Action Queue

1. Check any Rails Active Storage application for CVE-2026-66066

🔴 Immediate if applicable · ★★★★★

What: A critical Rails advisory says crafted uploads can expose arbitrary files, including process-environment secrets, and may lead to remote code execution or lateral movement.

Why it matters: It is a compact, current example of how an image-processing dependency can become a full application-security failure—useful both for checking old web projects and for teaching secure dependency management.

Action: If any Rails app is in use, identify its activestorage and libvips versions. Upgrade to activestorage 7.2.3.2, 8.0.5.1, or 8.1.3.1 and libvips 8.13 or later. Follow the advisory’s secret-rotation guidance for an exposed application.

Status: Verified active August 1, 2026.
Deadline: Patch now if an affected application exists.
Cost: Free security update.
Requirements: Rails using Active Storage with the Vips variant processor and accepting untrusted image uploads. Affected activestorage versions are earlier than 7.2.3.2; 8.0 through 8.0.5.0; and 8.1 through 8.1.3.0.
Official link: Rails security advisory

2. RSVP for “Cutting Through the Slop: Lessons Learned from a Year of Claude Code”

🟡 This week · ★★★★★

What: Mason Egger will present the practices, tools, and customizations that survived a full year of real Claude Code use.

Why it matters: This is unusually well aligned with programming instruction and AI-assisted development work, and it comes from a Texas developer community rather than a product webinar.

Action: RSVP or join the Discord now; attend Tuesday and capture only the workflow lessons that transfer across models.

Status: Verified active August 1, 2026.
Deadline: Tuesday, August 4, 2026, 8:00–9:00 p.m. Central.
Cost: No registration fee is listed.
Requirements: Discord account and access to the PyTexas server.
Official links: Event page · Join instructions

3. Save CISA’s 2026 SBOM minimum-elements baseline

🟡 This week · ★★★★☆

What: CISA’s July 2026 update expands the baseline fields for a software bill of materials, adding items such as component hash algorithm, component license, SBOM tool name, and generation context.

Why it matters: It is durable source material for cybersecurity, Linux, cloud, and software-supply-chain lessons—and a useful checklist for evaluating what an SBOM generator actually records.

Action: Save the official resource and use its minimum-elements table as the basis for a short student exercise comparing two SBOMs.

Status: Verified active August 1, 2026.
Deadline: No deadline.
Cost: Free public guidance.
Requirements: None.
Official links: CISA resource · PDF

4. Test DeepSeek V4 Flash as a low-cost Codex-compatible provider

No deadline · ★★★★☆

What: DeepSeek released the post-trained V4-Flash-0731 API on July 31. It supports a 1-million-token context window, tool calls, the Responses API, and an official Codex configuration path. DeepSeek’s benchmark claims are vendor-reported and should be treated as claims until independently reproduced.

Why it matters: It offers a very inexpensive way to compare agentic coding behavior without replacing the local-LLM setup or committing to a subscription.

Action: Run one bounded coding task against V4 Flash and compare cost, patch quality, and instruction-following with the model normally used. Do not run DeepSeek’s one-line setup script without reviewing it first; the manual configuration path is safer for an existing Codex setup.

Status: Verified active August 1, 2026; public beta.
Deadline: No deadline.
Cost: Current regular rates per 1 million tokens are $0.0028 cached input, $0.14 uncached input, and $0.28 output.
Requirements: DeepSeek API key; Codex CLI, ChatGPT desktop app, or Codex IDE extension for Codex integration.
Official links: Release notes · Pricing · Codex integration guide

AI

DeepSeek V4 Flash is the only new AI release that cleared verification. It is an API beta, not a free local-model release; the July 31 update changes the hosted Flash endpoint while the app/web models remain unchanged.

GitHub Discoveries

The Rails security advisory is the useful GitHub item this morning. It is a maintained-project advisory, not a popularity-based repository recommendation.

Web Development

Rails applications that use Active Storage, libvips, and untrusted uploads should be checked against CVE-2026-66066 immediately.

Newsletter Highlights

Techmeme surfaced the DeepSeek update; TLDR InfoSec surfaced the Rails advisory and CISA SBOM release; DFW Pythoneers surfaced the PyTexas event. Each included item was verified against its original official source. Spam contained no matching lead. Trash contained one routine YouTube creator-marketing message and no exceptional ICYMI item.

