Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Your AI agent did exactly what it was designed to do. The framework underneath it just handed an attacker a shell on the box that holds your OpenAI key, your database credentials, and your CRM tokens.
That is not a hypothetical. In a few months, three of the most widely deployed AI agent frameworks each turned a known, ordinary bug class into a way through. Check Point Research chained a SQL injection in LangGraph’s SQLite checkpointer to full remote code execution. Tenable and VulnCheck tracked a path traversal in Langflow’s file upload endpoint to active, in-the-wild RCE. Cyera documented a path traversal in LangChain-core’s prompt loader that reads your secrets off disk. Two paths to a shell, one to your keys. They are the same bug, wearing three frameworks.
These frameworks became production infrastructure faster than anyone secured them. They store agent state, take file uploads, load prompt configs, and hold the credentials to databases, CRMs, and internal APIs. The edge tools watch traffic. The endpoint tools watch processes. Neither was built to treat an imported framework as a boundary worth guarding, and that blind spot is exactly where all three chains live, widening every week as these frameworks ship to production.
Start with the one most teams pulled into production this quarter. LangGraph gives AI agents memory through checkpointers, the persistence layer that stores execution state. It has cleared over 50 million downloads a month. Yarden Porat of Check Point Research took that layer apart and found three vulnerabilities. Two of them chain to RCE.
CVE-2025-67644, rated CVSS 7.3, is a SQL injection in the SQLite checkpointer. The function that builds the WHERE clause for checkpoint lookups drops user-controlled filter keys straight into the query with no parameterization and no escaping. This does not hit everyone, but where it hits, it is serious. A deployment is exposed when it self-hosts LangGraph on the SQLite or Redis checkpointer and lets untrusted input reach get_state_history() or a similar history endpoint. Meet those conditions, and an attacker who controls the filter writes a fabricated row straight into the checkpoint table. Run LangChain’s managed LangSmith platform on PostgreSQL, and the exposure is gone.
Then CVE-2026-28277, CVSS 6.8, finishes the job. LangGraph’s msgpack checkpoint decoder rebuilds Python objects from the stored data, which lets it import a module and call a named function with attacker-supplied arguments. That step needs write access to the checkpoint store; the SQL injection is what grants it remotely. LangGraph loads the forged row as a legitimate checkpoint, the decoder runs the specified function, including os.system, and code executes under the identity of the agent server. A third issue, CVE-2026-27022, CVSS 6.5, reaches the same place through the Redis checkpointer.
There has been no confirmed exploitation in the wild yet. A working proof-of-concept is public in Check Point’s disclosure. The fixes are version bumps: langgraph-checkpoint-sqlite to 3.0.1, langgraph to 1.0.10, and langgraph-checkpoint-redis to 1.0.2.
Langflow is the one already under attack. CVE-2026-5027, CVSS 8.8, is a path traversal in the POST /api/v2/files endpoint, which takes the filename straight from the form data and writes it to disk unsanitized. An attacker packs that filename with traversal sequences and drops a file anywhere, such as a cron job in /etc/cron.d/. Because Langflow ships with auto-login enabled in its default configuration, an exposed instance needs no credentials at all. A single unauthenticated request reaches the endpoint, and the next cron run hands over a shell.
VulnCheck’s Caitlin Condon confirmed exploitation on June 9: “Our Canaries observed exploitation of CVE-2026-5027 that successfully leveraged the path traversal to write what appear to be test files on victim systems.” Censys put roughly 7,000 exposed instances on the internet, most in North America. This is the third Langflow flaw to draw active exploitation this year, after CVE-2025-34291, which the Iranian state-sponsored group MuddyWater weaponized and which CISA added to its Known Exploited Vulnerabilities catalog in May. CVE-2026-5027 itself was patched in version 1.9.0, released April 15.
The timeline is what sets the clock. The patch shipped April 15. Attacks started in June, and VulnCheck added CVE-2026-5027 to its exploited-vulnerabilities list June 8 once its sensors caught the first in-the-wild hits. Every instance left unpatched between those two dates has been sitting in the open for almost two months. The lesson for security teams is to start the patch clock at disclosure, not at a federal catalog entry.
LangChain-core, the foundation under both, disclosed CVE-2026-34070, CVSS 7.5, a path traversal in its legacy prompt-loading API. The load_prompt() functions read a file path out of a config dict with no check against traversal sequences or absolute paths, so an attacker who influences that path reads arbitrary files the process can reach, including the .env file holding OPENAI_API_KEY and ANTHROPIC_API_KEY. Cyera paired it with CVE-2025-68664, CVSS 9.3, a deserialization flaw that resolves environment secrets through a crafted object. The fix versions differ, which matters when you patch: CVE-2026-34070 lands in langchain-core 1.2.22 and 0.3.86; CVE-2025-68664 lands earlier in 1.2.5 and 0.3.81. Clear both, or the higher-severity flaw stays live behind a patched one.
Three frameworks, three classic AppSec bugs. Path traversal. SQL injection. Unsafe deserialization. Nothing exotic, nothing AI-specific, just old vulnerabilities living inside new infrastructure. None of this is a frontier-model problem. It is plumbing, sitting in the layer where AI meets the enterprise.
