Rust maintainers hunted by fake job calls, an AI IDE uploaded whole Git histories, and Git 3.0 sets a date with SHA-256
Three stories this week are about the same thing from different angles: the people, the login pages and the tools around your code are easier to attack than the code itself. The rest of the week was quieter and more useful - faster kernel builds, a date for Git's breaking changes, and a very cheap way to send audio to a model.
Rust warns maintainers about fake job video calls
Attackers are booking friendly video calls about jobs and contracts with crate owners, then asking them to install a "missing audio codec" or paste a command. The Rust security teams link the campaign to August's arrayref compromise.
ZCode uploaded whole Git histories; Zhipu apologizes
An analysis found Zhipu's coding tool packaging entire workspaces, `.git` included, and shipping them to cloud storage users cannot decrypt. One snapshot: 313MB, 42,411 files, 86.6% of it Git history. Zhipu apologized and promised an open-source release and an external audit.
OpenAI monorepo reached via libheif and SSO flaws
Three Hacktron researchers chained an image-decoder bug in OpenAI's Discourse forum with an identity misconfiguration, then had an employee's Codex agent open a pull request in the internal monorepo. OpenAI paid $6,500.
Linux 7.4 kbuild patches cut kernel build times
Arm's Lorenzo Stoakes used an LLM to find single-threaded bottlenecks in the kernel build, then audited and rewrote the output. No-op builds drop by 74 to 82 percent depending on the machine.
Jemalloc 5.4.0 ships 160 commits after Meta revival
The first real movement in years: over 160 commits, a new OS abstraction layer, per-CPU arena selection and GCC 16 fixes. It is a maintenance release, and that is the point.
Qwen3.8-Omni-Flash cuts audio input costs by 98%
Alibaba's omnimodal model takes text, images, audio and video across a 1M-token context. It is API-only, with no open weights, unlike the model whose architecture it borrows.
Git 3.0 will default to SHA-256 and require Rust
Git 2.56-rc0 landed on September 11. The release behind it switches new repositories to SHA-256, reftable and `main`, and makes Rust a build requirement. Check your `varchar(40)` columns.
Meta's Muse agent lands on the Mac with file access
Per-app consent, approval before sensitive actions, and an audit log. That permission model is now the baseline your own agent features get compared against.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.