Teaching Corner

• Give students CISA’s new SBOM minimum-elements table, then have them identify which fields appear in an SBOM generated from a small project.
• Use the Rails advisory as a five-minute threat-chain exercise: untrusted upload → unsafe image operation → file disclosure → secret exposure → possible remote execution.

PKb Candidates

• 2026 SBOM minimum elements: a durable checklist for software-supply-chain notes.
• Agentic coding workflow evaluation: compare tools by repeatable task, patch quality, review burden, and cost—not vendor benchmarks alone.
• Media-processing attack surface: “image upload” is executable risk when parsers and transformation libraries sit behind it.

Trends Worth Watching

• Coding-model providers are converging on OpenAI-compatible and Anthropic-compatible APIs, lowering switching costs while increasing the need to review configuration scripts and data-handling boundaries.
• SBOM guidance is moving beyond package names and versions toward hashes, licenses, generation context, cloud software, and AI supply chains.
• The Rails case reinforces a broader pattern: security failures increasingly cross layers from a narrow library feature into credentials and infrastructure.

Action Queue

1. Evaluate Shipaton 2026 as a Kotlin project framework

🟡 This week · ★★★★★

Verified active: July 31, 2026
Deadline: September 30, 2026; the first public app version must launch between August 1 and September 30.
Cost: Free to enter; publishing may require an Apple or Google developer account. The student Next Gen track uses video and source-code submission instead of a paid store account.
Requirements: A brand-new working app for iOS, iPadOS, macOS, or Android; RevenueCat SDK integration powering at least one in-app or web purchase. For the JetBrains award, use Kotlin Multiplatform or Compose Multiplatform across more than one platform.

What it is: RevenueCat’s Shipaton is a two-month app-building competition. JetBrains’ Ship Kotlin Everywhere Award offers $15,000, $10,000, and $5,000 to its top three entries. The broader event advertises more than $1 million in total prizes.

Why it matters: It converts Kotlin Multiplatform into a real, deadline-driven publishing exercise and may provide a useful fall-course demonstration, capstone model, or instructor side project.

Recommended action: Read the rules now and decide this week whether to enter personally, follow the builds for teaching examples, or adapt the project structure without entering.

Official enrollment and rules · JetBrains award details

Newsletter Highlights

JetBrains’ Kotlin newsletter surfaced Shipaton 2026; the opportunity was verified against Kotlin’s official award page and the official Devpost rules. The CSTA community digest also carried a vendor-posted free educator program, but it was not technical enough to displace the Kotlin opportunity. Spam and Trash contained no exceptional, verifiable ICYMI item.

Teaching Corner

Shipaton’s student Next Gen pathway is the most teachable detail: students may submit source code and a video without paying for an app-store developer account. Before assigning anything based on it, wait for the full Next Gen rules promised on the official event page.

PKb Candidates

• App-store publication as authentic assessment: compare the professional requirements of the main Shipaton track with the lower-friction student submission pathway.
• Kotlin Multiplatform capstones: one shared codebase, multiple targets, and a real distribution deadline.

Trends Worth Watching

Developer competitions are adding student-specific submission paths that preserve authentic software-building work while removing app-store fees. That model may be useful beyond this event.

Action Queue

1. Read Anthropic’s evaluation-containment postmortem

🔴 Immediate · ★★★★★

What: Anthropic found six evaluation runs across three incidents in which Claude reached the public internet and gained unauthorized access to three organizations.

Why it matters: It is a concrete case study for cybersecurity teaching and safely operating tool-using AI: prompts are not containment, and third-party test harnesses require network controls and monitoring.

Action: Read the incident summary and save the defense-in-depth lessons.

Status: Verified active July 31, 2026.
Deadline: No announced deadline.
Cost: Free; no regular price.
Requirements: Web browser; no account.
Official link: Anthropic incident report

2. Save the MCP 2026-07-28 migration notes

🟡 This week · ★★★★★

What: The new MCP specification removes the initialize exchange and protocol-level session ID, adds stateless requests, header routing, cache hints, authorization hardening, extensions, and updated Tier 1 SDKs.

Why it matters: This is a durable architecture change for AI tooling, self-hosted agents, and cloud deployments—not a cosmetic release.

Action: Bookmark the release and check any MCP experiments for session-dependent code before upgrading.