Merritt Baer, CSO at Enkrypt AI and former deputy CISO at AWS, has named what makes this kind of failure hard to see coming. It does not announce itself as an AI problem. “CISOs will experience MCP insecurity not in the abstract, but when an employee pastes sensitive data into a tool, or when an attacker finds an unauthenticated MCP server in your cloud,” Baer told VentureBeat. “It won’t feel like ‘AI risk.’ It will feel like your traditional security program failing.” The framework chains here are the same shape. An exposed Langflow instance is an unauthenticated server in your cloud, and the alert, if one fires, reads like an ordinary incident.
That is the gap in one sentence. The exploit lives in the framework your code imports. The WAF never sees a msgpack decoder running three layers down. The EDR watches the agent server make the same process calls it makes a thousand times a day and waves it through. Both tools are doing their job. Nobody scoped the framework itself as the thing that could turn on you.
The root cause is older than AI, and Baer names it. “MCP is shipping with the same mistake we’ve seen in every major protocol rollout: insecure defaults,” she told VentureBeat. “If we don’t build authentication and least privilege in from day one, we’ll be cleaning up breaches for the next decade.” Langflow’s auto-login is that mistake shipped. LangChain-core’s unguarded prompt loader is that mistake shipped. The convenient default is the vulnerability. And the moment an agent connects to anything, that risk compounds. “You’re not just trusting your own security, you’re inheriting the hygiene of every tool, every credential, every developer in that chain,” Baer said. “That’s a supply chain risk in real time.”
There is a governance failure layered on top of the technical one, and it is the same miscategorization Assaf Keren, chief security officer at Qualtrics and former CISO at PayPal, has flagged in adjacent tooling. “Most security teams still classify experience management platforms as ‘survey tools,’ which sit in the same risk tier as a project management app,” Keren told VentureBeat. “This is a massive miscategorization.” Swap in AI agent frameworks, and it still holds. Teams file LangGraph, Langflow, and LangChain under developer convenience, then wire them into databases, CRMs, and provider keys. “Security has to be an enabler,” Keren said, “or teams route around it.” These frameworks are what routing around it looks like.
Follow the money and it points at the same layer. On its Q1 fiscal 2027 earnings call, CrowdStrike reported its AI detection and response line up more than 250% sequentially, and on June 17 it extended that runtime coverage to agent, LLM, and MCP traffic on AWS. George Kurtz, the company’s co-founder and CEO, named the reason in plain terms: “Agents run on the endpoint. They make tool calls, access files, invoke APIs, and move data at the process level.” That is the exact plumbing these chains abuse, and real money is now moving to the layer your AppSec scan skips.
The board does not need the CVE numbers. It needs the consequence, and Keren draws the line the board cares about. Most teams have mapped the technical blast radius. “But not the business blast radius,” Keren told VentureBeat. “When an AI engine triggers a compensation adjustment based on poisoned data, the damage is not a security incident. It is a wrong business decision executed at machine speed.” A framework RCE is the same problem one layer earlier. The agent does not just leak a credential; it acts on production systems with it, and the business sees an outcome no one can explain.
So frame it the way a board frames it: we run AI agent frameworks in production that can be turned into remote shells through bugs our scanners are not built to find, all three are patched, one is under active attack, and here is the date every instance is verified and closed. None of this required custom malware or a zero-day.
Six trust boundaries, one per row, each with the question, the proof point, the command, the fix, and the board line. Run it tonight.
|
Trust-Boundary Question |
Proof Point |
What Broke |
Verify Before You Install |
The Fix |
Board Language |
|
1. Can the agent’s state store be poisoned with code? |
LangGraph SQLi-to-RCE chain. CVE-2025-67644 (CVSS 7.3) chains into CVE-2026-28277 (CVSS 6.8). PoC public, no in-the-wild use yet. |
Filter keys interpolated into SQL with an f-string. Forged checkpoint row hits the msgpack decoder, which imports and runs an attacker-named callable. |
pip show langgraph-checkpoint-sqlite. Below 3.0.1 = vulnerable. Confirm get_state_history() is not exposed to network input. |
Upgrade langgraph-checkpoint-sqlite to 3.0.1, langgraph to 1.0.10, langgraph-checkpoint-redis to 1.0.2. |
“Our agent memory layer can be tricked into running attacker code. Vendor has patched it. We are upgrading and confirming the endpoint is not exposed.” |
|
2. Can an unauthenticated request write a file to our agent server? |
Langflow CVE-2026-5027 (CVSS 8.8). On VulnCheck KEV (June 8). Active exploitation confirmed June 9. ~7,000 exposed instances (Censys). |
Path traversal in POST /api/v2/files. Filename unsanitized. Auto-login on by default. Two HTTP calls drop a cron job and earn a shell. |
Query Censys or Shodan for your Langflow, Flowise, n8n, and Dify instances on the perimeter. Check whether auto-login is enabled. |
Upgrade Langflow to 1.9.0+. Disable auto-login. Pull AI dev tools behind VPN or zero-trust. Isolate port 7860. |
“Our AI dev tools are reachable from the internet with login off. This exact flaw is under active attack now. We are pulling them behind access controls today.” |
|
3. Can our prompt loader read files it should never touch? |
LangChain-core CVE-2026-34070 (CVSS 7.5), path traversal in the prompt-loading API. Paired with deserialization CVE-2025-68664 (CVSS 9.3). |
load_prompt() reads a config-supplied path with no traversal check, returning files such as the .env holding OPENAI_API_KEY and ANTHROPIC_API_KEY. |
pip show langchain-core. Below 1.2.22 (1.x) or 0.3.86 (0.x) = vulnerable. Audit any code passing user-influenced paths to load_prompt(). |
Upgrade langchain-core past both fixes: 1.2.22 / 0.3.86 (CVE-2026-34070) and 1.2.5 / 0.3.81 (CVE-2025-68664). Replace load_prompt() with an allowlisted directory. Run as non-root. |
