo Salgado Araujo during a traffic stop, Gallagher said on “Fox News @ Night” that the killing was justified because authorities…

Source