Lawmakers Demand Criminal Probe of RFK Jr. Over Alleged Senate Lies

Robert F. Kennedy Jr. is facing calls from lawmakers for a criminal investigation and removal from office over allegations that he lied to the Senate. The controversy is linked to his history of spreading vaccine misinformation, including a reported trip to Samoa where he stoked fears about vaccines. Following his visit, Samoa experienced a devastating measles outbreak that killed 83 people. Critics argue his anti-vaccine advocacy directly contributed to the conditions that enabled the deadly outbreak. Legislators are now pushing for formal accountability measures against Kennedy.

India flags 200 high-risk Himalayan glacial lakes amid growing GLOF threat

India is home to approximately 7,500 Himalayan glacial lakes, of which around 200 are considered high-risk for glacial lake outburst floods (GLOFs). A recent GLOF disaster in Nepal has renewed concerns about similar threats facing India. The Sikkim GLOF incident previously caused severe destruction, underscoring the need for urgent preventive action. In response, the Indian government has launched a National GLOF Risk Mitigation Programme. The initiative focuses on risk assessments, continuous monitoring, early warning systems, and community awareness in vulnerable areas.

Silent CSS variable bugs expose gaps in frontend testing and static analysis

A developer working on an Electron-based agent GUI encountered two cascading UI failures in a single evening, both caused by silent errors in CSS custom properties. The first bug stemmed from hardcoded dark-palette hex values in component CSS that ignored theme variables, causing broken contrast in light mode, which was patched in version 0.2.84. The second failure emerged from that very fix: four CSS variables referenced in the updated code did not exist in the token definitions file, causing transparent backgrounds and broken styles with no console errors or test failures. Because undefined CSS variables silently fall back to browser defaults rather than throwing errors, existing behavior-based tests could not detect the missing values. The developer responded by building static guards that verify every referenced CSS variable is defined across all theme blocks and that no raw color values exist outside the token file, turning any future undefined variable into a build failure rather than a silent visual regression.

Google Offers US College Students One Free Year of AI Pro Plan Worth $240

Google announced on August 19, 2026, that eligible US college students can claim a free 12-month subscription to Google AI Pro, a plan normally priced at $19.99 per month. The offer includes four times higher Gemini usage limits, integrations with Google apps like Gmail and Docs, and 5 TB of Google One storage. Students must redeem the promotion before December 31, 2026, after which standard pricing applies unless they cancel. Google has also added a dedicated student hub within the Gemini app, featuring tools such as study notebooks and Deep Research in Gemini Live. A separate 12-month offer for students outside the US provides the Google AI Plus plan with 2x usage limits and 400 GB of storage.

Telnyx Launches AI-Powered IVR That Lets Callers Speak Naturally Instead of Pressing Keys

Telnyx has released an open-source Python/Flask application that replaces traditional touch-tone phone menus with a natural language IVR system. Inbound calls are handled using Telnyx Call Control, while an LLM dynamically generates greetings and routes callers to the correct department based on spoken input. Menu configurations are stored per phone number in a key-value store, allowing businesses to update routing options without changing code. If the AI model fails to determine intent, the system falls back to keyword matching, and calls exceeding three turns are automatically transferred to a default operator. The project is publicly available on GitHub and uses Ed25519 webhook signature verification to prevent spoofed requests from triggering unauthorized call actions.

FrameOS

Discussion | Link

How to Network Intentionally at Tech Conferences Using a Simple Strategy

A developer preparing for the Commit Your Code conference in Plano, TX, has shared a structured approach to making the most of tech events. The core advice is to define a clear goal before attending, whether that means reconnecting with peers, expanding your network, or job hunting, since each objective demands a different strategy. For those focused on meeting new contacts, the author recommends building a tracking spreadsheet to research speakers, send pre-event outreach messages, and schedule post-conference follow-ups. Job seekers are advised to go further by dressing sharply, crafting a memorable icebreaker, and refining an elevator pitch. The overarching message is that intentional preparation transforms a busy conference from an overwhelming experience into a meaningful career opportunity.

Weekly Cyber Roundup: AI Impersonation, Android Malware, and INTERPOL Crime Bust

Attackers are creating fake websites mimicking AI brands like Claude to distribute malware through deceptive installers that hollow out browser processes once executed. A new report reveals that leading AI labs including OpenAI, Meta, and Anthropic still lack publicly disclosed emergency containment protocols for rogue AI models. The ToxicPanda Android malware has been updated to support 167 remote commands and targets 349 financial apps across 16 countries using invisible phishing overlays. Researcher Matthew Callaghan accidentally discovered that AliExpress was using inaudible audio signals to fingerprint and track users' browsers without their consent. Separately, an INTERPOL operation targeting West African cybercrime rings uncovered a growing trend of sextortion attacks against minors as young as 14.

Government tightens norms for e-cycles, e-bikes

Italian Cybersecurity Student Joins DEV to Share Embedded and Web Projects

A Computer Engineering student based in Italy has introduced themselves to the DEV Community, highlighting their focus on cybersecurity. They believe understanding how to build systems is essential before attempting to secure or exploit them. Their recent work spans two areas: writing embedded C firmware for the M5Stick S3 and developing web applications using Next.js and React. The student follows a hybrid workflow, concentrating on system architecture and edge cases while using AI tools to assist with code generation, then reviewing the output carefully. They aim to build in public, share projects, and learn from fellow developers on the platform.

