A race condition any unprivileged user can trigger through the AF_ALG socket API gives root on the host and escapes Docker containers, and it sat in Linux kernel crypto code for roughly 14 years.
CVE-2025-39964, found by Muhammad Alifa Ramdhan at STAR Labs with Billy (Bing-Jhong) Jheng completing the chain, earned $113,337 as a Google kernelCTF submission; reported as the first kernelCTF entry using AF_ALG as the entry point.
Distinct from the 2026 Copy Fail bug (a straight-line AEAD logic flaw): this is a race between two threads calling sendmsg() on the same AF_ALG socket, where lock_sock() is released during af_alg_wait_for_wmem() via sk_wait_event(), letting thread B resume into state thread A changed.
The interleaving plus a deliberately failing memcpy_from_msg() (invalid user address) forces ctx->merge==true while the final af_alg_tsgl has cur==0, so sg = sgl->sg + sgl->cur - 1 computes sg[-1], an out-of-bounds read of a fake scatterlist 8 bytes before the 4096-byte object.
Full summary
A STAR Labs researcher documents CVE-2025-39964, a local privilege escalation in the Linux kernel's AF_ALG cryptographic socket interface, reachable from unprivileged userspace with no special configuration. The bug is a race: af_alg_sendmsg() releases the socket lock while waiting for send-buffer space (via sk_wait_event inside af_alg_wait_for_wmem), so two writers sharing one af_alg_ctx can interleave. Combined with a deliberately failing copy, this produces the supposedly impossible state ctx->merge==true with the final af_alg_tsgl's cur==0, making sgl->sg + sgl->cur - 1 point to sg[-1], an out-of-bounds fake scatterlist. Heap spraying controls sg[-1].page_link, which feeds the memcpy_from_msg() destination and yields a kernel write; because that path uses raw_copy_from_user with fault-tolerant exception handling, sendmsg's success-or-EFAULT return becomes a non-crashing oracle to locate pages despite KASLR. The exploit overwrites core_pattern with a pipe command to run the exploit binary as root, and because AF_ALG is reachable inside containers against the host kernel, it also escapes Docker to host root. The vulnerable code dated to 2011 (commit 8ff590903d5f, Linux 2.6.38); the upstream fix enforces exclusive writer ownership, returning -EBUSY to a second concurrent writer. The submission earned $113,337 via Google kernelCTF, distinct from the separate 2026 Copy Fail AEAD logic flaw.
An 816B-parameter (42B active) open-weight agentic model now runs locally on two M5 Ultra Mac Studios via MLX, putting frontier-scale inference on a desktop instead of a rented cluster.
Details
816B total parameters, 42B active, natively multimodal, 1M-token context window; Meta claims it is the most capable US open-weight model to date, built for coding and long-horizon agentic work.
Local deployment target: two Apple M5 Ultra Mac Studios running the latest MLX, each using up to 512GB unified memory (1TB combined) at 1.2TB/s bandwidth, so the pair holds the whole model.
Ships with custom auto-tunable Helion GPU kernels in SGLang claimed at 1.03-3.95x kernel-level speedups on NVIDIA and AMD, and a 3% end-to-end speedup on AMD MI350; runs on SGLang, vLLM, TensorRT-LLM, HF Transformers, MLX, llama.cpp, and Unsloth.
Meta released the weights for Muse Spark Open, which it calls the most capable US open-weight model to date: a natively multimodal model with 816B total parameters, 42B active, and a 1M-token context window aimed at coding and agentic tasks. Its headline feature is local deployment on two Apple M5 Ultra Mac Studios via MLX, using each machine's up to 512GB of unified memory (1TB combined) and 1.2TB/s bandwidth to hold the full model on a desktop. The release includes custom Helion GPU kernels in SGLang with claimed 1.03-3.95x kernel-level speedups on NVIDIA and AMD and a 3% end-to-end speedup on AMD MI350, plus broad inference-engine and silicon support. Weights are distributed on Hugging Face, SageMaker, Google Cloud Model Garden, and Microsoft Foundry, with hosted inference across seven partners, under the Muse Model License with limited commercial terms. Meta demonstrated on-device agentic workflows including shipping iOS changes to the Ice Cubes Mastodon client and automating DaVinci Resolve video editing. The post asserts the model met its Superintelligence Scaling Framework thresholds but publishes no concrete benchmark numbers and defers the full evaluation report.
