48 links from the last 24 hours · 21 October 2026
For the past month or so, I have been on a digital declutter. I only realized this today, because this was not something I planned. I guess it just happened.
LLM-based agents can do a lot of tasks. Or, at least, they can appear to do them. For example, they write code, summarize papers, plan trips, and fill in forms. If you ask one for a probability or a confidence score, it will give you one of those too. I have s…
Claude Duet | Your personal AI assistant
Claude Duet is a personal AI agent you message. It handles your inbox, calendar and follow-ups and messages you when something needs you. Join the waitlist.
Going down an Android reverse-engineering rabbit hole.
Why do my tables collapse into one column? Strict CSP vs inline styles in React
A strict CSP blocks style attributes in server-rendered HTML, so a React table collapses after a page refresh. Here's why it happens and 4 ways to fix it.
How Dushed gets and renews its TLS certificates automatically.
File Attack Deep Dives: Office Documents as an Attack Surface – Mohit Khare
Every way an Office document attacks: macros, remote templates, embedded objects, hyperlinks, QR handoffs and invoice fraud, plus the signals that catch each.
The Rise of Highly Personal Software – Michael Bassili
I think there’s a strong desire for uniquely personalized software permeating the market these days, spurred by the commodification of cheap large language models from Anthropic, OpenAI, and Google. We saw companies try their hand as enabling this kind of beha…
Postgres recovery_prefetch Considered Harmful and Causing Outages
Another story of something I saw in the field which surprised me. Turns out recovery_prefetch can cause outages. Something which has been happening quietly in the background all the time, but we di…
Design files are becoming text
A design saved as JSON is plain text that scripts, LLMs and validators can read and write. How the format works, what it unlocks, and what still breaks in production.
Shopify shops are being hit with a checkout hijack campaign through HulkApps/Swym/Selleasy Shopify extensions.
Coding agents got good at resolving merge conflicts this year, and racing your coworkers to merge first stopped making sense.
would I have learned as much with an LLM?
incidental learning in the age of LLMs.
This feature allows you to register multiple mappings in order to load local files through custom https:// URLs. This prevents having to spawn a HTTP server to test a web page. This makes it easy to test all Web APIs, including the ones being restricted to Sec…
Good Engineering Isn't the Point — Mike Longin
"Don't fuck up the product." I was sitting across the table from Scott Scherr, the founder and CEO of Ultimate Software, sharing a drink when he gave me that advice. It wasn't particularly eloquent, and it certainly wasn't the kind of carefully polished corpo…
When agents do the execution, every result comes back to you as a handoff. Medicine, the military and aviation worked out long ago how to hand over to someone who has little time and has to decide.
Accident Or Not, The No Kings Takedown Is Why You Shouldn’t Rent Your Megaphone From Zuck
This past weekend was the latest in an ongoing series of (massive) “No Kings” protests held around the country (and in some cases around the globe). The latest one was part of a “…
If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits …
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
Can they write a function?
For a software developer position, there isn't a trick to finding the best candidate. Your criteria do not determine how solid the candidates will be. Everyone is submitting 500 applications a month n
Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk …
Do minor curl vulnerabilities in the open
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in ou…
Why didn't we use RoRegisterForApartmentShutdown to clean up the unmarshalable delegate? - The Old New Thing
Too many requirements, some of which bring us full circle.
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team is happy to announce that today we're releasing DuckDB version 2.0.0 LTS, codenamed “Cinnamon Teal” (Spatula cyanoptera). This is our biggest feature release so far, and it ships a polished version of the Quack protocol, asynchronous I/O, a fir…
Building operating systems that do one thing with OCaml and Solo5.
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
sparqlite is a Rust-based SQLite loadable extension that stores RDF quads in ordinary SQLite tables and executes SPARQL 1.1 queries and updates natively inside the SQLite process. Its integer-encoded terms, …
Microspeak: Drain the slide, back-up slides - The Old New Thing
PowerPoint presentation jargon.
PHP
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
How I got over 300 Tor exit nodes removed
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
This morning, two critical PHP Security Advisories were published: RCE via OOM corruption (9.2/10) RCE via stale global state (9.2/10) If you're running PHP for any service, you need to upgrade immediately to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. And if you use R…
Release PHP 8.2.35 · php/php-src
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthe...
Climate: The 1.5°C goal of the Paris Agreement is no longer viable
UNEP's Emissions Gap Report 2026 warns that exceeding 1.5°C is inevitable and calls for urgent emissions cuts to limit warming and reverse the trend.
The Future of CSS ✨ • Josh W. Comeau
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a gli…
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
We want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical). The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We encourage all PHP users to prepare now so you …
This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome …
Nicolas Mattia – Setting up SSH keys on macOS with Touch ID
A simple and secure way to create SSH keys on a Mac's Secure Enclave with Touch ID protection
For the past month or so, I have been on a digital declutter. I only realized this today, because this was not something I planned. I guess it just happened.
“Vibe coding” is a category error
Why the term “vibe coding” massively misrepresents and trivialises the fundamental transformation of software development as we know it.
you're still going to have a job in 5 years. — Whiteboard by /dev/fast
Automating coding is not the same as automating engineering. Engineering is not solved, and it's not even close.
ClickHouse Will Let You Be Wrong at Scale
So I've posted before how I think ClickHouse is great. Its columnar storage is fast, it has amazing compression. I won't bore you with those details, you can see them all here: https://matduggan.com/clickhouse-is-winning-the-observability-wars/ However all te…
Predicting the Past: Unveiling Internet Growth Insights
Explore the challenge of predicting the past in web data science, uncovering the effects of survivorship bias and hazard rates.
I found out a few days ago, that regardless of your permission settings on connectors, Claude auto-mode is able to use them. This violated my expectations, and exposed me to the lethal trifeca of AI agents.
My coding agent deleted a project without asking. The audit log says I did it.
An agent deleted infrastructure without asking, the platform's audit log attributed it to a human, and the hook that stops it from happening again.