Moonshot's frontier-class open-weight model arrives as Anthropic grapples with Opus 5 errors
Plus: Node.js patches critical vulnerabilities, n8n and vBulletin fix exploited flaws, MCP overhauls its architecture, and Decker resurrects HyperCard.
TL;DR
- Kimi K3 weights (2.8T params, 1M context) drop July 27 as the largest open-weight model ever, with 16 of 896 experts firing per token.
- Anthropic Opus 5 experienced elevated error rates July 26-27 affecting claude.ai, the API, Claude Code, and Claude Cowork; root cause under investigation.
- n8n patched GHSA-gv7g-jm28-cr3m (CVSS 8.7) allowing authenticated users to execute OS commands; vBulletin fixed CVE-2026-61511, an unauthenticated pre-auth RCE via PHP eval().
- Node.js security releases (versions 26.x, 24.x, 22.x) address HIGH-severity vulnerabilities; n8n versions before 2.31.5 and 2.32.0-2.32.1 are affected.
Releases and versions
Open-weight frontier model lands as architecture rewrites ship
Moonshot's Kimi K3 and MCP's protocol overhaul reshape how developers build and deploy AI systems.
Moonshot AI released Kimi K3 weights on July 27: a 2.8-trillion-parameter model where only 16 of 896 experts fire per token. With 1 million token context and native multimodal support, the weights require 1.4TB in MXFP4 four-bit precision, available for download on HuggingFace. (via HuggingFace)
MCP removes legacy transport. The Model Context Protocol shipped its biggest update on July 26, shifting to stateless architecture where any server handles any request without persistent connections. Multi-round-trip requests let tools ask for user input mid-execution; routable headers simplify gateway routing; and standard error codes replace inconsistent implementations. (via The New Stack)
Decker revives HyperCard. Hacker News led with Decker on July 27: a free open-source multimedia platform inspired by HyperCard and early macOS. It features deep undo, touchscreen support, and cross-platform navigation across Windows, macOS, and Linux, making legacy-inspired content accessible on modern hardware. (via Hacker News)
Breakage and security
Three vulnerabilities see public exploits as Anthropic tracks elevated error rates
Pre-auth RCE in vBulletin, authenticated RCE in n8n, and production outage for Opus 5 all hit within 48 hours.
Anthropic investigated elevated error rates for Claude Opus 5 that began July 26 and persisted into July 27, affecting claude.ai, the Claude API, Claude Code, and Claude Cowork. The errors resulted in degraded performance rather than total unavailability, meaning some requests succeeded while others failed. Root cause analysis was ongoing as of July 27. (via Analytics Insight)
vBulletin eval injection goes public. CVE-2026-61511 is a pre-auth remote code execution flaw in vBulletin 6.2.1 and earlier where user input reaches PHP's eval() without sanitization. The regex filter allows XOR operators, letting attackers construct function calls using only bitwise operations. Patch 6.2.2 shipped July 1; Cloud sites are patched but self-hosted forums remain vulnerable. (via The Hacker News)
n8n patches authenticated sandbox escape. n8n fixed a high-severity expression-sandbox vulnerability (GHSA-gv7g-jm28-cr3m, CVSS 8.7) on July 27 that let authenticated workflow editors execute operating-system commands on the n8n host. Security Joes discovered the bypass while probing a prior fix; n8n patched versions 2.31.5 and 2.32.1 close the gap. Affected versions are <2.31.5 and >=2.32.0,<2.32.1. (via The Hacker News)
Node.js releases security updates. The Node.js project announced security updates for July 27 release across active lines 26.x, 24.x, and 22.x, addressing high-severity issues. Specific CVE details were embargoed until release time. Users should upgrade following the official schedule at nodejs.org. (via Node.js Blog)