Check Point VPN Flaws CVE-2026-85102 and CVE-2026-85103 Face Imminent Mass Exploitation

Two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, have been discovered in Check Point Security Gateway, Security Management Server, and Spark Firewall products, both carrying a CVSS score of 9.8. The flaws reside in VPN certificate processing and allow unauthenticated attackers to execute arbitrary code remotely without requiring any user interaction. The Dutch National Cyber Security Centre issued a warning on September 12, 2026, assessing the risk as high and predicting large-scale exploitation attempts are imminent, though no confirmed active exploitation has been reported yet. CVE-2026-85102 targets improper certificate validation during VPN negotiation, while CVE-2026-85103 involves a heap overflow in ASN.1 decoding, potentially compromising both gateways and management servers. Check Point has released patches, and organizations are urged to immediately identify affected devices, apply fixes, and monitor for anomalous VPN negotiation traffic or unexpected process crashes.

Break-in attempt at ex-US VP Kamala Harris' Malibu house

Don't call yourself an artisanal programmer

Article URL: https://purplesyringa.moe/blog/dont-call-yourself-an-artisanal-programmer/ Comments URL: https://news.ycombinator.com/item?id=49679360 Points: 5 # Comments: 3

Mumbai cleaner jailed 1 year for forcibly kissing saleswoman, court rejects accident claim

A Mumbai court has convicted a cleaner for forcibly kissing a saleswoman on two occasions. The accused had claimed he had accidentally slipped and fallen onto the victim, but the court rejected this defence. Judicial findings confirmed the act was deliberate, involving criminal force and sexual intent. The convict was sentenced to one year of rigorous imprisonment along with a monetary fine. The case was prosecuted under the newly enacted Bharatiya Nyaya Sanhita laws.

AI Trading System Uses NLP to Detect Hidden LLM Doubts Before Executing Crypto Trades

A developer building an AI-driven cryptocurrency trading system discovered that large language models can output confident structured decisions while their internal reasoning logs contain subtle hesitations and warnings. The team found that standard structured JSON outputs — such as a confidence score of 0.85 — mask critical contextual differences between a sound trade setup and a high-risk momentum chase. To address this blind spot, they built a component called the F-072 Semantic Risk Parser, which intercepts the LLM's unstructured chain-of-thought text and applies NLP and regex patterns to detect hidden risk signals. In one documented instance, the system identified such implicit warnings and blocked a leveraged long position on NEARUSDT moments before the market sharply reversed, preventing a significant portfolio loss. The approach highlights a broader challenge in algorithmic AI trading: relying solely on structured model outputs can create a false sense of certainty, while the model's own reasoning process may tell a more cautious story.

CIA releases 9/11 anniversary documents showing Bin Laden targeted India pre-attack

The CIA has declassified over 70 presidential intelligence briefs related to Osama Bin Laden, comprising more than 100 pages of materials. The release was made to mark the 25th anniversary of the September 11, 2001 attacks on the World Trade Centre in New York City. Among the revelations, the documents indicate that India was on Bin Laden's hit list prior to the 9/11 attacks. The declassified briefs offer new insight into the intelligence community's awareness of Bin Laden's targets and intentions in the period leading up to the attacks.

Carlsen suffers first GCL 2026 loss as Firouzja's Kings upset APL Pipers

Magnus Carlsen lost his first match of GCL 2026 as Alireza Firouzja led Triveni Continental Kings to a victory over APL Pipers. Despite the upset, the result did not change the overall standings in the tournament. American Gambits briefly rekindled their qualification hopes before falling to the Pipers in a subsequent match. Indian player Nihal Sarin's time forfeit effectively ended American Gambits' bid to reach the finals. The team will now face Mumba Masters in a third-place playoff on Sunday.

AI Reply-Length Safety Check Missed Its Target for Three Weeks Due to Routing Bug

A software team discovered on September 5, 2026, that an automated length-diversity check built to catch suspiciously uniform AI-generated replies had never actually run on the batches it was meant to guard. The check was written in August 2026 to apply only to self-reviewed replies, based on the assumption that independently reviewed replies were already adequately scrutinized. However, the flagged replies had all been reviewed by a separate model instance — a subagent — causing the filter to return an empty list and the audit to silently pass. A human reviewer, the shop owner, spotted the problem by noticing that three replies destined for Bluesky were all nearly the same length despite covering different conversations. The incident revealed a structural flaw: batch-level properties like length uniformity are invisible to single-reply reviewers, meaning independent review and batch-level auditing must be treated as separate, non-substitutable safeguards.

Brics declaration: India’s readout skips mention of Xi’s ‘partners, not rivals’ statement

Thousands protest in Erfurt to block AfD annual conference amid rising far-right influence

Large crowds gathered in Erfurt, Germany, to physically block access to the Alternative for Germany (AfD) party's annual conference. The demonstrations reflect growing public opposition to the far-right party's political agenda. The AfD has been leading in national opinion polls and is targeting gains in upcoming elections in eastern German states. Mainstream political parties have maintained a strategy of non-cooperation, refusing to form any alliances with the AfD. The protests highlight escalating tensions surrounding the party's expanding influence in German politics.