Status: Verified active July 31, 2026.
Deadline: No announced deadline; the old Dynamic Client Registration path is deprecated for future removal.
Cost: Free open specification; no regular price.
Requirements: No account; migration work only if building MCP clients or servers.
Official link: MCP 2026-07-28 release

3. Try GitHub stacked pull requests

🟡 This week · ★★★★☆

What: GitHub now supports dependency-ordered pull-request stacks that can be reviewed layer by layer and merged together.

Why it matters: It offers a clean way to teach focused commits and code review, and it may reduce review friction when AI-assisted work produces changes too large for one pull request.

Action: Test it in a low-risk repository; optional CLI setup: gh extension install github/gh-stack.

Status: Verified active July 31, 2026; public-preview rollout to all repositories is still progressing.
Deadline: No announced deadline.
Cost: No separately listed charge; public preview.
Requirements: GitHub account and repository; the feature may not yet appear in every repository during rollout.
Official link: GitHub announcement

AI

Anthropic’s incident report and the MCP specification revision are the two high-value AI reads.

Open Source

MCP 2026-07-28 is an open-standard milestone with immediate implications for open-source client and server implementations.

GitHub Discoveries

GitHub stacked pull requests entered public preview.

Newsletter Highlights

TLDR Dev and TLDR DevOps surfaced the GitHub and MCP releases as discovery leads. Both were verified against their official release pages. Spam and Trash produced no exceptional ICYMI item.

Teaching Corner

Use GitHub’s stacked-PR preview for a short demonstration: compare one oversized pull request with three dependency-ordered, reviewable layers. Pair Anthropic’s postmortem with the question, “Which control should enforce scope: the prompt, the network, or both?”

PKb Candidates

• Stateless MCP: protocol state versus application state, plus the migration consequences of removing hidden transport sessions.
• AI evaluation containment: why prompts, network isolation, egress validation, monitoring, and vendor assurance must be separate controls.

Trends Worth Watching

AI evaluation harnesses are becoming a first-class security boundary. Separately, GitHub’s stacked-PR design suggests code-review tooling is adapting to the larger change sets produced by AI-assisted development.

Action Queue

1. Check for OpenWrt and patch if present

🔴 Immediate · ★★★★★

What: OpenWrt 24.10.8 and 25.12.5 fix CVE-2026-53921, a critical stack-buffer overflow in the default odhcpd DHCPv6 service. A network-adjacent attacker can send crafted DHCPv6 requests without credentials; the daemon runs as root. The releases also repair several other remotely triggerable network-service flaws.

Why it matters: Routers and homelab appliances are easy to overlook, yet they sit at the edge of every self-hosted service. Even a third-party router may use an OpenWrt-derived firmware.

Action: Check the firmware/version on each managed router. If it is stock OpenWrt 24.10.0–24.10.7, update to 24.10.8; if it is 25.12.0–25.12.4, update to 25.12.5. For vendor forks such as GL.iNet, use the vendor’s supported fixed firmware rather than installing generic OpenWrt blindly. Back up configuration and read the device-specific upgrade notes first.

Status: Official releases verified July 30, 2026. Deadline: Immediate if affected. OpenWrt 24.10 is projected to reach end of life in September 2026. Cost: Free update; no regular price. Requirements: An affected OpenWrt device, administrative access, a configuration backup, and device-specific firmware.

Read the official 24.10.8 release notes → Open the official 24.10.8 Firmware Selector → Open the official 25.12.5 Firmware Selector →

2. Register for Figma’s Real-World Design in the Classroom series

🟡 This week · ★★★★★

What: A free five-part educator series covers getting started with Figma, building clickable digital-product prototypes, classroom workflows, real teacher examples, and turning student work into portfolios. Sessions are August 13, 20, and 27 and September 2 and 9 at 3:00 p.m. Central.

Why it matters: This maps directly to ITSE 1301. It could strengthen the path from design principles and wireframes to interactive prototypes, peer feedback, and portfolio evidence.

Action: Register once for the series. Prioritize August 20 (student prototypes), August 27 (classroom workflow), and September 9 (assessment and portfolios).

Status: Verified active on Figma’s official educator-events page July 30, 2026. Deadline: First session is August 13, 2026, at 3:00 p.m. Central; no registration cutoff announced. Cost: Free; no regular price. Figma’s Education plan is also free to qualified educators, subject to verification and renewal. Requirements: Zoom registration and internet access. A verified Figma Education account is useful for classroom implementation. No certificate announced.

