The Wire · Microsoft
Copilot, Azure AI, and Microsoft's AI across its stack — what's shipping and what it means for builders.
Moonshot AI released Kimi K3, the largest open-weight model yet: a 2.8-trillion-parameter mixture-of-experts (16 of 896 experts active), 1M-token context, native vision, Kimi Delta Attention and Attention Residuals, in K3 Max and K3 Swarm variants. Moonshot's own benchmarks show K3 beating Anthropic's Opus 4.8, while independent Artificial Analysis scores it clearing Opus 4.8 and GPT-5.5 but losing to Fable 5 and GPT-5.6 Sol; it lists at $3/$15 per million tokens, roughly half Opus's cost per task. Ask it who it is and it says "I am Claude" — the tell of the distillation Anthropic documented in February (3.4M exchanges from Moonshot, 16M across three Chinese labs via 24,000 fake accounts). Also: Mira Murati's Thinking Machines ships its first model, the 975B open-weight Inkling; an autonomous AI agent breaches Hugging Face and is caught with the open-weight GLM 5.2; and NotebookLM becomes Gemini Notebook with a sandboxed cloud computer in every notebook.
Multi-platform SDK for integrating GitHub Copilot Agent into apps and services
Read full story →Microsoft will end OneDrive synchronization support next month for older versions of Windows 10, leaving users without client updates, fixes, or technical assistance. According to a post on the company's Message Center, OneDrive sync app updates will continue on Windows 10 22H2 until October 10, 2028, but will stop for earlier versions from August 15, 2026. No support means no more updates, fixes, or security patches, although the service itself won't suddenly stop working. However, users running into problems cannot expect Microsoft to fix them. The move should not come as a surprise. Support for Windows 10 21H2, the last official release before the final 22H2, ended on June 13, 2023. The message mentions Windows 10 22H1, although this was never officially released by Microsoft – the company switched to an annual release cadence after 21H2. According to Microsoft, "this change aligns OneDrive support with the Windows lifecycle policy and helps Microsoft focus ongoing investments on supported operating systems." Microsoft 365 file synchronization services will also be affected, although, again, nothing will necessarily stop working immediately. Microsoft stated: "Existing installations may continue to function, but future functionality is not guaranteed." Users still clinging to Windows 10 versions before 22H2 will have to use the web interface to access OneDrive, which is a good deal less convenient than desktop synchronization. Alternatively, there's always the upgrade to Windows 11 that Microsoft would dearly like users to make, although OneDrive synchronization on Windows 10 22H2 should be fine until 2028. There are plenty of alternatives for cloud synchronization. For organizations looking for something a little more sovereign, there are always options like Nextcloud, which told The Register that its synchronization software would work on Windows 10 1809 or later. As with Microsoft, Windows 11 is the recommendation. However, unlike Microsoft, Linux is also an o
Read full story →Microsoft has delayed the removal of the -Credential parameter from Exchange Online PowerShell until December 2026, giving administrators more time to update affected scripts and automation. The -Credential parameter is used when connecting to Exchange Online PowerShell. It allows an administrator to supply stored username and password credentials. These days, it is heavily discouraged, particularly when more secure authentication methods are available. Microsoft had designated the parameter for removal in July 2026 as part of its move away from password-based authentication. The trouble is tracking down automation scripts that use it, updating them, and validating the changes – assuming a fix is even possible. Once the parameter is gone from the Connect-ExchangeOnline and Connect-IppsSession cmdlets in the Exchange Online PowerShell module, any scripts still relying on it will break, potentially taking carefully built workflows down with them. However, Microsoft has opted to push back the retirement beginning December 2026 – a festive gift for administrators. The company stated: "If your organization uses the -Credential parameter in PowerShell scripts or automation workflows connecting to Exchange Online or Security & Compliance PowerShell, those scripts will break when you update to an Exchange Online PowerShell module version released beginning December 2026." As such, the retirement won't take effect until an update is performed. The server-side retirement of the underlying authentication flow is planned "for a later date." "When that occurs, the -Credential parameter will stop functioning even on older module versions." Microsoft said it delayed the retirement due to "customer feedback," although it came late in the day. That said, a few extra months will be welcomed by affected administrators dealing with the impact of the change. And the change is still coming. Microsoft added: "While our published timeline extends to the start of December 2026, we strongly
