Issue 44

30 October 2026

Hi there,

Apple patched Safari’s certificate trust, but the git it ships can still accept the bad chain. Further down, somebody put a working RISC-V computer inside a language model. I spent rather more time on both than on the earnings calls this week.

Industry

1. Anthropic opens its books

Anthropic filed an S-1 with the SEC on Monday for a proposed public offering. The filing has no offer price or final share count. One enormous line deserves a second look before anyone calls it cash burned: of the $80.748 billion six-month net loss, $72.388 billion is a fair-value charge; the operating loss was $693 million. A real set of accounts is more useful than another private valuation headline.

CIO Corner: This week’s reads for leaders and decision-makers

Where is the return? Apollo's chief economist compares the Magnificent Seven with the rest of the S&P 500: revenue per worker and margins are rising among the technology giants but broadly flat in the other 493 companies. That is an aggregate observation, not proof that no factory has benefited. For a large industrial group, the question is which process has shorter cycle times or fewer errors after deployment, and who is measuring it against its old baseline rather than counting licences.

Two very different adoption numbers. In Microsoft's customer accounts, Volkswagen has rolled Copilot out to more than 330,000 employees, while Telstra says an agent helps with more than 272,000 service migrations and recommends decisions at over 95% accuracy under human review. One is reach, one is a defined workflow. Ask the process owner how many recommendations are overturned, what a mistake costs, and whether junior colleagues still learn how to make the decision themselves.

List the things another party can switch off. Steve Blank argues for European alternatives to US technology after reports of restrictions on Starshield access in Ukraine. His political account is contested, and replacing an enterprise suite with AI is not a near-term exit plan. The useful exercise for a CIO is narrower: identify external control over identity, network access and plant-support systems, then run an actual disconnection or supplier-failure drill. The person who owns that drill should also own the recovery time.

Artificial Intelligence

2. Mistral releases the weights, with a licensing catch

Mistral Large 4’s improved weights are now available after the company’s earlier public preview. It is a one-trillion-parameter multimodal model trained on European infrastructure; running it yourself is a considerable engineering proposition, even if the files can be downloaded. Its licence also requires a separate agreement for commercial Model-as-a-Service operators. Open weights are useful for a sovereign deployment, but they are not a blank cheque to resell an endpoint.

3. Kimi’s new model is hosted now, weights later

Moonshot’s Kimi K3.1 Pro offers a million-token context window and a faster Highspeed variant on its site and API. The company calls it open-weight but says the full weights will follow by 4 November; that makes today’s self-hosting claim premature. Its benchmark comparisons use different agent harnesses, so I would try it on the actual code or documents before taking a leaderboard as a purchasing decision.

4. OpenAI calls three research results discoveries

OpenAI describes new work in harmonic analysis, complexity theory and quantum field theory. The way it is releasing the material is the story: the maths output is public, the computer-science group published a natural-language proof and Lean formalisation, and the physics collaborators are holding their AI-generated artifacts while they write their own account. Researchers can check some of the work now, but not all three on the same footing. OpenAI says the outside groups are independent and unpaid; their explanations and verification still matter more than the announcement.

Infrastructure

5. Zephyr crosses into car controllers and DSPs

Zephyr 4.5 adds Infineon TriCore and Qualcomm Hexagon to its real-time operating system. TriCore is used in automotive control units, while Hexagon handles signal processing in Qualcomm chips. Both have QEMU targets (with extra toolchain setup); the release also adds SPDX 3.0 records of build inputs and 178 boards. An RTOS that can tell you which compiler built the firmware is worth a closer look when devices have to be patched years after they ship.

6. Panfrost replaces its Mali shader compiler

Collabora switched newer Mali GPUs to Kraid in Mesa’s main branch. On its captured OpenGL shaders, the compiler generated 18.47% fewer instructions; a Vulkan compilation dataset ran about seven times faster through the compiler. That is not a sevenfold application frame-rate gain. The work removes needless register moves, a rather concrete reminder that open graphics support depends on compiler engineers as much as driver authors.