“Our prompt system could be steered to read our API keys off disk. We are patching and removing the legacy loader.” |
|
4. Does a compromised framework hand over every credential at once? |
These frameworks are often deployed with provider keys, database credentials, and integration tokens available to the process environment. Cyera documents the credential-exfiltration path. |
One RCE on the agent server exposes every secret the process can read. Blast radius is the full credential set, not one app. |
Inventory which secrets each framework process can reach. Confirm keys come from a secrets manager, not static .env files. |
Move provider keys to ephemeral injection. Rotate any key a vulnerable instance could have read. Scope each key to least privilege. |
“A single break in one AI framework exposes the keys to every model and data store it touches. We are rotating and scoping them now.” |
|
5. Are these frameworks running outside security governance? |
A prior Langflow flaw, CVE-2025-34291, was weaponized by Iranian-linked MuddyWater and added to CISA KEV in May. Shadow AI is the new shadow IT. |
Teams stand frameworks up for speed, give them credentials, and never bring them under review. The security team cannot see what it does not know exists. |
Run a discovery sweep for AI frameworks outside change management. Map each to an owner and an approval record. |
Assign every framework a documented owner and a place in the approval process. Offer a sanctioned alternative so teams do not route around you. |
“We have AI frameworks in production that no one formally approved. We are bringing them under governance, not banning them.” |
|
6. Can our scanners even see inside the framework at runtime? |
Runtime detection is forming around this layer: CrowdStrike Falcon AIDR expanded to AWS June 17 (Bedrock, Kiro, Strands); its QuiltWorks coalition now covers cloud workloads. |
WAF reads HTTP at the edge. EDR watches the endpoint. By default, neither reliably models a msgpack decoder or a prompt loader three layers down in an imported framework as a separate trust boundary. |
Test whether your AppSec scan covers third-party framework internals. Track CVEs by dependency, not just by what your edge tools can parse. |
Add framework dependencies to vuln management. Treat agent output and stored state as untrusted. Patch on disclosure, not on KEV listing. |
“Our scanners check our code, not the frameworks our code imports. We are closing that blind spot and patching on disclosure, not waiting for the federal catalog.” |
How to read this table: each row is one trust boundary, left to right, from the question to ask to the line to read your board.
The fixes are not a re-architecture. They are version bumps and config changes you can land this week. The exposure is the gap between the day the patch shipped and the day your team runs the checks, and right now that gap is measured in months. The frameworks did exactly what they were built to do.
Looking for the most recent Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections: Sports Edition and Strands puzzles.
Today’s NYT Connections puzzle changed at the last minute. The Times had another puzzle scheduled for today, but moved it to June 30 at the last minute. And if you’re a fan of a certain New York team that just won a basketball championship, you can see why. They substituted today’s puzzle, which features some words relating to that winning team. Read on for clues and today’s Connections answers.
The Times has a Connections Bot, like the one for Wordle. Go there after you play to receive a numeric score and to have the program analyze your answers. Players who are registered with the Times Games section can now nerd out by following their progress, including the number of puzzles completed, win rate, number of times they nabbed a perfect score and their win streak.
Read more: Hints, Tips and Strategies to Help You Win at NYT Connections Every Time
Here are four hints for the groupings in today’s Connections puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.
Yellow group hint: The 11th letter.
Green group hint: I’m behind you!
Blue group hint: Sit down.
Purple group hint: Rock on.
Yellow group: Featuring silent and pronounced “K”s.
Green group: Endorse.
Blue group: Kinds of chairs.
Purple group: Words repeated in hit song titles.
Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words
The completed NYT Connections puzzle for June 20, 2026.
The theme is featuring silent and pronounced “K”s. The four answers are jackknife, knapsack, Knicks and knock-knock.
The theme is endorse. The four answers are back, bolster, champion and support.
The theme is kinds of chairs. The four answers are beanbag, recliner, rocker and stool.
The theme is words repeated in hit song titles. The four answers are Jumpin’, Louis, New York and Rebel.

Owners of original PlayStation consoles have watched their disc drives age for decades. Lasers fade. Games start to skip or fail to load altogether. Replacement drives grow scarce and expensive. A new device called ArcStation steps in with a direct solution. It replaces the entire optical drive assembly inside the console with a compact circuit board that loads games from an SD card instead. No discs stay necessary after setup. The change keeps the original hardware intact and authentic while removing the most common point of failure.
Installation is mercifully simple: simply unplug and open the case with a single Phillips screwdriver, and you’re done. Owners then carefully remove the old drive, flip over to the shiny new board, and adjust two little DIP switches to match the region settings on their console. Once that’s done, simply plug in the short cables provided, which go into the exact same locations as the originals. You will not need to apply any solder or make any lasting modifications to the motherboard. Instead, the new board sits well on the existing posts inside the casing thanks to a 3D manufactured mount that also accommodates both the larger “fat” PlayStation models and the handy tiny PSOne. A simple test boot with the lid remaining open will ensure that the old Sony logo and boot animation are back in action. Put the case back on, and you’re finished.

