Today's Hacker News Digest: Ghost Answer Attack Exposes Billions of Devices

Over two billion devices are vulnerable to a new DNS cache poisoning attack called Ghost Answer. That's the number from a paper published this morning by researchers at the University of Cambridge, and it means the fundamental address book of the internet is, once again, dangerously unreliable. Last week on episode seventy-five, we talked about finding the Hacker News threads that truly matter. A bug that could silently redirect a quarter of the planet's internet traffic to a malicious server… yeah, that qualifies. So, what else is burning up the front page today, June ninth, 2026? First up, Google just open-sourced a new programming language called Cognita, designed from the ground up for building and training large AI models.

But the reception is… spicy. The top comment on Hacker News right now says its core design choice—a novel form of concurrent garbage collection—is, quote, "an elegant solution to a problem that shouldn't exist." We’ll get into that. Next, a much smaller story that’s punching way above its weight. A stealth startup called Memryx published benchmarks for what they’re calling “computational RAM,” and the numbers are frankly absurd. They're claiming a seventy-five-X speedup on certain types of matrix multiplication by performing the math inside the memory chips themselves, which would be a fundamental break from seventy years of computer architecture. Naturally, the community is trying to tear the paper apart, and so far… it’s holding up.

Finally, the CEO of collaboration software company Huddle, a big remote-work champion, wrote a blog post titled "Asynchronous Is A Trap." He argues that the obsession with avoiding meetings has just created a different kind of burnout from constant, low-grade notification anxiety. The Hacker News thread is, as you can imagine, a perfectly balanced and civil discussion. No, it’s a complete warzone between the "never-meeting" crowd and the "sync is underrated" camp. It's a proxy war for the soul of remote work, happening in real time. We’re going to focus on the two biggest stories today: that DNS vulnerability and Google's new programming language. Because both of them are about challenging the very foundations we build on.

Okay, let's start with Ghost Answer. To understand why this is such a big deal, you need to know what DNS cache poisoning is. It's simple, really. When you type a website like google dot com into your browser, your computer asks a DNS server, "Hey, what's the real address for this?" The server looks it up and gives you back an IP address, like a phone number. To be efficient, that server then caches the answer for a little while. Cache poisoning is when an attacker tricks that server into caching the wrong address. So the next time you ask for your bank's website, you get sent to a perfect replica run by a thief. The web's entire trust model breaks. Now, where have we seen this before? The pattern here is a direct echo of 2008.

A security researcher named Dan Kaminsky found a massive, fundamental flaw in DNS that made this kind of poisoning trivial. It was a global, coordinated, secret effort to patch the internet before the bad guys could exploit it. It was one of the defining moments in cybersecurity history. The Ghost Answer vulnerability, discovered by this Cambridge team, feels like the sequel. So what’s different? The Kaminsky bug was about guessing a specific ID number in the DNS request. It was like picking a lock. The patches made that number much, much harder to guess. Ghost Answer is more subtle. It doesn't try to guess the lock. Instead, it exploits a loophole in how different DNS servers talk to each other when they're trying to resolve a complex address.

It sends a cleverly crafted query that causes one server to give a slightly ambiguous response, and the receiving server… well, it makes the wrong assumption and caches a malicious record. It’s less like picking a lock and more like social engineering the locksmith. And here’s where the analogy to 2008 breaks down. The Kaminsky patch was relatively straightforward—increase the randomness, problem solved. The fix for Ghost Answer is way messier. It touches a part of the DNS protocol that hasn't been updated in twenty years because, frankly, everyone was afraid to break it. The fix requires updating the core logic in BIND and dnsmasq—the two pieces of open-source software that basically run the global DNS system.

And because these systems are embedded in everything from home Wi-Fi routers to massive cloud infrastructure, patching two billion devices is going to be a long, painful process. This isn't a quick fix. This is a multi-year cleanup. Now for the second big story: Google’s new programming language, Cognita. On the surface, it looks like another entry in a crowded field. It’s a compiled, statically-typed language, borrowing ideas from Go, Rust, and Swift. But its entire reason for being is to make building massive AI models less of a black art. Right now, if you're training a model with trillions of parameters, you spend half your time fighting with memory allocation, GPU scheduling, and just… getting the data to the processors fast enough.

Cognita promises to abstract most of that away. It has a feature called "model-aware scheduling" that tries to intelligently manage how different parts of a neural network are trained across thousands of GPUs. It’s ambitious. So why the controversy? It comes down to one thing: garbage collection. In most languages, when a piece of memory is no longer needed, a process called the garbage collector, or GC, swoops in and cleans it up. But this can cause tiny, unpredictable pauses. For most apps, you'd never notice. For an AI model trying to max out ten thousand GPUs at once, a millisecond pause can throw the whole symphony out of tune. Rust solves this with its famous borrow checker, which enforces memory safety at compile time—no GC needed.

But it comes with a steep learning curve. Cognita tries to split the difference. It has a concurrent garbage collector that runs alongside the main program, trying to clean up memory without causing those "stop-the-world" pauses. And that’s what the Hacker News thread is tearing apart. The purists say if you're designing a systems language for performance, any GC is a compromise. They see it as a design flaw, a concession to developer convenience over raw power. And here's the pattern-matching moment. This isn't a new debate. It's the exact same shape as the arguments around Go when it first launched. Go was criticized for its simplicity, for not having features like generics that C++ and Java developers were used to.

The Go team's argument was that this simplicity made it easier to build and maintain massive, concurrent systems. They were optimizing for large teams of engineers, not for the most elegant possible code. And they were right. Go now powers a huge chunk of the cloud. Google seems to be making the same bet with Cognita. They're betting that for AI development, the bottleneck isn't raw performance as much as it is developer productivity and the ability to manage mind-boggling complexity. They’re willing to sacrifice a little bit of theoretical perfection for a system that’s easier to reason about at scale. The analogy with Go holds here: a big corporation introduces an opinionated language to solve a problem they have internally, and the open-source community debates whether those trade-offs make sense for everyone else.

Whether Cognita becomes the next Go or the next Dart… that depends on whether Google's specific problems are actually everyone's problems. So you have two stories dominating the conversation today. One is about a flaw in a system we all thought was settled—the internet's phone book. The other is a proposal for a new foundation for the next wave of technology—the language we'll use to build AI. They feel different, but they're connected. Both Ghost Answer and Cognita are forcing a conversation about the fundamental building blocks we rely on. Ghost Answer reveals that our old foundations are more fragile than we assumed. Cognita argues that our future foundations need to be built in a completely new way.

It's a reminder that in technology, nothing is ever truly finished. You don't just build a skyscraper and walk away. You have to constantly check the foundation, and sometimes, you have to redesign it from the ground up while people are still living on the top floor. This week sets up a critical test for the open-source ecosystem. Can the community coordinate a complex, messy patch for a core protocol like DNS faster than attackers can weaponize the exploit? And will developers embrace a new, opinionated tool like Cognita, or will the inertia of existing systems—Python, PyTorch, JAX—prove too strong? One is a race against decay, the other a race toward a new paradigm. The real takeaway from today isn't just the vulnerability or the new language.

It's the realization that the most important work in technology isn't always about building the shiny new thing on top. It's about the brutal, unglamorous, and absolutely essential work of rebuilding the ground beneath our feet.