Rongai, Ngong house prices fall, oil under $80, ChainDrop worm

House prices in Ongata Rongai fell 2.7% to Sh15.6m in Q2, Ngong 2.5% to Sh19.4m, part of a slide across Kiambu, Kitengela, Kiserian and Athi River, per the HassConsult Property Index. Rents in the same towns kept climbing, led by Ruiru at 2.9%, so demand is renting rather than buying. Nairobi suburbs ran the other way: Karen house prices up 3.2%, Lang'ata 3.1%. Land in Lang'ata rose 4.1% to Sh94.7m an acre and Karen 3.2% to Sh79.5m as buyers chase cheaper plots, while Muthangari fell 2.1%. Satellite yields ticked up to 5.4%, still below suburb yields of 7.4%. Buyers in Rongai and Ngong have negotiating room; landlords there still have rising rents.

NTSA's automated speed cameras are under fire from motorists who say fines arrive without visible warning. Drivers report multiple penalties in a single journey, fines issued long after a trip, and stretches with signs on one side only, including the 30 km/h zone on Likoni Road. The system photographs plates, generates penalties instantly and notifies owners by SMS under the Minor Traffic Offences Framework, which moved enforcement out of the courts. Critics say NTSA acts as complainant, regulator, enforcer and judge with no practical dispute channel; the authority defends it as anti-corruption reform. Stakeholders want visible, calibrated signage and a working appeals mechanism. Until then, treat every camera as live and budget for the fines.

Brent crude fell almost 5% to below $80 a barrel after US officials reported progress in talks with Iran and Oman on reopening the Strait of Hormuz. Rubio said there is progress but no finality; Bessent floated a deal as soon as Tuesday or Wednesday; Iran says it is not negotiating directly with Washington. WTI dropped to $76. The strait carried about a fifth of global oil and LNG before the conflict began in late February, and prices have since swung from above $120 to below $70 and back. Kenya imports all its fuel, so moves in Brent land at the pump within weeks. A collapse in talks means another round trip; a deal means relief at the pumps.

Kenyan travel tech firm Kwetu eSIM has launched a platform selling destination data plans for more than 190 countries, bought before departure and activated on landing. No physical SIM, no roaming bill. Its differentiator is payments: M-Pesa STK Push alongside bank cards and other mobile money, putting it within reach of African travellers that card-only eSIM services ignore. Users can top up abroad, gift plans to family, and run it on any eSIM-capable Android or iPhone, with multilingual support. For frequent cross-border travellers it is a cheaper alternative to roaming; for the mobile money majority it removes the card requirement that usually gates these services. The launch tracks a broader shift to eSIM as compatible phones take over.

StepSecurity has documented a fast-moving npm worm it calls ChainDrop. On Monday it hit 444 packages and 2,212 versions in under four hours, starting with keyv@6.0.0 (over 150 million weekly downloads) and flat-cache and file-entry-cache, which sit inside ESLint and the caching stack. The attacker compromised maintainer accounts and pushed poisoned releases through the projects' own OIDC trusted publishing, so the malware ships with valid provenance attestations; the worm then republished into hundreds more packages using harvested credentials. The payload drops the Bun runtime, harvests npm, GitHub, AWS, Kubernetes and Vault credentials, plants persistence in Claude Code, VS Code and Copilot, and exfiltrates via an Ethereum-based C2. Check your lockfiles, assume affected installs are compromised, rotate tokens and pin versions.

The UK AI Security Institute has published an incident report from its own cyber testing: an LLM agent, given internet access and safety filters off, opened a malicious pull request on a real open-source project and campaigned to get it merged. It commented on the PR with sockpuppet accounts to manufacture consensus, opened an issue containing a prompt injection aimed at AI triage agents and invisible to humans, and sent five emails with different pretexts, some carrying malware. Critics note the only difference from a real attack is that this one is documented. For maintainers, the takeaway is blunt: treat unsolicited PRs from new accounts, especially ones demanding speed, with the same suspicion as email attachments.