AI
OpenAI launches Codex Security plugin powered by GPT-5.6 Sol, claims top cybersecurity benchmark
OpenAI announced that GPT-5.6 Sol has achieved state-of-the-art performance on "The Last Ones" cyber range benchmark, and is now available for practical defensive use through a new Codex Security plugin. The plugin, available directly inside Codex, lets development teams scan folders of real-world code for vulnerabilities, validate findings, and apply fixes — positioning OpenAI's coding agent as a security tool, not just a productivity one. Sam Altman flagged the launch approvingly, and the company highlighted thousands of community use cases for GPT-5.6 Sol alongside the announcement.
Setup requires adding the Codex Security plugin within the Codex interface, after which users are prompted to select a folder and run a preconfigured security scan. The step-by-step rollout suggests OpenAI is pushing Codex toward enterprise security workflows, a market where rivals like Google and Anthropic are also actively competing.
Consumer Tech & Gadgets
Apple raises iCloud+ prices in multiple countries
Apple has increased iCloud+ subscription prices across several countries, a move that will directly hit consumers who rely on the service for device backups, photo libraries, and iCloud Mail. The price hike follows a broader industry trend of cloud storage services raising rates, and comes as Apple continues to push iCloud as a central part of its ecosystem.
New macOS ClickFix malware targets enterprise Macs with backdoor attack
A newly identified macOS malware strain using the ClickFix technique is posing a growing threat to enterprise fleets, according to 9to5Mac's Apple @ Work column. The attack method tricks users into executing malicious commands themselves, effectively bypassing standard security prompts and potentially opening a backdoor into corporate networks running Macs.
Google open-sources its 3D emoji library
Google has open-sourced its library of 3D emoji, making the expressive, polished assets freely available to developers and designers. The move could significantly expand where and how these emoji appear across third-party apps and platforms, giving the broader Android and web ecosystem access to visuals that were previously exclusive to Google products.
Dev Tools & Infrastructure
Nuxt 4.5 ships Vite 8, Rspack 2, and experimental SSR streaming
Nuxt released version 4.5 with a substantial set of upgrades: Vite 8 and Rspack 2 (now powered by Rsbuild) replace the previous build tooling, and experimental SSR streaming lands to reduce time-to-first-byte. The release also adds a stable error code system, a new useLayout composable, and named views support. The team described it as heavy groundwork toward Nuxt 5.
Cloudflare deploys emergency WAF rules for two critical WordPress RCE and SQLi vulnerabilities
Cloudflare pushed Web Application Firewall protections for two critical WordPress vulnerabilities — an unauthenticated remote code execution flaw and a SQL injection bug — before their public disclosure. Sites proxied through Cloudflare get immediate exposure reduction, but patches are required: fixes shipped in WordPress 7.0.2, with backports to 6.9.5 and 6.8.6.
Vercel makes Sandbox inbound data transfer free and expands Kimi Code integration
Vercel removed data transfer charges for inbound traffic to its Sandbox environment, meaning developers can clone Git repositories, install packages, and pull external datasets at no cost. Separately, Vercel's developer plugin is now available inside the Kimi Code CLI, giving the agentic coding tool on-demand access to Vercel platform knowledge covering Next.js, the AI SDK, and Vercel Functions.
Gaming
Call of Duty movie set in Modern Warfare universe, arriving June 2028
A Call of Duty film has been officially confirmed, with Geoff Keighley announcing it will be set in the Modern Warfare universe and is slated for a June 2028 theatrical release. The announcement marks one of the more significant video game IP adaptations revealed this year, bringing one of gaming's best-selling franchises to the big screen for the first time.
Dead Space creator Glen Schofield retires from the gaming industry
Glen Schofield, the developer behind the original Dead Space and more recently The Callisto Protocol, has announced his retirement from the gaming industry. Schofield was a foundational figure in survival horror game design, and his exit marks the end of a decades-long career that shaped the genre.
Security
WordPress wp2shell RCE flaws get CVEs and public exploits — patch to 6.9.5, 7.0.2, or 7.1 beta2 now
A pair of chained WordPress core vulnerabilities — now assigned CVE-2026-63030 and CVE-2026-60137 — allow any anonymous attacker to execute arbitrary code on unpatched sites without needing a single plugin installed. The first flaw breaks REST API batch routing; the second injects SQL. Together they yield full remote code execution on WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, while sites on 6.8.0 through 6.8.5 face SQL injection alone. A working proof-of-concept is now public, though no active exploitation had been confirmed as of July 18.
The full RCE path only succeeds when WordPress is not using a persistent object cache such as Redis or Memcached — a condition that matches the vast majority of default installs. Fixed releases are 6.9.5, 7.0.2, and 7.1 beta2. Until patched, defenders can reduce exposure by blocking anonymous access to both REST batch routes.
OpenSSL patches HollowByte memory-freeze flaw triggered by an 11-byte TLS request
OpenSSL has quietly shipped a fix for a vulnerability dubbed HollowByte, in which a crafted 11-byte TLS request can cause a server to reserve up to 131 KB of memory per connection. On glibc-based systems tested by researchers, that memory remained frozen and unrecoverable until the server was restarted, making the flaw a practical denial-of-service vector against high-traffic TLS endpoints. The fix was included without prominent advance notice.
Abbott Laboratories investigates two cyber incidents amid extortion claims
Medical device and diagnostics giant Abbott Laboratories has confirmed it is probing two separate cyber incidents after extortion claims emerged. No further details on the nature of the incidents, the data potentially involved, or the threat actors making the claims have been disclosed publicly.
Startups & Funding
Paul Graham warns young founders: inexperience leads to hiring smart jerks
Paul Graham flagged one of the more overlooked dangers of founding a company too early: the inability to hire well. In a widely shared post, he argued that young founders can assess technical skill but lack the life experience to read character, which leads them to bring on smart people who are nonetheless toxic. His fix is blunt — either develop that judgment yourself, or lean on someone who already has it. Graham noted he would never hire anyone his partner Jessica disapproved of, treating her read on character as a hard veto.
Graham followed up with a practical suggestion for founders who recognize the gap: delegate the vetting to a trusted person with a strong track record of reading people, rather than relying solely on their own instincts.