Bath residents demand demolition of £3M mansion over planning rule breach

A £3 million seven-bedroom mansion in Bath, England, has triggered a significant planning dispute. Over 100 local residents are calling for the property to be demolished, alleging it was built larger and taller than what Bath and North East Somerset Council had approved. The developer, however, denies any intentional violation of planning regulations. The case highlights ongoing tensions between residential development and local planning oversight in the region.

Developer finds AI alone insufficient for debugging, credits community forums for key fix

A developer encountered a persistent bug related to Tailwind CSS classes not working correctly with third-party elements in a React Native project. Initial attempts to resolve the issue using the AI assistant Claude produced a working but undesirable workaround that replaced Tailwind classes with plain CSS. The developer turned to traditional online forums and discovered a community-reported issue that provided both the fix and a deeper understanding of how Tailwind interacts with third-party components. Armed with that context, the developer was able to prompt the AI model more precisely and receive the correct solution. The experience led to a broader reflection that human-shared knowledge in forums remains essential, as it serves as the foundation AI models learn from and that engineers must understand to use AI tools effectively.

Renaming secrets with NEXT_PUBLIC_ in Next.js exposes them to all visitors

In Next.js, environment variables prefixed with NEXT_PUBLIC_ are embedded directly into the client-side JavaScript bundle, making them visible to anyone who inspects page source or network traffic. Developers sometimes accidentally trigger this exposure by renaming server-only secrets — such as Stripe or OpenAI API keys — with the NEXT_PUBLIC_ prefix to silence a build error. Such leaked credentials can grant full access to third-party services and may be harvested by bots or malicious actors. The correct fix is to keep sensitive secrets unprefixed and use them exclusively in server components or API routes, while client components interact with those secrets only through server-side API calls. A tool called KeyDrift can perform a read-only scan of the client bundle to detect any hard-coded or inlined secrets and recommend remediation steps.

Supabase public buckets bypass signed URLs, exposing private files to anyone

A technical advisory warns that Supabase Storage buckets marked as public allow anyone to access stored files directly via a stable URL, completely bypassing signed URL authentication. This poses a serious risk for developers building private B2B workflows — such as storing generated images in Next.js apps — who mistakenly assume signed URLs alone protect their content. The core issue lies in Supabase's public flag: when set to true, no authentication check is performed before serving objects. Developers are advised to set the bucket's public flag to false, apply row-level security policies, and serve files exclusively through time-limited signed URLs generated server-side. An optional recommendation is to offload CPU-heavy image processing to background workers while keeping all outputs in the now-secured private bucket.

Junk foods will soon have labels warning of high salt, sugar and fat

Stripe Connect refunds can silently drain platform revenue due to two default flags

When Stripe Connect platforms issue refunds, two boolean flags — refund_application_fee and reverse_transfer — determine whether the application fee and the fund transfer to the connected account are also reversed. Both flags default to false, meaning a standard refund only credits the customer while the platform's fee and transferred funds remain unrecovered. This silent discrepancy never triggers an error in Stripe's logs, surfacing only as a mismatch between the amount refunded and what actually returns to the platform's balance. Platforms can audit this exposure using a read-only Stripe API token to compare expected versus actual balance changes across past refunds. Setting both flags to true during a refund is the recommended fix to ensure a net-zero outcome for the platform.

CJI Surya Kant: Clean Energy Transition Must Not Burden Developing Nations

Chief Justice of India Surya Kant raised concerns about the unequal pressure placed on developing nations in the global clean energy transition. Speaking at the Commonwealth Secretariat in London, he noted that countries still in the process of industrialising are being pushed to rapidly adopt renewable energy. He highlighted that these nations often face disproportionate criticism when they are unable to transition quickly enough. The CJI called for balancing the urgency of clean energy goals with the principles of fairness and shared responsibility among all nations.

Nilekani-Led Panel Invites Public Suggestions to Reform India's Exam System

A high-level committee headed by Infosys co-founder Nandan Nilekani has called for public input to address issues in India's examination system. The panel was announced by Prime Minister Narendra Modi last month following widespread controversy over an alleged paper leak in the NEET-UG examination. Youth protests over alleged irregularities in the conduct of the test had intensified scrutiny of the country's testing framework. Beyond plugging integrity gaps, the committee will also examine ways to improve accessibility, inclusion, and student well-being within the examination process.

Astro Still Lacks TypeScript Support for Named Slots, RFC Open Since 2022

Astro currently allows developers to type component props using TypeScript interfaces, but named slots cannot be typed in the same way, leaving a known gap in the framework. A GitHub RFC proposing typed slots has been open since December 2022, and an Astro core maintainer acknowledged the feature is planned but not yet on the roadmap. The complexity stems from the fact that slots inject markup rather than passing simple data values, and neither TSX tooling nor Astro's internal slot implementation fully supports the required typing mechanisms. As of 2024, a follow-up from the RFC author confirmed the issue remains unresolved. In the meantime, developers can work around the limitation by documenting slot names in comments or using runtime checks via the Astro.slots.has() API.

DEV Community Member Earns Trustee Status After Shifting Focus to Commenting

A DEV Community member who joined in June published 16 posts that averaged just 1.6 reactions each, with several receiving none at all. On July 24, they shifted strategy and began actively reading and commenting on other users' posts, after which their subsequent 12 posts saw a notable increase in reactions and followers. Without applying or requesting it, the platform this week granted them Trusted Member status, one of the higher recognition tiers on DEV. Reflecting on the experience, the member concluded that engagement — not content alone — was the missing ingredient, describing the comment sections as where real community connection happened. They credited several specific community members for making the environment feel welcoming and expressed gratitude to the DEV team for the recognition.