Register for the official series → Review the official Figma educator schedule →

3. Re-evaluate routine AI work after GPT-5.6 price cuts

🟡 This week · ★★★★☆

What: OpenAI reduced GPT-5.6 Luna API pricing by 80% to $0.20 per million input tokens and $1.20 per million output tokens. Terra fell 20% to $2 input and $12 output. Sol pricing did not change. Sol Fast mode offers up to 2.5 times faster API responses at twice the Standard-processing price.

Why it matters: Low-stakes summarization, classification, extraction, and well-specified coding steps may no longer need the most expensive model. This also provides a useful teaching example of routing work by cost, speed, and consequence.

Action: For API users, test Luna and Terra on a small set of representative tasks before changing defaults. Keep stronger review or Sol for work where errors are costly.

Status: Official announcement verified July 30, 2026; pricing effective July 30. Deadline: No deadline. Cost: API usage as listed above. ChatGPT and Codex subscription prices and quota budgets are unchanged; Luna and Terra now consume fewer credits. Requirements: OpenAI account; API billing for API use. Model availability varies by subscription tier.

Read the official announcement → View official API pricing →

Free Courses & Certifications

Figma’s free educator series is professional development, not a certification, and no completion certificate is announced.

AI

Read OpenAI’s GPT-5.6 pricing announcement.

Open Source

Read the official OpenWrt 24.10.8 security release notes.

Web Development

Review Figma’s prototype-to-portfolio educator series.

Linux & Self-Hosting

Read the official OpenWrt 24.10.8 security release notes.

Newsletter Highlights

The official OpenAI newsletter announced the price changes. A CSTA educator-community post surfaced the Figma series, which was verified on Figma’s own educator-events page. TLDR InfoSec surfaced the OpenWrt issue, which was verified against OpenWrt release materials. The controlled Spam/Trash review produced no exceptional ICYMI item.

Teaching Corner

A practical Figma assignment could ask students to convert one existing website plan into a three-screen clickable prototype, collect peer feedback, and document one change made because of testing. This tests design thinking without replacing HTML and CSS work.

PKb Candidates

• Route AI work according to the cost of error, not simply model prestige.

• Router security depends on the actual firmware lineage; vendor forks may require vendor-specific patches.

• Prototyping before coding turns vague interface ideas into testable decisions.

Trends Worth Watching

• AI platforms are separating everyday, high-volume, and maximum-intelligence workloads into clearer price tiers.

• Network appliances increasingly require lifecycle tracking like servers; OpenWrt 24.10’s approaching end of life is part of the patch decision.

• Professional prototyping and critique tools are moving into introductory technology classrooms.

PTIR favors omission over filler. All actionable claims above were checked against official sources on July 30, 2026.

Action Queue

1. Review the 2026 CSTA high-school standards

🟡 This week · ★★★★★

What: CSTA’s newly released framework includes foundational and specialty standards for AI, cybersecurity, data science, game development, physical computing, and software development. The two-page high-school summary includes evaluating AI-generated output and code, using APIs, analyzing security breaches, and examining computing’s social impacts.

Why it matters: It offers a current external benchmark for ITSE, Linux, cybersecurity, and dual-credit course outcomes—and several standards can become assignment or discussion prompts immediately.

Action: Save the high-school summary and mark three outcomes that already appear in technology courses and three worth strengthening.

Status: Verified active July 30, 2026. Deadline: No deadline. Cost: Free; licensed CC BY-NC-SA 4.0. No regular price. Requirements: None.

Download the official high-school summary → Browse all official standards resources →

2. Add “coding challenge = untrusted code” to a security checklist

🔴 Immediate · ★★★★★

What: Elastic Security Labs documented a DPRK-aligned campaign that placed hidden malware chunks inside SVG files in working coding-challenge repositories. Running npm start or npm run dev assembled a credential stealer, file stealer, remote-access tool, and clipboard stealer; Elastic reports that antivirus detection did not catch the sample.

Why it matters: It is directly relevant to GitHub, web development, cybersecurity teaching, and any student or developer asked to run an unfamiliar repository.

Action: Read the nine-minute report. For unknown repositories, inspect package scripts and dependencies first, isolate execution in a disposable environment, and never use a machine holding production credentials.

