AI
OpenAI launches ChatGPT Health and brings Voice to the desktop app
OpenAI rolled out two significant ChatGPT expansions on Thursday. ChatGPT Health is now reaching U.S. users, letting them securely connect Apple Health data and supported medical records so the model can contextualize results, track changes over time, and hold more informed conversations. OpenAI said more than 300 million people already bring health-related questions to ChatGPT each week, and the feature was built with input from hundreds of physicians who helped measure accuracy, safety, and communication.
Separately, ChatGPT Voice is now available in the desktop app globally, powered by GPT-Live. Users can speak to control their computer and direct multiple agents running inside ChatGPT Work or Codex simultaneously, with the model able to listen, speak, and coordinate tasks in parallel. OpenAI developers also confirmed that Sites Analytics has entered public testing, giving Codex-published websites basic performance metrics.
Google DeepMind unveils Gemini 3.5 Flash Cyber, a security-specialized lightweight model
Google DeepMind announced Gemini 3.5 Flash Cyber, a lightweight model purpose-built for security teams to detect and patch vulnerabilities before they are exploited. The model is designed for speed and efficiency, allowing analysts to evaluate significantly more code paths than with general-purpose models. DeepMind said internal testing on its own codebases, including Chrome and Android, showed the model consistently caught complex, novel vulnerabilities that standard models missed. Given its sensitivity, the rollout is starting with a limited-access pilot for governments and trusted partners.
Consumer Tech & Gadgets
Ford's CarPlay deal with Apple looks like a scaled-back version of CarPlay Ultra
A new Apple-Ford in-car integration announcement is drawing skepticism from tech journalists who see it as CarPlay Ultra in all but name — with the parts automakers found most threatening quietly stripped out. Joanna Stern noted the deal looks like CarPlay Ultra minus exactly the features carmakers pushed back on, and separately pointed out that Ford CEO Jim Farley — who she had interviewed previously and who expressed hesitancy about CarPlay Ultra — appears to have negotiated a more favorable arrangement for the automaker. The episode highlights the ongoing tension between Apple's ambitions to dominate the in-car software experience and automakers' reluctance to cede control of the dashboard.
OpenAI's ChatGPT Health rolls out broadly with Apple Health integration
OpenAI has relaunched and expanded ChatGPT Health, its Apple Health-connected feature, making it available to all US users aged 18 and older. The Verge noted that OpenAI is making significant claims alongside the rollout, while 9to5Mac reported the feature now offers expanded access compared to its earlier limited release. The move brings AI-assisted health data analysis to a much wider audience and marks one of the more consequential consumer integrations between a major AI platform and Apple's health ecosystem.
Design
Webflow MCP 2.0 ships with screenshot-to-component AI, full CSS variable access, and no bridge app
Webflow released MCP 2.0, a meaningful upgrade to its AI agent layer. The headline feature lets users point an agent at a screenshot and receive back a fully formed Webflow component complete with props, variants, and CMS bindings pulled from the existing design system. The update also adds full CSS variable access, site-level agent instructions, and analytics querying, while eliminating the bridge app requirement for most workflows — a friction point that had frustrated developers since the tool's original launch.
Dev Tools & Infrastructure
Vercel AI Gateway expands with live audio transcription and free Ling 3.0 Flash model access
Vercel's AI Gateway picked up two notable additions in the same briefing window. The platform now supports live audio transcription via a streamTranscribe method in the AI SDK, letting developers pipe in audio streams and receive real-time transcripts for voice agent use cases. Separately, Ling 3.0 Flash, a mixture-of-experts model from AntLing AGI designed for agentic workflows with both thinking and non-thinking modes, is available free on AI Gateway through August 3. Guillermo Rauch highlighted the pace of iteration, calling it "unreal product velocity."
React Router patches five security vulnerabilities including a high-severity DoS in v7.18.0
Five security vulnerabilities were disclosed in React Router today, one rated High severity for denial-of-service exposure. All five are resolved in react-router 7.18.0, which is available now. Netlify flagged an additional wrinkle for its users: old deploy previews remain live until explicitly deleted, meaning teams need to actively clean up stale environments to eliminate exposure even after upgrading.
Supabase adds one-click Grafana Cloud integration covering 200-plus metrics on all plans
Supabase has launched a one-click Grafana Cloud integration directly from its dashboard, shipping a pre-built dashboard that tracks more than 200 metrics with authentication and metric scraping fully pre-configured. The integration is available on every Supabase plan, including the free tier, lowering the bar for teams that want production-grade observability without manual setup.