Once inserted, the board appears as soon as you turn on the console and displays a very clean small menu on a tiny built-in LED screen. Users just copy their game files to a normal SD card formatted in either FAT32 or exFAT. It is not an issue to have CUE/BIN pairs, BIN files on their own, or ISO pictures on there; the board can handle them all. You can keep the games in folders or subfolders if you like, as this is all about organization. Simply hit the refresh button in the menu, and the board will scan your card and generate a list for you. Then simply press the title button with your controller, and the game will launch immediately on the original hardware. In terms of load timings, they’re not far off from what you’d get from an actual CD, and there’s even a special option for early motherboard revisions that can shave even more off.

The reason this works so well is that it accurately mimics the behavior of the original CD-ROM drive, down to the radio frequencies that the console expects. Games that generally look for modchips or copy protection will not even blink an eye. You get region-free access on all PS console generations, including the legendary PSOne. If you’re playing a game with multiple discs, the board will usually handle the queue for you. You can even build a manual queue of up to six discs and move between them as needed; simply press the button next to the SD slot while keeping an eye on the LED display.

Save games are moved to virtual memory cards that are kept directly on the SD card; each game has its own dedicated file, so storage never runs out like it did on the old physical cards. You can attach the virtual card to either slot 1 or 2 on the fat models, but be careful because some older systems cannot handle it. Owners can access the menu without having to turn off the console by specifying a button combination on the controller, which is far more convenient than fiddling around in the settings. The tiny PSOne differs from the others in that it cannot use virtual memory cards or the game reset combo due to its completely different internal layout, but it can still use all other functionalities. Some additional options on the main menu allow you to adjust video settings, switch to a light or dark theme, receive sound cues, have the console auto-start the previous game you played with a slight delay, and even display the game title from either a database or what is actually on the folder name.

Pre-orders began at the end of May at a reduced price of roughly 140 euros. Shipping is expected in September, but fingers crossed it will arrive sooner. The kit contains all of the wires required for both the fat and slender models, as well as the board, which is pre-mounted for ease of installation. There has been thorough testing on over a hundred titles, and the results on the fat models have been remarkably consistent, even after extended gaming sessions.
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers’ Salesforce environments, as the new “Icarus” extortion group publicly claims the attack.
The disclosure comes after cybersecurity firms Huntress and ReliaQuest detailed how attackers abused compromised Klue Battlecards integrations to steal Salesforce CRM data from multiple organizations.
In a statement published this week, Klue CEO Jason Smith confirmed that the company discovered unauthorized activity on June 12 affecting part of Klue’s integration infrastructure.
“On June 12, we identified unauthorized activity affecting a portion of Klue’s integration infrastructure. Since then, we’ve been working alongside trusted cybersecurity experts to understand what happened, support our customers, and restore the connections you rely on,” wrote Smith.
“Our investigation determined that an attacker gained access through a compromised legacy credential associated with an integration service. The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments.”
The company says there is currently no evidence that customer content stored directly within the Klue platform was impacted and that the incident was limited to third-party integrations.
Klue says it immediately revoked affected credentials and tokens, removed unauthorized code, disabled impacted integrations, launched an investigation, and notified law enforcement. The company also confirmed it engaged CrowdStrike to assist with the response.
ReliaQuest and Huntress found that the attackers used stolen OAuth credentials associated with Klue integrations to access customer Salesforce environments and conduct large-scale data theft.
ReliaQuest observed attackers generating OAuth tokens and using Python scripts to query Salesforce’s API for extended periods, as data was stolen.
Huntress later disclosed that its own Salesforce environment was affected by the Klue breach and that the stolen data included business contacts, sales communications, pricing information, and other records.
While BleepingComputer and Huntress previously linked the incident to the Icarus extortion operation, the threat actors have now publicly claimed responsibility on their data leak site.
“As you’ve probably already heard, Klue.com has been impacted by us recently. A number of other companies’ Salesforce instances, which were partners to Klue, were exfiltrated,” reads the Icarus post.

The threat actors went on to pressure Klue and affected organizations to contact them through the Session messaging platform to prevent the leaking of stolen data.
The post comes after BleepingComputer previously reported that the attacks were linked to Icarus, after sources shared extortion emails sent to affected organizations. Huntress also independently connected the operation to Icarus through Session Messenger IDs used in the extortion emails and the group’s data leak site.
Since then, additional victims have disclosed that they were affected by the attacks, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity.
Almost all say the incident led to the theft of data from their Salesforce instances and did not affect their platforms, infrastructure, payment information, or internal systems.
Several organizations warned that the stolen business contact information could be used in follow-on phishing, social engineering, and extortion campaigns and urged customers to be vigilant.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
If there’s an avid DIYer who doesn’t love a good tool sale, they are few and far between. Many of us are always on the lookout for a chance to score new tools or replace those that are getting old. Getting them at a discount feels like a win-win regardless of whether you’re buying tools for yourself or someone else.
At Lowe’s, you can choose from one of the tool brands it owns, brands with which it has exclusive relationships, or some well-known options that can also be found at other retailers. You can take advantage of the deep discounts Lowe’s is offering on its line of professional-grade tools in June of 2026 by shopping in-store or online.
There are discounts across much of Lowe’s product lineup, but we’ll look at examples ranging from standard mechanic’s hand tools, battery-powered cordless tools, carpentry and woodworking tools, and tools to make time spent working in your shop or garage more productive.
Tools are an investment in our future DIY projects. As such, the term “buy once, cry once” is as accurate here as it is in any situation. That’s why a quality tool storage solution is so important. It makes no sense to buy good tools only to throw them into a greasy pile in the corner of a musty garage.