If you run a coding agent against many MCP servers, OpenCode 2.0's "code mode" lets the model compose tool calls in a single scripted round trip instead of sequential calls, cutting latency and context bloat even with ~1,000 servers attached.
Details
Client/server split is now default: a single background process backs the TUI, web UI, and desktop app; the @opencode/client package autodiscovers the local service, and /pair or opencode pair exposes it to other hosts.
Code mode (@opencode/codemode) runs a minimal native JS interpreter that ingests MCP servers or OpenAPI endpoints as callable functions, avoiding Node VMs or QuickJS; agents can call a tool, map over results, and call another tool in one round trip. All MCP servers opt in by default.
Background execution added on two fronts: background subagents (the primary agent spawns work to another agent, optionally a different model, and keeps prompting) and async background shell commands; a hotkey moves any slow foreground task to the background.
OpenCode 2.0 is a major rewrite of the open-source coding agent that makes its client/server model the default: a single background process now serves the TUI, web, and desktop clients, with an autodiscovering @opencode/client package and a /pair flow to expose the service to other hosts. The headline feature is "code mode" (@opencode/codemode), a minimal native JavaScript interpreter that converts MCP servers and OpenAPI endpoints into functions the agent can script, letting it chain tool calls in one round trip rather than sequentially; all MCP servers are opted in by default to limit context bloat even with roughly a thousand servers attached. The release adds background subagents and asynchronous background shell commands so long-running work does not block the primary agent, plus a hotkey to push slow tasks to the background. The plugin system was rebuilt with 80+ internal plugins implementing most 2.0 features, and TUI plugins (built on OpenTUI) are now stable. A new @opencode/sdk exposes OpenCode as an embeddable library, for example in Durable Objects. Upgrading requires the latest 1.x and opencode upgrade --major, and carries breaking changes: 1.0 plugins are incompatible, the server API is entirely new, and tui.json config moves to json. Claims about "millions of daily users" and performance gains are self-reported and unquantified.
A decompiled mobile game shows device-side ML pricing you per ad view and dealing provably unsolvable puzzles exactly when an ad worth 3.5x your last one is loaded, so the "difficulty" you hit after a high score is a revenue trigger, not skill tuning.
Details
Revenue claim (Sensor Tower estimates): Block Blast made ~$127M from ads January-May 2026, against Candy Crush Saga's $81.1M over the same months.
Game logic ships as server-controlled encrypted JS modules (XXTEA + Brotli) called traits/arms, not in the store binary: the config named ~700 traits, this install selected 254, and 101 were downloaded after install, so two players run different games and the studio can change yours with no app update.
RewardHighValueAdHarvestTrait (15,616 bytes decoded) fires when three conditions line up: last three rewarded ads completed (AppLovin MAX onUserRewarded, so a closed ad stays false), the loaded ad's eCPM is >=3.5x your last one, and you are 1,000 points past your high score (other arms use 500/750). It then swaps the piece pipeline for deathAlgorithm, OFFER_TYPE.ZHI_SI_TI / algorithm 24001, native func_death_blcok.
A reverse-engineering write-up, following a video with over 15 million views, decompiles the mobile puzzle game Block Blast (Android 10.8.2 via jadx/Ghidra, iOS 7.4.9) and argues it deliberately deals unsolvable puzzles to force high-value rewarded-ad views. The game ships most logic as ~700 server-controlled encrypted JavaScript modules ("traits"); the author documents RewardHighValueAdHarvestTrait, which fires when three completed rewarded ads, a loaded ad worth at least 3.5x the last, and a score 1,000+ past the high score all hold, then requests a provably unsolvable three-piece hand (deathAlgorithm/algorithm 24001, native func_death_blcok), confirmed by exhaustive search (0 of 171 placements work). Several other rules and on-device XGBoost/LightGBM models independently trigger the same lethal generator, predict difficulty placement, estimate each player's ad value (finalEcpm, varying sharply by country and first score), and predict churn. The author verified the rule running live on an iPhone simulator with real AdMob pricing, matched server-fetched files to cached copies byte-for-byte, and matched an offline native decode to a running-app memory dump across 25.3M bytes. Claims the author cannot fully substantiate include Sensor Tower revenue figures (~$127M vs Candy Crush's $81.1M) and server-side model weights that stay off-device; the decryption key and protection-bypass steps are withheld from the public evidence bundles.