Read full story →172 points, 47 comments on HN
Fortinet admins have two more reasons to clear their calendars after CISA confirmed a pair of critical FortiSandbox bugs are being actively exploited. The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9.1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. According to Fortinet, they are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, requiring neither valid credentials nor user interaction. Fortinet released fixes for CVE-2026-39808 in April and CVE-2026-25089 in June, warning in advisories published at the time that successful exploitation could lead to remote code execution via low-complexity attacks. Fortinet has not publicly confirmed that either flaw is being exploited in the wild, but CISA has now added both bugs to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means CISA has evidence that the vulnerabilities are being actively exploited, although the agency rarely attributes attacks or discloses how widespread they are. For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured. Fortinet has not updated its advisories to mark either flaw as exploited and did not respond to The Register's questions. CISA isn't the only one reporting attackers poking at these vulnerabilities. Security firm Defused said it had observed exploitation attempts against both flaws this week alongside another FortiSandbox vulnerability, CVE-2026-39813. Not every exploit appears to be doing its job, though, as Defused described the one targeting CVE-2026-25089 as "vibecoded" and likely broken, adding that it has yet to see a working public exploit. CISA also used Thursday's KEV update to flag another fresh concern: Microsoft's newly patched SharePoint Ser
A framework for building, orchestrating and deploying AI agents and multi-agent workflows with support for Go.
Microsoft is looking to sell its in-house AI models as more efficient and cost-effective than its competitors' models.
Right on the heels of Microsoft releasing a record number of security patches, a researcher has published exploit code that can enable low-privilege Windows accounts to make sensitive changes to administrator accounts. The exploit, which multiple researchers say works , is sending Microsoft scrambling, yet again, to patch a zero-day released by an anonymous researcher who has complained about the software maker’s handling of their bug reports. To date, the pseudonymous NightmareEclypse has published nine such exploits, including Tuesday’s HiveLegacy . The researcher said the proof-of-concept code included in the report was stripped down to prevent attackers from using it maliciously. A “pretty powerful primitive” HiveLegacy is an elevation-of-privilege exploit that targets a vulnerability residing in the Windows User Profile Service. It allows users (and with more work likely processes) with limited system rights to compromise an admin user's account by modifying its classes registry hive , a resource that ensures the correct application opens when certain types of files are clicked on in Windows Explorer. Read full article Comments
Microsoft's monthly release of security fixes, dubbed Patch Tuesday, resolved a record 570 security vulnerabilities across the company's product line, thanks to discoveries with AI.
Yesterday’s headline story became even more true, with Superapp usage adding yet another 1M users since we last wrote: In other news, published his final AIEWF26 recap of recaps: Including coverage of Addy Osmani’s excellent keynote covering what AI engineers should continue doing even when the cost of code generation trends to zero: AI News for 7/13/2026-7/14/2026. We checked 12 subreddits, 544 Twitters and no further Discords. AINews’ website lets you search all past issues. As a reminder, AINews is now a section of Latent Space . You can opt in/out of email frequencies! AI Twitter Recap Coding Agents, Harnesses, and the Shift From Chat to Execution OpenAI’s agent products are seeing unusually strong pull : @sama said usage of Codex + ChatGPT Work grew 2.5x in a week , later adding that GPT-5.6 Sol demand is “insane” and may cause scaling hiccups while infra catches up ( 1 , 2 ). The ecosystem response was immediate: JetBrains made Codex its recommended agent , @theo highlighted Codex’s underexposed “question tool” , and OpenAI’s own team showed command-line eval tooling built start-to-finish with GPT-5.6 . Product-side, OpenAI also ran multiple usage resets , amplified by @reach_vb and users like @kimmonismus . Harness quality and observability are becoming a first-class differentiator : several tweets converged on the idea that model quality alone is no longer enough. @swyx warned that stale agents.md instructions can act like self-inflicted prompt injection , causing multi-hour stalls in long-running tasks. LangChain added tracing for Codex and later expanded to Cursor, Copilot, Pi, and OpenCode in LangSmith , exposing tool calls, subagents, and token usage. @Teknium shipped Hermes updates to parallelize any subset of tool calls and previously exposed banked resets directly in Hermes Agent . The meta-point was stated crisply by @andykonwinski : companies that can encode their value into evals and environments may gain a more durable edge than those relying on c