There are a lot of pros and cons to consider when deciding if you need a $500 tool chest. However, what if you could get a $600 tool chest on sale at Lowe’s for just $400? Quality tool storage and deep discount pricing are obviously items to add to the pros column.
The tool chest we’re looking at is the $399 Craftsman 2000 Series. It’s a 52-inch wide, by 38.05-inch tall, 10-drawer red rolling steel tool cabinet (model CMST98273RB), and it also comes in black (CMST98273BK) for the same price while they’re on sale, ending July 8, 2026.
While there is likely some overlap in the reviews, Lowe’s credits the red version with 2,916 and the black with 3,004 reviews, with each model averaging 4.3 stars. The 10 drawers support up to 100 pounds of tools each, and the chest rolls on four 5-inch diameter by 2-inch wide casters, providing a final load rating of 1,500 pounds. A 10-year limited warranty provides protection for your investment.
It’s no surprise that DeWalt produces a popular cordless drill. It’s frequently at or near the top of the list anytime we see major cordless drill brands ranked worst to best. The surprise is that one of DeWalt’s top-rated cordless drills is currently hugely discounted at Lowe’s. The DeWalt 20V Max 1/2-in keyless brushless cordless drill kit (model DCD793D1) includes the drill, a 20V Max battery, and a battery charger that also charges 12V DeWalt batteries if you have them.
This drill provides up to 1,650 revolutions per minute (RPM) without a load, has a ratcheting ½-inch keyless chuck to hold bits securely without the need for tools, and lights up the workspace in front of it with an integrated LED work light. While Lowe’s claims it provides up to 16% more power using the included DCB203 battery than its DCD771 drill using the same battery, the DCD793’s biggest perk may be its 2-inch shorter head length compared to the DCD771. The DeWalt 20V Max drill is priced at $99 (down from $179) until July 15.
Whether you’re interested in creating cabinetry, installing trim inside your home, or building a pole barn, a good saw is a must-have. While you could make do with a number of different saw types, it’s important to pick the right saw for the job at hand. With these June 2026 deep discounts at Lowe’s, you might as well have a saw capable of creating compound miter cuts on your workbench.
Through July 31, 2026, Lowe’s has the Bosch Glide 12-inch 15-amp dual bevel sliding compound corded miter saw (model GCM12SD) priced at $449, a savings of $280 from its standard list price. The Bosch Glide miter saw is listed as one of Lowe’s best sellers and carries a 4.4-star customer approval rating.
The Bosch miter saw’s 15-amp corded electric motor delivers up to 4,000 RPM to power a 12-inch saw blade on a 1-inch diameter arbor. Compared to typical 10-inch-bladed saws, the 12-inch blade cleanly cuts through material up to 1 inch thicker. The upfront miter and bevel controls, along with easy-to-read scales and detents at common angles, make setting the precision saw a simple task.
The Bosch GCM12SD specifications show it can swing 52 degrees left and 60 degrees right, while allowing left and right bevel cuts of up to 47 degrees. It provides a 6.5-inch depth of cut measured at 90 degrees and a 4-inch maximum at 45 degrees.
Having a robust selection of tools, and just as importantly, a place for each tool, is one of life’s greatest blessings. That might sound a little dramatic, but the time saved by easily finding the right size tool, or having a visual reminder that something is out of place before calling the project finished, isn’t something to be taken lightly.
Lowe’s owns Kobalt, so the prices of these tools don’t fluctuate a lot, and deep discounts can be rare. However, the Kobalt 302-piece metric and standard (SAE) mechanics tool set with a hard case is on sale for $119 until July 29, 2026. While its discount of $30 from the standard Lowe’s price isn’t extremely deep, at this price point, it’s rare to find a comparable set of tools.
The comprehensive Kobalt tool set includes ¼, ⅜, and ½-inch drive socket wrench sets, each with 90-tooth ratchets, 100+ sockets including 6- and 12-point styles, combination wrenches, nut drivers, and other small tools. While the sockets, ratchets, and wrenches are made of heat-treated chrome vanadium steel polished to a grime-resistant finish, the two-drawer molded tool chest they come in might be the deciding factor if tool control is a high priority.
AI infrastructure startup Tensordyne has taped out its first commercial accelerator, with fabrication on TSMC’s 3nm process already underway.
Developed in collaboration with Juniper Networks and Broadcom, Tensordyne’s systems promise higher throughput and lower power consumption than GPUs. It claims to achieve this using an unorthodox approach to mathematics that uses logarithms – which you might recall from high school arithmetic – to make matrix multiplication heavy AI workloads less computationally intensive to run.
In conventional computing, addition is cheap, and multiplication is expensive. Logarithms flip this on its head. Using logs, multiplication essentially becomes an addition problem. a*b becomes log(a) + log(b).
The trick is converting those values to logs and back again efficiently. There are a couple of ways of dealing with this. One of the easier options would have been to use a lookup table (LUT). However, Tensordyne cofounder Gilles Backhus tells El Reg that relying on LUTs would have been too large to be practical.
Instead, the company uses a heuristic, specifically the Mitchell approximation, to estimate log and antilog for each value. This is still an approximation and on its own introduces too much error to be tenable. To overcome this, Backhus tells us Tensordyne has implemented a section-wise correction mechanism in hardware that delivers accuracy equivalent to that of FP16. However, it’s worth noting that Napier will also support FP8 and 4-bit block floating data types.