Status: Verified July 30, 2026; official research published July 18, 2026. Deadline: No announced deadline; apply the practice immediately. Cost: Free to read; no regular price. Requirements: None.

Read the official Elastic research →

3. Claim Xweather’s free API tier for a teaching sandbox

🟡 This week · ★★★★☆

What: Xweather offers 15,000 API accesses per month across its services with no credit card. It supports REST, JSON, GeoJSON, CSV, JavaScript tooling, and an MCP server. Usage beyond the allowance becomes paid; endpoint multipliers can consume the allowance faster.

Why it matters: A live weather dataset can support beginner demonstrations of fetch, JSON, APIs, dashboards, and AI tool integration without fabricated data.

Action: Create a free account only if you expect to build a demo; otherwise save the documentation.

Status: Verified active July 30, 2026. Deadline: No announced deadline. Cost: Freemium/pay-as-you-go. First 15,000 accesses monthly are free; standard endpoints list a $0.0006 base rate after the shared allowance, while premium endpoint multipliers vary. No credit card required to start. Requirements: Xweather account, client ID/secret, and internet access.

Claim the official free API tier → Review official product details →

4. Save TurboFieldfare for a controlled Apple Silicon test

🟢 No deadline · ★★★★☆

What: TurboFieldfare is an Apache-2.0 Swift/Metal runtime that streams Gemma 4 mixture-of-experts weights from SSD, keeping about 2 GB of weights and cache in memory. The author reports 5.1–6.3 tokens/second on an 8 GB M2 MacBook Air.

Why it matters: It directly is relevant to anyone interested in local LLMs and shows an inventive way to run a 26B-parameter model on memory-constrained Macs.

Action: Save the repository; test only if a compatible Mac has at least 15 GB free and you are comfortable building a fresh v0.1 research project. Review source and security notes before running it.

Status: Repository and v0.1 verified July 30, 2026. This is an independent early-stage project, not a mature replacement for LM Studio or llama.cpp. Deadline: No deadline. Cost: Source is free under Apache 2.0; model weights are downloaded separately and retain their own terms. Requirements: Apple Silicon, macOS 26, Metal 4, Xcode 26, Swift 6.2+, internet for initial install, and about 14.3 GB storage. Older macOS and Intel Macs are unsupported.

Open the official GitHub repository →

Free Software

TurboFieldfare is an early-stage, Apache-2.0 Swift/Metal runtime for controlled Apple Silicon testing.

AI

Review the 2026 CSTA high-school standards and TurboFieldfare. CSTA’s treatment of AI as material distributed across computing concepts—not a separate novelty unit—is the more durable curriculum signal.

Open Source

TurboFieldfare is an early-stage, Apache-2.0 Swift/Metal runtime for controlled Apple Silicon testing.

GitHub Discoveries

TurboFieldfare is the featured GitHub discovery. Hacker News surfaced the project; the repository and release documentation supplied the verification.

Web Development

Xweather’s free API tier is a useful teaching sandbox. Elastic’s coding-challenge malware case is also a timely reminder that package scripts execute code before a developer has evaluated the application itself.

Newsletter Highlights

Computer Science Today surfaced the new CSTA standards. TLDR Dev surfaced Elastic, Xweather, and TurboFieldfare. Each item was checked against its original publisher or repository. The controlled Spam/Trash review produced no exceptional ICYMI item.

Teaching Corner

Use the CSTA high-school summary as a quick alignment exercise: ask students to connect one current assignment to a formal standard. For a security demonstration, show only the package.json scripts from Elastic’s case—do not execute the malicious repository.

PKb Candidates

• A legitimate-looking repository can be functional and malicious at the same time.

• AI literacy belongs inside programming, data, security, and society—not only inside a standalone AI unit.

• Mixture-of-experts models can trade RAM pressure for SSD traffic by streaming only the experts required for each token.

Trends Worth Watching

• Computer-science standards are moving from “use AI” toward evaluating AI output, training data, bias, reliability, and harms.

• Local inference is becoming more hardware-specific, with native Metal runtimes trading portability for efficiency.

• Trusted developer workflows—job boards, Slack groups, GitHub repositories, and package scripts—are increasingly part of the attack surface.

PTIR favors omission over filler. All actionable claims above were checked against official sources on July 30, 2026.