An industry-wide standard Microsoft invented to protect Windows, and later Linux, devices from firmware infections has been trivial to bypass for 13 of its 14 years of existence. The discovery was made by researchers at security firm ESET after identifying 11 firmware images, at least one from 2013, that were known to be defective but remained signed by the software company anyway. The images are known as shims , which were invented to extend Secure Boot to Linux devices and utility software. Using a technique simple enough to be performed by novice hackers, these old, forgotten shims can be used to completely circumvent the protection, which is embedded into the UEFI (Unified Extensible Firmware Interface) of the device's motherboard. The gaffe is the result of Microsoft, which oversees the signing of shims, failing to revoke the publicly available images once vulnerabilities were found in them. Threat extends to Windows and Linux users The threat extends to Windows and Linux users alike, since the shim can be installed on devices running both operating systems. From there, an attacker can subvert the mandated chain of digitally signed firmware to install malicious firmware that loads early in the boot process and persists after either the OS is reinstalled or a hard drive is replaced. Read full article Comments
Microsoft just released a long list of improvements for Windows 11 as part of its bigger patch Tuesdays, and that includes the ability to pause updates indefinitely, as reported earlier by Windows Central. This option rolled out to Windows Insiders earlier this year, allowing you to hold off on updates for up to 35 days […]
New York Governor Kathy Hochul signed into law Senate Bill S10642 today, also called the Responsible Data Center Development Act, which would put a one-year moratorium on all data center developments in the state. According to Reuters , this is the first temporary ban to be enforced statewide in the U.S. Maine’s legislature was actually the first one to pass a statewide moratorium, but Maine Governor Janet Mills vetoed the measure after it failed to exempt a data center project “that enjoys strong local support from its host community and region.” Go deeper with TH Premium: AI and data centers (Image credit: Microsoft) Photonics and high-speed data movement is the next big AI bottleneck The data center cooling state of play Massive AI data center buildouts are squeezing energy supplies Ultra Ethernet: The data center interconnection of tomorrow "As data center development threatens to hike up utility bills, deplete our natural resources, and create uncertainty for New Yorkers, it's my responsibility to take action and lead," Hochul said in a statement. She also said that she’s pursuing legislation to repeal tax exemptions for large data centers. The moratorium will apply to data center projects with a capacity of 50 megawatts or more, with the New York Department of Environmental Conservation not issuing any more permits to projects that haven’t been completed yet. Hochul said that the state will build a Generic Environmental Impact Statement (GEIS) so that future data center developments are held to “consistent standards,” while also looking at how the construction and operation of these projects will impact the environment. Although the data center moratorium is set for one year, the governor’s office said that it will be lifted once the state has finalized the GEIS. President Donald Trump has been pushing for the development of AI technologies, with the White House releasing the ‘AI Action Plan’ to accelerate infrastructure build-out . While this policy encoura
Microsoft is testing a cleaner version of the Windows 11 search menu that strips it of recommended content and ads. In a blog post on Monday, Microsoft announced that it's rolling out the decluttered Search Box to Windows Insiders in the Experimental channel as the company looks to regain trust with users and fix Windows. […]
<p data-block-key="cy5dt">Will bring Google, Amazon Web Services, Microsoft, and Oracle under direct regulatory oversight</p>
An independent briefing for builders: the whole field read continuously, every story scored for relevance, and the noise left off the page.
300+ curated sources. Every story scored 1–10 for builder relevance by Claude's frontier model. The filler never makes it to the page.
GPUs, datacenters, power deals, and inference economics: the infrastructure layer that decides what every builder pays. Our signature coverage.
Every story is sourced. Every score is computed. We show our work and link to originals.
Every briefing closes with The Call: one falsifiable claim with a date on it. When we're wrong, we say so in print. Opinions are cheap; ours get scored.