Coldcard wallet flaw drains 594 BTC ($38M) from 500 wallets in a 25-minute sweep

GitHub Copilot in VS Code redesigns its Agents window, adds git-worktree multi-session support

GitHub's July 2026 Copilot update for VS Code overhauls the Agents window with a shared tab bar, per-file change counts, and a more compact diff view, and lets Copilot, Claude, or Codex sessions each run in an isolated Git worktree. Copilot vision, for adding images and PDFs to chat, also reached general availability.

why it mattersRunning several agent sessions in parallel, isolated worktrees is becoming a baseline expectation for coding agents rather than a power-user trick.

GitHub

GitHub Copilot code review's agent skills and MCP support reach general availability

Copilot code review can now invoke a team's own SKILL.md-defined tools and standards, and pull live context from MCP servers such as issue trackers or documentation systems; all MCP calls are read-only. The feature moved from public preview to GA for Pro, Pro+, Business, and Enterprise users.

GitHub

DeepSeek ships V4-Flash-0731, beating its own larger Pro model on nine agent benchmarks

DeepSeek put the official V4-Flash API into public beta under build 0731. The re-post-trained model keeps the same architecture as the earlier preview but now outscores DeepSeek's bigger V4-Pro-Preview on every published agent and coding benchmark, including a jump to 82.7 on Terminal-Bench 2.1, while pricing stays well below the Pro tier.

why it mattersA cheap, fast model beating its own flagship on agent benchmarks keeps pressure on Western labs' pricing.

TechNode

Google DeepMind launches Gemini Robotics 2 for whole-body humanoid control

Gemini Robotics 2 extends Google DeepMind's robotics models beyond upper-body manipulation to full whole-body control — walking, crouching, bending — demonstrated on Apptronik's Apollo 2 humanoid. A companion on-device model can adapt to new dual-arm robot platforms from fewer than 200 training examples.

Google DeepMind

pip 26.2 ships --only-deps, letting developers install a package's dependencies without the package itself

The new pip release adds an --only-deps flag to install a package's runtime dependencies without the package, plus --no-require-hashes for mixed hashed/unhashed requirements, experimental venv-based build isolation, and Python 3.15 support.

why it mattersCloses a 16-year-old gap that developers have been working around with manual requirements-file hacks for container builds and testing environments.

Python.org

GitHub Actions starts enforcing minimum runner versions for Enterprise Cloud with Data Residency

As of July 31, self-hosted runners older than the minimum supported version (older than 2.329) can no longer register or reregister with GitHub Enterprise Cloud with Data Residency; the same enforcement lands for standard GitHub Enterprise Cloud on September 25.

GitHub

Bitcoin holds its July gain despite the Coldcard fallout

Bitcoin is on pace to end July up roughly 7.5% even after a hawkish Fed, a broader AI-stock selloff, and the Coldcard theft. Analysts say heavy leveraged positioning was already flushed out in June, which limited forced selling through this latest bout of volatility.

CoinDesk

Traders load up on $60K puts as sentiment turns bearish for August

The $60,000 bitcoin put is now the most popular position on Deribit, the largest crypto options exchange, as traders hedge against a seasonal August pullback — a month that has historically followed a green July with a median return of roughly -7.5%.

CoinDesk