In effect, Tensordyne claims to have built a chip in which the multiply accumulate (MAC) unit works without actually doing multiplication in the conventional sense. The result is a chip that delivers power efficiency significantly greater than what you’d see on modern GPUs. Or at least that’s the claim.
Tensordyne says its rack systems will spit out up to 17x more tokens per watt and achieve 13x higher throughput than Nvidia’s Blackwell systems.
Tensordyne’s first commercial chip, Napier, boasts many of the same specs you’d have seen from a high-end GPU just a couple of years ago.
The accelerator boasts a 300-watt nominal TDP, 144 GB of HBM3e spread across four stacks, 4.7 TB/s of memory bandwidth, and up to 2.1 petaFLOPS of dense FP8 performance. This makes it roughly comparable to Nvidia’s H200 accelerators announced in 2023, while using nearly 60 percent less power.
Having said that, max achieved FLOPS often fall far short of peak FLOPS, so take that comparison with a grain of salt. We won’t know how Napier actually compares to Nvidia or AMD’s latest generation of GPUs until it arrives next year.

Backhus tells us that Tensordyne is leaning heavily on the scalability of its accelerators rather than individual performance. Each chip features roughly a terabyte of interconnect bandwidth, allowing for rack-scale deployments of up to 72 accelerators per pod.
Tensordyne’s system, codenamed the TDN72, consists of eight air-cooled compute blades, each with a single 10-core Intel Xeon-D host CPU and nine Napier accelerators.
These chips are interconnected by a high-speed interconnect fabric topology reminiscent of the one used by Nvidia’s GB200 NVL72 rack systems.
Each chip connects to six proprietary fabric switch blades developed by Tensordyne’s networking partner Juniper, located at the back of the system, in an all-to-all fabric.

Despite some similarities to Nvidia’s NVL72 racks, Tensordyne’s TDN72 will be much smaller and won’t require liquid cooling, which should make it easier to deploy in older brownfield datacenters.
According to Backhus, up to four 30 kW TDN72 systems can be packed into an – admittedly large – 52U rack. That works out to 608 petaFLOPS in a 120 kW footprint, or about 1.68x more dense FP8 compute per rack than Nvidia’s GB200 NVL72. That doesn’t take into consideration the fact that Nvidia’s kit supports NVFP4 acceleration while Napier is limited to FP4 weights. But again, don’t read too much into that comparison. Peak FLOPS are not representative of real-world performance.
Tensordyne’s TDN72 launches next year, and it’ll be competing against Nvidia’s next-gen Vera Rubin and Vera Rubin Ultra systems, which will no doubt be a stiffer fight, especially when software compatibility is taken into consideration.
Since building its first prototype silicon a few years ago, the company has gone to great lengths to keep its software platform as simple and easy for customers to deploy, as possible.
For example, the prototype lacked the error correction found in its Napier chips, and would have required users to use quantization-aware training to adapt their models to run accurately on the hardware – not exactly feasible for those looking to run trillion-parameter models.
The software has also matured such that the hardware’s compiler can convert existing models to run directly on its latest hardware, an approach we’ve seen from other chip startups like Tenstorrent.
For inference, Tensordyne has developed its own proprietary serving platform, as well as a runtime environment that Backhus says will allow customers to use their preferred inference servers, such as vLLM. PyTorch support is under development.
Before the chip has even shipped, the company is making some bold performance claims. Backhus expects the chips to deliver upwards of 1,000 tokens a second, and that’s without relying on multi-token prediction or other forms of speculative decoding to boost token generation.
Tensordyne’s platform has certainly attracted the attention of neocloud providers like Cirrascale and BlueSky Compute, both of which have expressed interest in deploying the company’s hardware when available.
But, as we’ve seen with AMD and others, software can make or break a chipmaker. With Napier slated for release in Q2 or Q3 of 2027, Tensordyne won’t have long to get things right. ®
Shibu Kaithalamattathil, a senior engineer at MSD, explores the day to day as an engineer in the biopharma space and having the opportunity to watch his son enter the industry.
Shibu Kaithalamattathil is a senior engineer at MSD Biotech in Dublin.
In this role, he oversees the day-to-day engineering activities that support manufacturing, “ensuring that equipment, processes and systems operate safely, reliably and in full compliance with site standards”, he tells SiliconRepublic.com.
Kaithalamattathil says that no two days feel alike in her job, which he puts down to the team and the culture on-site.
“You’re genuinely excited to go to work every morning,” he says.
Never was this truer, Kaithalamattathil says, than last year, when he had a “unique opportunity”.
“My son Alan joined MSD Biotech, Dublin as an intern and worked on-site alongside me,” he explains. “Alan is studying chemical engineering in college and to be able to work alongside him for that period of time was amazing, not just because of the feeling of pride I got knowing my son was following in my footsteps, but also the sense that he’s taking his first professional steps in what will be a hugely exciting and rewarding career.
“With the way science is advancing, I think it’s safe to say his day to day will eventually look very different to my own, but there’s so much excitement in that.”
One of the things I enjoy most about my role is that every day I have to use both technical and non-technical skills alike. My role is as much about dealing with machinery, systems and equipment as it is about dealing with people, so it’s a mix of very technical troubleshooting skills as well as communications, teamwork and project management.
And at the heart of it, the biggest skill I think is problem-solving, whether looking at equipment or looking at our ways of working, it’s about being able to adapt and solve any issues or challenges as they arise.
That is something I think Alan experienced first-hand during his internship as well. While at university, you’re so focused on the technical side of things with the science, the engineering and chemistry. Across STEM, softer skills can sometimes be an afterthought. But on a day-to-day basis, whatever area you end up specialising in, the skills that will come in handy are usually communication and problem-solving.
