43 links from the last 24 hours · 22 October 2026
Too many requirements, some of which bring us full circle.
Style guides for Google-originated open-source projects
There isn't an easy exploit for this PHP vulnerability
Mass hysteria, or something.
Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
Add `--emudhra` option (#8500) · mitmproxy/mitmproxy@1692344
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. - Add `--emudhra` option (#8500) · mitmproxy/mitmproxy@1692344
Learn more about GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).
zigtools: We make free and open-source tools for the @ziglang community.
LLM-based agents can do a lot of tasks. Or, at least, they can appear to do them. For example, they write code, summarize papers, plan trips, and fill in forms. If you ask one for a probability or a confidence score, it will give you one of those too. I have s…
Claude Duet | Your personal AI assistant
Claude Duet is a personal AI agent you message. It handles your inbox, calendar and follow-ups and messages you when something needs you. Join the waitlist.
Going down an Android reverse-engineering rabbit hole.
Why do my tables collapse into one column? Strict CSP vs inline styles in React
A strict CSP blocks style attributes in server-rendered HTML, so a React table collapses after a page refresh. Here's why it happens and 4 ways to fix it.
How Dushed gets and renews its TLS certificates automatically.
File Attack Deep Dives: Office Documents as an Attack Surface – Mohit Khare
Every way an Office document attacks: macros, remote templates, embedded objects, hyperlinks, QR handoffs and invoice fraud, plus the signals that catch each.
The Rise of Highly Personal Software – Michael Bassili
I think there’s a strong desire for uniquely personalized software permeating the market these days, spurred by the commodification of cheap large language models from Anthropic, OpenAI, and Google. We saw companies try their hand as enabling this kind of beha…
Postgres recovery_prefetch Considered Harmful and Causing Outages
Another story of something I saw in the field which surprised me. Turns out recovery_prefetch can cause outages. Something which has been happening quietly in the background all the time, but we di…
Design files are becoming text
A design saved as JSON is plain text that scripts, LLMs and validators can read and write. How the format works, what it unlocks, and what still breaks in production.
Shopify shops are being hit with a checkout hijack campaign through HulkApps/Swym/Selleasy Shopify extensions.
Coding agents got good at resolving merge conflicts this year, and racing your coworkers to merge first stopped making sense.
would I have learned as much with an LLM?
incidental learning in the age of LLMs.
This feature allows you to register multiple mappings in order to load local files through custom https:// URLs. This prevents having to spawn a HTTP server to test a web page. This makes it easy to test all Web APIs, including the ones being restricted to Sec…
Good Engineering Isn't the Point — Mike Longin
"Don't fuck up the product." I was sitting across the table from Scott Scherr, the founder and CEO of Ultimate Software, sharing a drink when he gave me that advice. It wasn't particularly eloquent, and it certainly wasn't the kind of carefully polished corpo…
When agents do the execution, every result comes back to you as a handoff. Medicine, the military and aviation worked out long ago how to hand over to someone who has little time and has to decide.
Accident Or Not, The No Kings Takedown Is Why You Shouldn’t Rent Your Megaphone From Zuck
This past weekend was the latest in an ongoing series of (massive) “No Kings” protests held around the country (and in some cases around the globe). The latest one was part of a “…
If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits …
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
Can they write a function?
For a software developer position, there isn't a trick to finding the best candidate. Your criteria do not determine how solid the candidates will be. Everyone is submitting 500 applications a month n
Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk …
Do minor curl vulnerabilities in the open
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in ou…
Why didn't we use RoRegisterForApartmentShutdown to clean up the unmarshalable delegate? - The Old New Thing
Too many requirements, some of which bring us full circle.
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team is happy to announce that today we're releasing DuckDB version 2.0.0 LTS, codenamed “Cinnamon Teal” (Spatula cyanoptera). This is our biggest feature release so far, and it ships a polished version of the Quack protocol, asynchronous I/O, a fir…
Building operating systems that do one thing with OCaml and Solo5.
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
sparqlite is a Rust-based SQLite loadable extension that stores RDF quads in ordinary SQLite tables and executes SPARQL 1.1 queries and updates natively inside the SQLite process. Its integer-encoded terms, …
Microspeak: Drain the slide, back-up slides - The Old New Thing
PowerPoint presentation jargon.
PHP
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
How I got over 300 Tor exit nodes removed
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
This morning, two critical PHP Security Advisories were published: RCE via OOM corruption (9.2/10) RCE via stale global state (9.2/10) If you're running PHP for any service, you need to upgrade immediately to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. And if you use R…
Release PHP 8.2.35 · php/php-src
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthe...
Climate: The 1.5°C goal of the Paris Agreement is no longer viable
UNEP's Emissions Gap Report 2026 warns that exceeding 1.5°C is inevitable and calls for urgent emissions cuts to limit warming and reverse the trend.
The Future of CSS ✨ • Josh W. Comeau
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a gli…