Utah recycles 15,000 cu yds of old highway concrete to build new interchanges

Utah's Bangerter Highway underwent a sustainable upgrade in which old concrete pavement was crushed and repurposed on-site. Around 15,000 cubic yards of the recycled material were used as the structural base layer for new highway interchanges. The approach significantly cut down on truck trips needed to haul away debris and eliminated the need for off-site waste disposal. The project effectively extended the life of a highway that had been in service for roughly three decades.

Ganga water level breaches 'highest flood mark'

X-Frame-Options Being Deprecated: Why CSP frame-ancestors Is the Better Choice

Clickjacking attacks trick users into clicking hidden buttons on malicious sites that load a target page inside a transparent iframe. Two HTTP headers defend against this: the legacy X-Frame-Options and the modern Content Security Policy directive frame-ancestors, with the former now considered deprecated. Security guidance recommends using CSP frame-ancestors with strict values like 'none' or 'self' instead of broad wildcards, which leave sites fully exposed. Developers can quickly check their exposure using a simple curl command to inspect response headers for either directive. Sites intentionally embedded by third parties, such as payment widgets, should maintain a minimal, explicitly documented allowlist rather than opening framing permissions entirely.

Quick-reference guide lists essential HTTP security headers with ready-to-use values

A developer on DEV Community has published a pocket reference table of HTTP security headers commonly checked during security audits. The guide covers headers such as Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and Permissions-Policy, each paired with recommended values and the threats they mitigate. Ready-to-paste configuration snippets are provided for nginx and Apache servers. The article also highlights common misconfigurations to avoid, such as using unsafe-inline in CSP or setting cookies without Secure and HttpOnly flags. A companion open-source CLI tool, reconpp, is mentioned for quickly scanning a site's header posture and generating a severity-ranked report.

Bihar flood threat rises as Ganga flows above ‘highest flood level’; Orange rain alert in Delhi

Ready-to-use authorization template for passive web security audits released

A security professional has published a written authorization template designed for passive web configuration audits, covering scope, engagement rules, and confidentiality terms. The document defines strict boundaries, including no fuzzing, no brute force, and no exploitation attempts, limiting activity to passive HTTP response analysis. It includes sections for host ownership, emergency contacts, and a retest policy, and requires signed authorization before any testing begins. The author also references an open-source tool called reconpp, which automates header, TLS, cookie, CORS, and exposed-file checks within 60 seconds. A Portuguese-language ebook covering a 70-point audit checklist and five-phase methodology is available alongside the template.

How Industrial Robots in Factories and Warehouses Could Shape Future Warfare

The robots most likely to influence future military applications are not being built in defense labs but are already operating in factories, warehouses, mines, and ports. Industrial robotic arms, autonomous vehicles, drones, and AI-powered cameras form the technological foundation that could eventually be adapted for large-scale robotic forces. Rather than a single humanoid soldier, future systems may resemble an ecosystem of specialized machines — small robots acting as scouts, drones extending situational awareness, and ground vehicles handling logistics. The key challenge lies in adapting these industry-tested technologies from controlled environments to unpredictable real-world terrain and conditions. Experts suggest that developers are more likely to repurpose proven industrial machinery than build entirely new systems from scratch.

Citrix NetScaler Auth Bypass CVE-2026-19490 Actively Exploited, Patches Available

Attackers are actively targeting a critical authentication bypass vulnerability, CVE-2026-19490, in Citrix NetScaler ADC and Gateway products, with attack attempts matching a public proof-of-concept observed from multiple regions. The flaw allows an unauthenticated remote attacker to bypass authentication on devices configured as Gateway or AAA virtual servers without any user interaction. Security firm Previdian confirmed that incoming requests to their sensors aligned with the known PoC exploit pattern. Affected versions span NetScaler ADC and Gateway 13.1 and 14.1 lines, with patched versions 14.1-73.32 and 13.1-63.21 now available for standard builds. Citrix has urged administrators to apply patches immediately and verify SAML and FIPS configurations against the official advisory CTX696939.