7. Linux reaches the M4’s boot screen

The first Apple M4 and A18 Pro support landed for Linux 7.4. For the M4 that currently means a booting kernel and console, not a usable replacement desktop on a MacBook. Hardware enablement starts with the boring parts; there is a long list of peripherals and power management to bring up after the first prompt appears.

Microsoft

8. GitHub puts an agent inside Actions, with a fence

GitHub Agentic Workflows is generally available. A Markdown instruction compiles into a normal Actions workflow, with runner groups and repository policies intact. The agent starts read-only in a sandbox; proposed writes pass through validation and threat detection. A maintainer could start with issue triage before deciding which, if any, repository write path an agent should have.

Development

9. Ghostty compresses the history you never see

Ghostty 1.4 compresses scrollback and reduces memory use, while completing Kitty graphics protocol support. Its release notes also disclose fixes for memory-corruption cases involving terminal control sequences and scrollback. Terminals display arbitrary output from commands and remote machines; that security section is worth reading even if the headline feature is speed.

10. Popcorn puts the actual BEAM in the browser

Software Mansion’s Popcorn 1.0 replaces AtomVM with an OTP/BEAM build compiled to WebAssembly. The old small VM needed patches to keep up with Elixir and OTP; maintaining that fork became work of its own. The new runtime brings much broader compatibility, although a browser is still an odd place for a full Erlang VM. I want to see what people build when they can share real Elixir modules between a Phoenix app and a browser rather than translating them to JavaScript.

11. A RISC-V CPU inside Qwen’s weights

Divyansh Agrawal compiled a 32-bit RISC-V core into Qwen3.5’s layers, using the model’s Gated DeltaNet state as addressable memory. The CPU executes during forward passes; there is no external tool or runtime. The author says it passes the RISC-V tests and has run 18 million instructions without an error, though slowly. The post went up on 22 October, just before this issue’s window, and is too good a machine-design experiment to bury because of that date.

Information Security

12. Apple’s git still accepts the compromised chain

Researchers tested the git, curl and Python shipped with macOS after the 27.2 update and found that the bundled command-line trust file still accepts certificates under compromised eMudhra intermediates. Apple’s advisory distinguishes those tools from Safari and framework-based apps, which block the affected certificates. An attacker would need to redirect or intercept the connection, but a build runner that fetches code over HTTPS is an obvious place to check. The update can also revert a manually edited trust file; re-test after patching macOS.

13. The fingerprinting script that baited AI reviewers

A reverse engineer found bioweapon-themed function names and an encoded prompt inside an obfuscated browser fingerprinting script. The names made several models refuse to explain the JavaScript; another model did unpack it. The author also found behaviour gated to a Node environment that can touch files and shell commands. The headline circulating online says the script ‘creates bioweapons’. The evidence in the write-up is about frustrating analysis and unexpected code paths, not an actual bioweapon.

14. Binance’s preliminary account of a vast withdrawal attack

Binance says its initial investigation points to a compromised DevOps engineer’s laptop, followed by access to a service container and unauthorised withdrawals. It estimates total impact around $6.3 billion and says roughly $3 billion has been frozen on-chain. Those are preliminary figures, and frozen assets are not a final loss calculation. Binance says it found no evidence of a wallet private-key leak; the promised technical post-mortem will have to explain the container and withdrawal authorisation boundaries.

15. Tailscale fixes an SSH privilege boundary

Tailscale’s account of the Tailworm findings says an already-authorised peer with SSH access could, in certain conditions, act beyond the configured local user’s privileges. That is a serious lateral-movement problem, but not unauthenticated entry to any machine on a tailnet. Fixes for the SSH issues and three Serve/Funnel bugs are in 1.104.4. Check both the installed version and the SSH permissions in the tailnet policy, particularly where one peer can reach several servers.

Coming up

4 November: Moonshot says the full Kimi K3.1 Pro weights will be released by this date; check the actual licence and files when they land.

9–12 November: KubeCon + CloudNativeCon North America meets in Salt Lake City.

17–20 November: Microsoft Ignite takes place in San Francisco.

30 November – 4 December: AWS re:Invent meets in Las Vegas.

If you tried that git certificate check on a Mac this week, I’d be curious what you found.

Best,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.