Intro
Hello everybody. This is Episode-26 of FalseTrue Digest.
Here is a fresh set of links I’ve been collecting. Wild month — an OpenAI agent broke out of its sandbox and hacked Hugging Face, a 15-year-old kernel bug finally got a public exploit, and the open-source AI scene is on fire. Enjoy.
Stories
https://www.legacy.com/legacy/robert-bobby-prince-lll - Robert Prince composer of Doom and Duke Nukem sound tracks died at 81.
https://en.wikipedia.org/wiki/John_C._Dvorak - the famouse tech journalist and podcast John C. Dvorak died at 80.
https://hackaday.com/2026/06/29/hackaday-europe-2026-building-a-retro-pc-from-scratch/ - Sprite_tm at Hackaday Europe showing how he built a retro gaming PC from scratch around an AMD Elan SC520, an FPGA and an ESP32. Targeting 1995 vibes
https://news.ycombinator.com/item?id=48884984 - Ask HN: What are you working on? (July 2026) — always worth browsing, roguelite games, RF monitoring rigs, and the usual side project chaos
https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/ - FBI seized hundreds of NetNut domains. Turns out two million smart TVs and streaming boxes were silently proxying traffic for cybercriminals via the Popa botnet
https://krebsonsecurity.com/2026/07/felons-fraudsters-flog-offensive-cybersecurity-startup/ - Krebs digs into an offensive cybersecurity startup that turned out to be run by felons and fraudsters
Programming
https://fyrox.rs/blog/post/fyrox-game-engine-1-0-0/ - Fyrox hit stable 1.0.0 after seven years. Rust-based 2D/3D game engine with its own editor, export CLI, and a freshly updated book
https://blog.jetbrains.com/idea/2026/07/java-annotated-monthly-july-2026/ - Java Annotated Monthly for July — big news is Project Valhalla’s Value Classes (JEP 401) confirmed for JDK 28
https://lwn.net/Articles/1080835/ - LWN on the kernel community figuring out how to deal with large LLM-assisted patch sets from established devs. New territory for code review
https://forgejo.org/2026-01-release-v14-0/ - Forgejo v14.0 shipped with inline issue filters, CodeMirror replacing the old web editor, and stateless CSRF protection
Emacs
https://sachachua.com/blog/2026/07/2026-07-27-emacs-news/ - Sacha Chua’s Emacs News for July 27, Emacs Carnival theme this round is “Programming”, plus new MELPA stuff
https://lists.gnu.org/archive/html/emacs-devel/2026-07/msg00270.html - Emacs 31.0.91 pretest dropped. Legacy unexec dumper is gone, flex completion got rewritten, new window layout commands, Unicode 17.0
https://en.andros.dev/blog/06bfd107/emacs-is-a-lispboard/ - “Emacs is a Lispboard” — nice post comparing Emacs to an electronics breadboard where every Lisp module shares the same bus. Makes the case that the web browser is its real rival
https://sachachua.com/blog/2026/07/2026-07-13-emacs-news/ - July 13 Emacs news with some cool new packages: blamee for chunked git-blame, hnview (HN client in Emacs), org-mindmap, and moonbit-ts-mode
AI
https://simonwillison.net/2026/Jul/22/openai-cyberattack/ - Simon Willison’s writeup on OpenAI accidentally hacking Hugging Face. Their models escaped a sandbox, found a zero-day, and broke into HF prod to cheat on a benchmark. Unreal story
https://huggingface.co/blog/agent-intrusion-technical-timeline - Hugging Face published the full technical timeline of the intrusion — how the agent moved laterally through their clusters over a weekend
https://www.kimi.com/blog/kimi-k3 - Moonshot AI dropped Kimi K3, 2.8 trillion parameters, largest open-weight model so far. 93.5% on GPQA Diamond, record scores on BrowseComp
https://huggingface.co/blog/ResterChed/kimi-k3-model-overview-mxfp4-quantization-open-wei - Good technical overview of Kimi K3 internals — LatentMoE only fires 16 of 896 experts per token, MXFP4 quantization, what the open weights actually mean
Security
https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html - GhostLock (CVE-2026-43499) — use-after-free in the kernel futex PI locking code that’s been sitting there for 15 years. Any local user gets root in about five seconds. PoC is public, every major distro since 2011 was affected
https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/ - FBI and Google took down the NetNut residential proxy network, two million compromised home devices being used by criminals and espionage groups
https://thehackernews.com/2026/07/openai-agent-used-exposed-credentials.html - More on the HF breach — the escaped OpenAI agent grabbed exposed credentials from four different services and chained them together
https://huggingface.co/blog/security-incident-july-2026 - Hugging Face’s official incident disclosure. Interesting detail: their own LLM-based triage system is what caught the intrusion
Unix, Linux, BSD and free software scene
https://lwn.net/Articles/1079892/ - Linux 7.2-rc1 is out. Busiest merge window since 6.7 with 13,412 non-merge commits. Final 7.2 should land around August 16-23
https://fossforce.com/2026/07/oopsies-freebsd-devs-say-theres-still-gpl-in-the-kernel/ - FreeBSD thought they removed all GPL code when they swapped dialog for bsddialog… then found GPL bits still in the kernel, including a Linux header for Qualcomm SoCs. Oops
https://www.phoronix.com/news/FreeBSD-Q2-2026 - FreeBSD Q2 2026 status report — working on a BSD-native NTSYNC driver for Wine gaming (matching Linux perf), plus a Foundation intern is porting AMD ROCm
https://lwn.net/Articles/1079457/ - LWN on LLMs in the kernel, famfs, sched_ext, and efforts to harden the kernel with allocation tokens
Marginal, Indie, Selfhosted
https://github.com/perminder-klair/subwave - SUB/WAVE just hit 1.0 — point it at your Navidrome/Subsonic library and it gives you a 24/7 internet radio station with an AI DJ, weather updates, listener requests. Runs on local LLMs via Ollama
https://selfh.st/weekly/2026-07-31/ - Self-Host Weekly for July 31
https://selfh.st/weekly/2026-07-24/ - Self-Host Weekly for July 24 — Vikunja got its first pro features, Immich landed on F-Droid, Dawarich added a poster studio
https://selfh.st/weekly/2026-07-17/ - Self-Host Weekly for July 17, new selfh.st Insiders perks with free plans for Karakeep, ntfy, Papra, WebGazer