CrowdStrike Falcon Zero-Day PoC Enables SYSTEM Privilege Escalation on Windows

Security researchers have published a proof-of-concept exploit, dubbed FalconFlank, that abuses CrowdStrike Falcon Sensor's Microsoft Office macro removal feature to escalate privileges from a low-privileged user to SYSTEM on Windows endpoints. The PoC works by manipulating file operations during Falcon's macro remediation process to write a malicious DLL to a protected system path, specifically C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll, which is then loaded with elevated privileges. Exploitation requires the attacker to already have low-privileged local code execution on the target machine and the Falcon Sensor's Office macro removal setting to be active. No active in-the-wild attacks leveraging this technique have been observed as of the disclosure date of September 4, 2026. CrowdStrike has issued interim guidance recommending that administrators disable the Windows policy setting for Microsoft Office File Suspicious Macro Removal while a full fix is pending.

Google Patches Actively Exploited Chrome Zero-Day Flaw in V8 Engine

Google has released an emergency security update for Chrome to address CVE-2026-85046, a critical type confusion vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw allows a remote attacker to trigger arbitrary code execution within the browser sandbox by directing a user to a specially crafted HTML page. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, signaling urgency for organizations to act. Users on Windows and macOS should update to Chrome version 152.0.7977.82 or 152.0.7977.83, while Linux users should update to 152.0.7977.82, and restart the browser to complete the patch. Operators of Chromium-based browsers are also advised to check for available updates and restrict access to untrusted sites in the interim.

Cline VS Code Extension Turns AI Coding Into a Human-Approved Execution Loop

Cline is a TypeScript-based VS Code extension that transforms an IDE into an iterative AI-driven coding loop, where the model inspects files, proposes changes, runs commands, and observes failures in sequence. A key design feature is mandatory human approval at each meaningful step—such as file writes and shell commands—ensuring the agent cannot act silently on the entire system. Performance on focused tasks is fast, but context costs grow significantly as command outputs, diffs, and errors accumulate across longer or broader refactoring sessions. The extension is particularly suited to scoped implementation and debugging work, though large monorepos can cause noticeable spikes in both latency and token usage. The author recommends keeping destructive commands like Docker deployments guarded and reviewing every diff, emphasizing that human engineering judgment remains essential even with AI assistance.

Why Pasting Secrets Into Your Browser Console Is a Security Risk

Developers commonly paste API tokens, JWTs, and environment keys into the browser console for debugging, but this practice carries two distinct security risks. First, browser consoles store history locally, meaning pasted secrets persist on the machine until manually cleared. Second, using third-party websites to decode tokens effectively transmits those credentials to external servers, where they may be logged. The recommended fix is to avoid pasting secrets into the console entirely and to use local, browser-based JWT decoders that process tokens without any external transmission. Adopting these habits replaces a common but risky workflow with a secure alternative that requires no additional tools or setup.

Study of 1,000 Repos Reveals git blame Misses Team Process Patterns

A large-scale analysis of over 1,000 code repositories, spanning personal projects, client work, and public codebases, uncovered consistent patterns that challenge common assumptions about repository health. The study found that a small fraction of files consistently accounted for the majority of code churn across nearly all repositories, regardless of team size or tech stack. Commit patterns were found to correlate more strongly with team size than with team quality, while branch ratios proved to be the most stable metric observed. The research concluded that git blame reveals who touched the code but obscures the underlying team processes that shaped it. These findings directly informed the design of gitpulse, an open-source CLI tool built to provide a more complete weekly repository health check covering both structural and security concerns.

internetspeedtest.net releases open dataset of global speed test results by country and ISP

The operator of internetspeedtest.net has open-sourced aggregated internet speed data collected from the site's free, LibreSpeed-based tool. The first release covers January through August 2026 and includes average, median, and percentile statistics for download speed, upload speed, and latency, grouped by country and ISP. Data is published as monthly JSON files on GitHub, Zenodo, Kaggle, and Hugging Face under a CC BY 4.0 license. The creator cautions that the sample is self-selected and uneven, with country and ISP derived from IP lookup rather than verified sources. Minimum sample thresholds — 200 tests globally, 30 per country, and 20 per ISP — are enforced before any aggregate is published.