Gaming
Marvel's Wolverine gets September 15 launch date and SDCC story trailer with new lore details
Insomniac's Marvel's Wolverine officially locked in a September 15 PS5 launch date at San Diego Comic-Con, where PlayStation unveiled a new story trailer and hosted a panel packed with lore reveals. Game director Mike Daly confirmed that the X-Men do not exist in this universe — instead, Logan is part of a covert unit called Team X alongside Sabretooth and Mystique — and that the character has lost his memories, a narrative thread Daly says shaped every gameplay decision to ensure Logan's personality comes through in player actions. A prequel comic explaining why Logan left Team X was also distributed at the Marvel booth.
Sony also announced a costume crossover tying Marvel's Wolverine to the upcoming fighter Marvel Tōkon: Fighting Souls — each game will receive a suit inspired by the other. At the same SDCC panel, Tōkon revealed Phoenix Cyclops, voiced by Ray Chase, as the first Year 1 DLC character, and released an opening movie teasing the game's Episodes story mode, in which The Champion serves as the central villain.
Nintendo launches Splatoon Raiders-themed Joy-Con 2 controllers in Blue and Light Yellow
Nintendo of America has released Deep Cut-inspired Blue and Light Yellow Joy-Con 2 controllers to coincide with Splatoon Raiders on Nintendo Switch 2, available now at Nintendo New York, Nintendo San Francisco, and the Nintendo online store. The company also added a Splatoon Raiders soundtrack to the Nintendo Music app at launch.
Security
Russian state group LAUNDRY BEAR exploited Zimbra zero-click flaw for five months to steal email and credentials
A Russian state-supported espionage group tracked as LAUNDRY BEAR exploited a Zimbra Collaboration Suite zero-day, CVE-2025-66376, for at least five months, stealing passwords, two-factor authentication recovery codes, organization directories, and 90 days of archived mail — all triggered simply by a victim viewing a malicious email with no link or attachment required. CISA issued an advisory urging organizations to patch ZCS immediately, warning that just opening a vulnerable webmail session is enough to trigger full data exfiltration.
BleepingComputer and The Hacker News both published detailed breakdowns of the campaign, dubbed ZimReaper, describing how the zero-click exploit gave attackers persistent, silent access to high-value government and organizational inboxes across the five-month window before discovery.
Claude Cowork VM escape via CVE-2026-46331 lets attackers reach host Mac filesystem
Researchers disclosed a vulnerability chain called SharedRoot that allows a single malicious prompt sent to Claude Cowork to break out of its Linux VM sandbox and access files on the host Mac. The attack uses CVE-2026-46331 to gain guest root inside the VM, then pivots through Cowork's read-write host mount to reach the broader filesystem, turning a sandboxed AI coding environment into a full host-access exploit.
583 malicious GitHub Actions workflows weaponized against cPanel servers to harvest cloud keys and secrets
Attackers planted 583 malicious GitHub Actions workflows that turned GitHub-hosted runners into an attack platform targeting cPanel and WHM servers vulnerable to CVE-2026-41940. The campaign systematically hunted for cloud access keys, API tokens, and SSH credentials stored on exposed servers, effectively converting a trusted CI/CD platform into attack infrastructure at scale.
Startups & Funding
a16z profiles Harvard dropouts who bet on AI inference chips before ChatGPT existed
Andreessen Horowitz is spotlighting Etched, the AI inference chip startup founded by Harvard dropouts Gavin Uberti, Robert Wachen, and Chris Zhu, noting they placed their bet on purpose-built inference silicon in 2022, months before ChatGPT put AI on the mainstream map and years before Cursor, Claude Code, and Codex made the inference market obvious. The firm's write-up frames the founding decision as near-irresponsible at the time, a framing that doubles as implicit validation of the contrarian thesis now that the market has caught up.
YC makes pitch to scientists and researchers ahead of Fall 2026 application deadline
Y Combinator is actively recruiting scientists and researchers in the final stretch before its Fall 2026 batch application deadline on July 27th, arguing that skills like running experiments, tackling hard problems, and persisting through failure are strong founder preparation. The push features former NASA researchers who became YC founders, and is paired with a broad reminder that no business background is required to apply.