The most challenging part of the day is dealing with the unexpected. It creates a sense of excitement and learning, but at the same time it is always a challenge to manage unexpected breakdowns or issues, all while ensuring that planned work is completed on time no matter what is going on.
That requires quick decisions and effective prioritisation, as well as a real passion for problem-solving. Whatever issue is in front of you, it’s really about just stepping back, looking at it holistically and then figuring out what the best way to fix or address it is. It’s about not just finding a solution, but making sure you’re finding the best solution.
I start my day by taking a few minutes to prioritise my workload, focusing on key tasks and then I get working on the to-do list. Engineering roles can be fast-paced and unpredictable, so having a clear structure helps me stay focused and calm, even when challenges arise.
I tend to break tasks into smaller, manageable steps, which keeps me organised and makes it easier to maintain momentum throughout the day. I also make a point of taking short breaks to reset, especially during busy periods. Staying refreshed helps me think more clearly and safely, both are essential in a biotech environment. And finally, I’ve learned the value of leaning on the team.
I was struck by the importance of adaptability. Even with years of experience, I quickly learned that continuous learning is part of daily life here.
The facility is equipped with modern, cutting‑edge technology and the systems evolve regularly as the industry advances. Being open to new tools, new processes and new ideas has been just as important as any technical skill I brought with me. Having my son on-site with me, I tried to encourage those same habits and behaviours for him too as I really do think they make a difference. And it’s been brilliant to see him taking them on, both in his academic and professional development.
The biopharmaceutical sector is expanding rapidly and with that growth has come significant technological advancement. My role has evolved from focusing mainly on hands-on engineering tasks to now also incorporating more data-driven decision-making and working with highly sophisticated equipment, which has been very exciting.
Automation, digital systems and advanced monitoring tools have become part of our daily operations, allowing us to work more efficiently while maintaining the highest standards of safety and quality. I’m also sure that by the time Alan finishes university and moves fully into the workforce, the role will have evolved even further, given the pace at which technology, automation and digital systems continue to develop across the sector.
However, although the tools and processes have evolved, what hasn’t changed is the purpose behind the work. We’re producing medicines that make a real difference to people’s health and you can really feel how much that sense of responsibility guides everything our team does.
What I enjoy most is the atmosphere on-site. There’s a real sense of community at MSD Biotech, Dublin. People are friendly, supportive and proud of the work they do. It genuinely feels like a home away from home in a way and that makes a huge difference in an industry where teamwork and trust are so important.
Every day, I also get to work with colleagues who share the same commitment to quality and the same passion for improving patients’ lives. That always feels very powerful too.
Seeing Alan walk into the same site where I work and watching him experience the same warm, welcoming environment was such a proud moment. It just reinforced everything I love about this job, the strong culture, the sense of belonging and the meaningful work we do every day.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
TIRED
I still remember the moment I realized Samsung’s The Frame Pro 2026 is the best art television around. I loaded Van Gogh’s The Starry Night painting with its various shades of blue. The masterpiece came alive with texture and realism thanks to the contrast ratio and clear picture quality. I marched friends and family members down to my office to gaze in wonder.
Installing The Frame Pro is a bit of a process, though. I ended up watching a YouTube video for help. About an inch thin, this model sits mostly flush to the wall. Rather than connecting your streaming boxes directly to the TV, Samsung’s Wireless One Connect breakout box acts as a bridge. I connected my Xbox Series X and PC to the HDMI ports (there are four total) on the breakout box, which then connects to The Frame Pro using Wi-Fi 7 from across the room. Navigating The Frame Pro was also easy, thanks to the intuitive UI and the lightweight, long-lasting remote.
Free users have access to Samsung’s rotating catalog of 30 free images, but subscribers willing to pay $4.99 monthly will have access to 5,000 pieces of art. The Frame Pro 2026 has the widest variety of artwork, including hundreds of masterpieces, but I preferred Amazon’s Ember Artline “moving artwork” feature better.
At $2,000, The Frame Pro is the most expensive option on our list, and it’s worth its price. Even though most manufacturers, Samsung included, don’t list specs for their art TVs, The Frame Pro 2026 displayed artwork and photos with the best contrast and picture quality.
I was blown away by the picture quality for movies. When viewing Netflix’s Awake, which displays a lot of night scenes, I was able to still see all of the action. In comparison, the same scenes looked muddy and dull on the TCL NXTVISION and Amazon Ember Artline.
The 2026 model now supports high-fidelity gaming with a 240 Hz refresh rate when connected to a gaming computer (though it does lower the resolution). I played Crimson Desert and the main character—wearing a black suit of armor—moved realistically and responded quickly to my controller nudges.
For AI features, you have a few options. Samsung lets you pick from Alexa+ or Samsung’s Bixby to control the volume by voice or ask about which thrillers came out this month. You can also use Microsoft Copilot or Perplexity. However, the Amazon Ember Artline was the only art television that let me generate AI artwork by voice.
The Frame Pro 2026 is my top pick for art TVs because paintings looked the most realistic. If you want the best quality and are willing to pay a higher price, it’s a phenomenal choice.
WIRED
While workers continue to explore ways to adopt AI in their everyday workflows, recruiters are warning they should be doing so when writing their resumes, new research has claimed.
More than half (56%) say they often or always receive resumes that contain at least some AI-generated text – two-thirds (67%) also note an increase in AI-generated content.
