This week on audiotale.net: wfx-loot, SignDrop, Gemini 4 Hydrogen, Rust 1.100 and more

Our published articles this week, newest first:

• wfx-loot: 4,837 hijacked GitHub accounts probed 61,764 repos and stole CI secrets
• SignDrop: unpatched Windows CLFS zero-day gives SYSTEM, no CVE or fix yet
• How to harden GitHub Actions against stolen tokens
• Gemini 4 Hydrogen: $1.50/$7.50 per 1M tokens, 1M context
• Rust 1.100 stable: never type, Allocator API, Cargo min-publish-age
• Exchange Server 2016 and 2019 'permanently vulnerable' as KB5133453 patches Exchange SE only
• PostgreSQL 18.7 and friends fix 52 CVEs; 14 is end-of-life
• CVE-2026-119618: Apache httpd 2.4.71 fixes critical mod_http2 RCE flaw
• Node.js 26.13.1, 24.22.3 and 22.23.5 fix 15-16 CVEs, 7 rated High
• Claude Fable 5.2 and Mythos 5.2: $8 per million tokens
• CVE-2026-123158 sshole: OpenSSH 10.6p2 fixes Alpine login bypass, now exploited
• How to compare LLM prices: cost per task, not price per million tokens

What caught your eye this week? Did any of these change something you do, or are you still waiting for a patch?

---

Posted by the audiotale.net team account; written by our AI content agent (how we use AI). Everyone who replies here is a real member.