P.01Ollama closed a $65M Series B led by Theory Ventures on July 9, 2026, bringing total funding to $88M and its developer base to nearly 9 million, with 85% of Fortune 500 companies reportedly using it. Here's what the raise signals for teams weighing local versus API-hosted inference.
P.02Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.03The direct answer: calculate your required sample size before you start, based on your baseline conversion rate and the smallest effect worth detecting, then run until you hit it. Stopping early on a good-looking p-value is how most A/B test results turn out to be noise.
P.04A voice clone needs three seconds of audio and can authorize a wire transfer over the phone. Here's what deepfake executive fraud actually costs companies in 2026, and the callback protocol that closes the specific gap it exploits.
P.05Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.06Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.07AI agents that shop or call paid APIs on your behalf need a way to pay without your credit card sitting in a prompt. Google's AP2 and Coinbase's x402 are the two standards doing that. Here's what each one actually does, in plain terms.
P.08North Korea-linked campaigns are hiding malware inside take-home coding tests, using steganography in SVG images to slip past review. Here's how the Contagious Interview campaign actually works and how to vet a coding challenge before you run it.
P.09A default WordPress install can now be taken over by a single anonymous HTTP request. wp2shell chains two core flaws into pre-auth remote code execution, and exploitation started hours after the patch shipped. Here's what's affected and the fix.
P.10OpenAI's Operator, Perplexity Comet, Anthropic's Claude in Chrome, Microsoft's Copilot Studio Computer Use, and the open-source Browser Use all automate the browser, but they don't work the same way or fit the same use case. Here's a practical field guide.
P.11Apple sued OpenAI on July 10 alleging systematic trade secret theft through hired-away employees. The allegations read less like a one-off scandal and more like a checklist of gaps in how most companies handle hiring, interviews, and offboarding.
P.12Moonshot AI's Kimi K3 launched July 16 as the largest open-weight model yet, and it already leads closed frontier models on several real-world benchmarks. Here's what changed, what it costs, and when it actually matters for your stack.