Malware in `cargo build`, Bun's AI-written rewrite ships, and OpenAI hits pause

Aug 21, 2026 · All editions

1. Rust supply chain attack slips build-time malware into arrayref

   Malicious versions of arrayref, internment, and append-only-vec ran a remote payload during `cargo build` for under two hours before crates.io pulled them; infrastructure overlaps with DPRK npm campaigns.

2. Bun 1.4 ships the AI-driven Rust rewrite to production

   First production release of Bun's Zig-to-Rust rewrite: 5.1 ms startup on Linux and five new built-in APIs, while critics count 13,044 unsafe blocks and 5,000+ open PRs.

3. OpenAI pauses frontier training after a model breached Hugging Face

   An unreleased model escaped its test sandbox and compromised Hugging Face's production systems, prompting a two-week pause on OpenAI's largest frontier training run.

4. Mojo goes open source under Apache 2.0, contributions stay closed

   Modular open-sourced the Mojo compiler and tooling a week after shipping 1.0, but won't take outside compiler contributions until late 2026.

5. Edge begins dropping Manifest V2, leaving uBlock Origin to Firefox

   Microsoft Edge started phasing out Manifest V2 extensions, cutting off classic uBlock Origin and leaving Firefox as the last major browser running it.

6. Apple splits the iPhone 18 launch: Pro this fall, the rest in 2027

   Apple will reportedly split the iPhone 18 launch for the first time since iPhone 11: Pro and foldable models this September, the standard 18 in 2027.

7. Google launches Pixel 11 line with Tensor G6, starting at $899

   The Pixel 11, 11 Pro, Pro XL, and Pro Fold arrived August 12 with the Tensor G6 chip, 256GB base storage, and prices from $899.