Alan Ritchson and Wife Catherine Split After Nearly 20 Years of Marriage

Actor Alan Ritchson, known for his role in 'Reacher', and his wife Catherine have officially confirmed their separation after close to two decades together. The couple, who met as teenagers and married in 2006, share three sons together. Despite the split, both have stated that maintaining their friendship remains a priority, particularly for the sake of their children. Ritchson had first filed for divorce in December, though the couple briefly reconciled in March before ultimately parting ways. The two have asked the public to respect their privacy as they move through this transition.

tokeneff: Open-Source CLI Tool Tracks LLM API Costs Locally in Real Time

Developers have released tokeneff, a free open-source command-line tool that monitors large language model API spending in real time without sending data to external servers. The tool runs a lightweight local proxy on localhost:7860, intercepting LLM responses to count tokens and calculate costs using a bundled pricing table stored in a local SQLite database. It supports multiple providers including OpenAI, Anthropic, DeepSeek, and GLM, and separately tracks spending in USD and CNY to avoid mixing costs across regions. A standout feature is its month-end spending forecast, which uses a weighted algorithm combining seven days of usage history and linear extrapolation to predict total monthly costs with a confidence score. API keys are stored in the OS keyring and prompt content is never logged, making it a privacy-focused alternative to cloud-based cost trackers.

Volunteers Clear Over Two Tonnes of Waste, Including Medical Debris, Near Bengaluru's Turahalli Forest

MP-based activist Bittu Tabahi participated in a clean-up drive near Turahalli forest in Bengaluru for the first time. He and other volunteers were shocked to discover poultry waste, domestic garbage, dog carcasses, and medical waste dumped at the forest's edge. The team collectively removed more than two tonnes of waste during the drive. Environmentalist AN Yellappa Reddy noted that the area once served as an important water catchment zone. The initiative was organized to spotlight growing environmental pollution and encourage greater civic responsibility among residents.

OpenAI Uses AI to Block Unsafe Code Merges, but Blind Spot Risk Remains

OpenAI has deployed a dedicated AI code-review model that automatically blocks pull requests flagged as security risks, with no human override allowed. Thibault Sottiaux, engineering lead for the Codex team, described the system on The Pragmatic Engineer podcast, claiming the model performs at a superhuman level in detecting logic errors and vulnerabilities. Beyond security, the same AI handles regression detection, dependency updates, and large-scale refactoring tasks that would otherwise take engineering teams months. However, critics point out a structural blind spot: if AI writes the code and AI reviews it, both systems may share identical failure modes. A vulnerability missed by the writing model could pass the review model undetected, creating a false sense of security that may be more dangerous than having no automated review at all.

Recursive CTEs Explained: The SQL Feature That Handles Unlimited Hierarchy Levels

Recursive Common Table Expressions (CTEs) solve a longstanding SQL limitation: traversing hierarchical data of unknown depth, such as org charts, category trees, or folder structures. A recursive CTE consists of two parts joined by UNION ALL — an anchor member that defines the starting row and a recursive member that repeatedly joins back to the CTE's own output until no new rows are returned. The technique works in PostgreSQL, SQL Server, and MySQL 8.0 or later, but is unsupported in older MySQL versions. Developers should use UNION ALL rather than UNION to avoid costly deduplication, and must guard against cyclic data — where relationships loop back on themselves — by tracking visited IDs or capping recursion depth. While powerful, recursive CTEs recompute the full traversal on every query, so alternative design patterns may be preferable for very large or frequently queried hierarchies.

OpenProfile.md 0.2 lets users answer dating profile questions once, own the data

OpenProfile.md, an open Markdown standard served from a user's own domain, has released version 0.2 with a new Match section designed to eliminate repetitive data entry across dating platforms. The update allows users to fill in personal attributes — such as age, gender, orientation, height, and relationship preferences — a single time in a file they fully control. Any dating platform can then read the file directly, removing the need to re-enter the same information on Hinge, Bumble, or similar services. The specification includes a strict rule requiring a valid Born field confirming the user is 18 or older before a profile can appear in any matching context, and platforms are prohibited from inferring sensitive fields like orientation or ethnicity from external sources. Version 0.2 is published under CC BY 4.0 at logicsrc.com/docs/openprofile and is intended to be hosted at a well-known URL on the user's own domain.

Browser Tool Converts GLB to STL for 3D Printing Without Uploading Files

Developer Casey Marlin has built STL Mesh, a browser-based tool that converts GLB files — the standard export format from AI 3D generators like Meshy and Tripo — into STL files compatible with 3D printing slicers. Unlike most online converters, the tool processes files entirely on the client side using a Web Worker powered by three.js, meaning no data is sent to external servers. The converter handles GLB parsing, transform baking, and binary STL encoding, and also supports other format pairs including OBJ, FBX, SVG, and STL conversions. A key feature is a bounding box preview that helps users catch a common unit mismatch, since glTF files use meters while slicers interpret STL units as millimeters. The tool is freely available at stlmesh.com and requires no software installation.

How to Structure a Freelance Web Portfolio for Clarity and Usability

A well-organized freelance portfolio should immediately answer three questions for visitors: what the designer does, what work they can show, and how to contact them. İzmir-based freelance web designer Ben Can Taşkın outlines a simple content plan for presenting web design services clearly, recommending that the primary service be stated upfront while secondary offerings appear in subsections. Each project card should include the project name, its scope, and a link — without unsupported claims like unverified conversion rates or traffic figures. The article also emphasizes using proper HTML heading structure for content hierarchy rather than visual styling alone, and ensuring the layout works with real content on small screens. For multilingual portfolios, separate language sections with naturally translated text are advised over cramming multiple languages into a single heading.

Modi-Xi talks put India-China thaw to the test

Babar Azam urges Pakistan to reflect after 3-0 Test series whitewash by England

Pakistan captain Babar Azam has called for honest self-assessment after his side suffered a 3-0 Test series defeat against England. Babar stressed the need to reassess the squad composition and identify the strongest possible playing eleven. Despite the overall result, the final Test offered some positives, particularly through the batting contributions of debutant Razaullah. The series loss has pushed Pakistan to the bottom of the World Test Championship standings.