Bifrost Open-Source AI Gateway Streams LLM Audit Logs to Enterprise SIEMs

Security teams face a growing blind spot as LLM traffic often bypasses corporate monitoring by flowing directly from microservices to third-party model providers. Bifrost, an open-source AI gateway built in Go by Maxim AI, addresses this by centralizing multi-provider model routing and generating immutable, HMAC-signed audit trails. The gateway natively exports structured telemetry to major SIEM and log platforms including Splunk, Datadog, Microsoft Sentinel, Kafka, and cloud storage services. Granular content controls allow organizations to sanitize sensitive prompt data while retaining searchable metadata, supporting compliance with regulations such as HIPAA and PCI DSS. The solution aims to give security operations teams real-time visibility into prompt injection attempts, unauthorized data egress, and agent behavior across enterprise AI deployments.

CLI Tool gitpulse Maps Real Codebase Ownership Using Git History and Impact Scores

A developer tool called gitpulse claims to identify who truly maintains a codebase by analyzing git history rather than relying on org charts or ownership files. Instead of counting raw commits, it measures contributor impact by weighing lines changed across distinct files, with extra weight given to frequently modified 'hotspot' files. Running a single command over a quarterly period can reveal who owns high-churn files, which contributors are ramping up, and who may be becoming a single point of failure. The tool also surfaces patterns such as late-weekend commit clusters that may indicate a team under stress, insights that raw git logs alone do not provide. The article positions gitpulse as a practical, terminal-based analytics instrument distinct from version control systems, offering actionable decisions rather than just event logs.

How to Add Automated Secret Scanning to GitHub Actions Using Dotguard

Developers can integrate the open-source tool Dotguard into GitHub Actions using a single YAML block to automatically scan repositories for exposed secrets on every pull request or push. The tool checks .env files, config files, and source code for leaked credentials, including cloud keys, tokens, and high-entropy strings tied to sensitive variable names. When a secret is detected, the CI build fails and generates a JSON report pinpointing the exact file and line, making remediation straightforward. False positives can be handled through documented exceptions rather than disabling the scanner entirely, preserving the integrity of the security check. The article argues that the cost of running such a scan is negligible compared to the potential six-figure financial and reputational damage caused by a leaked credential.

Ex-cricketer backs Sanju Samson to replace Ruturaj Gaikwad as CSK captain

Discussions are underway about a potential captaincy change at Chennai Super Kings ahead of the 2027 IPL season. Ruturaj Gaikwad's performances have drawn scrutiny, prompting questions about his suitability to continue leading the side. Former cricketer Sadagoppan Ramesh has publicly endorsed Sanju Samson as a strong replacement, citing his experience and a notable 50% win rate as an IPL captain. Beyond the captaincy question, CSK also faces decisions regarding the future of their coaching staff. The role of franchise icon MS Dhoni in the team's setup remains another key matter for the organisation to resolve.

Delhi influencer Swatantra Bhardwaj detained after viral video of assault boast

Social media influencer Swatantra Bhardwaj was detained by Delhi Police after a video of him boasting about assaulting a protester's father spread widely online. In the video, he claimed responsibility for causing severe injuries to the victim, reportedly requiring multiple stitches. His social media profiles drew additional scrutiny, revealing provocative content and claims of closeness to political figures. The detention came after Delhi Police assured protesters that action would be taken against him.

Why are European countries moving their gold out of North America?

Article URL: https://www.bbc.com/news/articles/cvgyn8q8gqxo Comments URL: https://news.ycombinator.com/item?id=49573455 Points: 27 # Comments: 7