The report by Kickresume stresses the role of a resume is to demonstrate a person’s skills and character on paper, thus emotionless, polished text ultimately fails to represent individuals.
With AI generating more text that users might otherwise write, around a third (32%) said they’ve seen two-page CVs become more popular. “63% of professional CV writers report that generic/boiler plate content is the most common issue in client CVs,” the report revealed.
The data also reveals that workers often exaggerate skills or provide inaccurate information. Conversely, only 8% considered typos and spelling mistakes a noticeable issue – a double-edged sword implying that AI both produces better-quality resumes while also falsely representing an individual’s competency.
“AI is there to be leaned on, but what makes a CV stand out is the personal touch you add to it,” CEO Peter Duris commented.
“The specifics of your skills, experience, and achievements are only something individuals can provide.”
While Kickresume is discouraging the use of AI in producing CV content, it does recognize that generative AI has helped applicants express their own creativity. A quarter (24%) have seen an increase in personal branding and storytelling, and a fifth (18%) have seen more creative and infographic-style CVs.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Artificial intelligence is rapidly becoming part of everyday life, and that includes classrooms. Students are turning to tools like ChatGPT for homework, research, writing assistance, and even basic questions. But a growing number of educators, researchers, and policymakers are questioning whether introducing children to AI at such a young age could do more harm than good.
Norway appears to agree. The country has announced a near-total ban on generative AI tools for elementary school students, arguing that children need to develop fundamental reading, writing, and math skills without relying on AI. The move could become an early sign of a broader trend, especially as governments around the world take a tougher stance on children’s use of technology.

Norwegian Prime Minister Jonas Gahr Støre said the government is concerned that AI could cause younger students to skip important stages of learning. The administration argues that reading, writing, and mathematics should remain the primary focus during a child’s early education.
That said, Norway is not completely shutting the door on AI in education. Under the new guidance, students aged 6 to 13 should generally not use generative AI tools, while those between 14 and 16 may use them under teacher supervision. Students in upper secondary education, aged 17 to 19, will be taught how to use AI responsibly so they are better prepared for higher education and the workplace.

A recent study found that even short periods of AI-assisted work may reduce independent critical thinking. Participants who relied on AI assistance were significantly more likely to struggle or give up when that assistance was removed, suggesting that frequent reliance on AI may reduce persistence and independent thinking.
The study focused on adults, which raises an obvious question. If mature minds can become dependent on AI after only brief exposure, what happens when children with developing brains use these tools every day? That question is becoming increasingly difficult for educators and policymakers to ignore, and Norway’s new restrictions suggest some governments are no longer willing to wait for a definitive answer.

Norway’s AI restrictions are part of a wider trend. The country has already banned smartphones in schools and has proposed tighter controls on children’s access to social media. Similar debates are taking place around the world as governments become increasingly willing to intervene when new technologies are seen as posing risks to young users.
Just a few years ago, the idea of restricting children’s access to social media platforms was viewed by many as unrealistic. Today, age-verification laws, smartphone bans, and social media restrictions are becoming increasingly common. AI could be heading down a similar path.
The Epson HX-20 is sometimes referred to as an early laptop computer. It’s a little odd in its form factor, and in its storage, relying on a microcassette drive to store data. It can be problematic to keep these tapes and drives going after so many decades, so [Andrew Menadue] has been tinkering with a more modern solution.
The replacement drive uses a Raspberry Pi Pico to emulate the original tape drive. The Pico uses a microSD card to store data instead of the magnetic media of old. The device has a small screen for showing status information and four buttons for navigation, allowing the faux drive to be controlled as to what “tape” it’s pretending to be. It’s also possible to use the device to emulate ROM cartridges that could be used with the HX-20 in place of its original tape deck storage solution.
We’ve seen some other old hardware get similar drive upgrades before, too. No surprise, because mechanical drives and media simply don’t last forever. Sometimes you need to build a replacement that’s viable today. Video after the break.
No Jackpot Winner as $257 Million Prize Rolls Over to $269 Million Monday Draw
Zimbabwe Requires Crypto Businesses to Register Annually Under New FIU Regulations
Bitget enters Argentina’s regulated crypto market through PSAV registration
NanoClaw integrates JFrog registries to secure AI agent downloads
Matt Damon’s Viral Sci-Fi Thriller Has Taken Over HBO Max
Anthropic staff to meet White House officials next week, Axios reports
As AI companies race to go public, who else is along for the ride?
Bitcoin could crash to $48,000, if this historical pattern is triggered
Warning of disruption as Cardiff Crossrail works to start
“Israel’s” ban on ICRC visits ruled illegal, but Knesset moves to stop them permanently
Financial Accounting | Last Day Revision Strategy and Booster | CMA Inter – June 2026
Tributes to former deputy head teacher at Cambridge school among death and funeral notices
Deion Sanders Shares Powerful Post After Viral Advice To Deiondra
Weekend Open Thread: Miami – Corporette.com
what doctors are seeing in ebike crashes
Kate Middleton Glare Goes Viral After Kids Booed At Royal Event
XRP ETFs Outperform As Bitcoin And Ethereum Funds Extend Outflow Trend
Market Preview: SpaceX (SPCX) IPO Record, Federal Reserve Meeting, and Iran Nuclear Agreement
Over 400 Arch Linux packages compromised to push rootkit, infostealer
Invesco Quality Income Fund Q1 2026 Commentary
You must be logged in to post a comment Login