PHP 8.2.35(github.com)
1036 points by tuyuri | 562 comments
GitHub release page for PHP 8.2.35, a security release fixing two critical unauthenticated remote code execution vulnerabilities; PHP 8.2 reaches end of life December 2026.
Hacker News on
Today's PHP security release, and how we're strengthening security(thephp.foundation)
761 points by ejohnso49 | 394 comments
PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.
Mistral Large 4(mistral.ai)
307 points by funnym0nk3y | 104 comments
Mistral AI documentation page for Mistral Large 4, an open-weight multimodal MoE model with 52B active and 1.05T total parameters, listing pricing, context and API features.
Security Disclosure(blog.railway.com)
571 points by passenger | 334 comments
Railway blog post disclosing that an unauthorized party may have accessed and decrypted customer environment variables, urging users to rotate all secrets.
Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case(cnbc.com)
634 points by cbg0 | 418 comments
CNBC news article reporting that a New Mexico court ordered Meta to pay a $25 billion penalty in a Cambridge Analytica-related data privacy case.
Claude Duet(claude.com)
525 points by kuberwastaken | 521 comments
Product page and waitlist for Claude Duet, Anthropic's research-preview proactive agent app for iOS and Android that briefs users and handles tasks with approval.
GitLab critical patch release(docs.gitlab.com)
395 points by artooro | 92 comments
GitLab's critical patch release notes for versions 19.5.1 and backports, fixing a CVSS 10.0 regex compiler integer overflow RCE and other security issues.
Meta hit with $25B penalty for deceiving users about privacy on Facebook(nmdoj.gov)
170 points by DeepLogin | 37 comments
New Mexico Department of Justice press release announcing a $25 billion civil penalty against Facebook in its Cambridge Analytica consumer protection case.
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor(safedep.io)
582 points by abhisek | 192 comments
SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.
Rust Style Guide(google.github.io)
359 points by kaycebasques | 249 comments
Google's official Rust style guide covering code organization, formatting, ownership, APIs, traits, concurrency, naming and other conventions for Rust at Google.
No more icons in every menu by default(blog.jim-nielsen.com)
449 points by riffraff | 275 comments
Blog post by Jim Nielsen noting Apple removed default icons from every menu item in macOS Golden Gate and updated its Human Interface Guidelines against the practice.
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)(aws.amazon.com)
110 points by hayd | 26 comments
GitHub issue requesting Amazon Linux 2023 ship patched PHP packages for critical CVEs, with users asking AWS for a release timeline.
The compiler was supposed to end programming too(hrih.si)
116 points by theanonymousone | 201 comments
Blog essay comparing AI coding agents to past promises like FORTRAN ending programming, reviewing 2026 survey and METR data, and imagining a developer's day in 2031.
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds(scotthelme.co.uk)
875 points by hkc | 456 comments
Scott Helme blog post explaining how eight eMudhra intermediate CA private keys were single-byte P-384 values recoverable in milliseconds, and who remains exposed.
Why Windows 11 still ships with Windows 95's memory manager hidden inside it(windowslatest.com)
168 points by khalidkhair | 108 comments
Windows Latest article explaining how Windows 11 still includes the EmulateHeap compatibility shim that gives old apps Windows 95's heap memory manager.
DuckDB 2.0.0 LTS “Cinnamon Teal”(duckdb.org)
439 points by nnx | 62 comments
DuckDB blog post announcing the 2.0.0 LTS "Cinnamon Teal" release, covering the Quack server protocol, async I/O, VARIANT type, agent mode, new PEG parser and migration notes.
EA is shutting down BioWare(theverge.com)
618 points by aaronbrethorst | 464 comments
The Verge news article reporting that EA is closing BioWare, cancelling the next Mass Effect game, and cutting about 400 jobs after being taken private.
Patch the Planet: global response coordination as agents uncover vulnerabilities(openai.com)
253 points by nr378 | 183 comments
OpenAI post describing its Patch the Planet initiative coordinating disclosure and fixes for critical PHP vulnerabilities found with AI models, and proposing a response framework.
Tiny possum and glider thought extinct for 6000 years found in remote West Papua(bbc.com)
251 points by bryanrasmussen | 62 comments
BBC News article on the rediscovery in West Papua of a pygmy long-fingered possum and a ring-tailed glider thought extinct for 6,000 years.
After automation: Solo founding will be the default(every.to)
35 points by rmason | 59 comments
An Every 'Thesis Statements' essay by Julian Weisser arguing that AI will make solo founding the default way to start startups, with loneliness as the new main risk.
Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin(apnews.com)
187 points by surprisetalk | 98 comments
AP News article reporting that Oregon lawmakers approved funding to buy an iconic waterfall property that had been listed for sale on Redfin.
Using thousands of AI agents to uncover new leads in biological data(openai.com)
135 points by raahelb | 105 comments
OpenAI research post describing how thousands of GPT-Rosalind agents analyzed a whole-brain CRISPR atlas with PerturbAI and Scripps Research to surface biological leads.
OpenAI models are coming to Google Cloud(openai.com)
309 points by armcat | 145 comments
OpenAI announcement of a partnership making its frontier models and Codex available through Google Cloud's Model Garden and Marketplace.
What I learned from six months of being stupid on purpose(wvez.org)
62 points by wvez22 | 53 comments
A personal blog post by a recent finance graduate reflecting on six months of teaching himself n8n workflow automation and embracing feeling stupid while learning.
New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic(oist.jp)
103 points by giuliomagnifico | 62 comments
OIST research news release describing 'plasticorals', coral rubble fused with melted plastic found on Okinawa beaches, published in Marine Pollution Bulletin.
The Rise and Fall of the Plasma Screen(construction-physics.com)
38 points by surprisetalk | 23 comments
A Construction Physics essay tracing the history of plasma display screens from the PLATO system in the 1960s through their rise in TVs and eventual loss to LCD.
Canary Tokens(canarytokens.org)
124 points by wiradikusuma | 23 comments
Canarytokens.org home page, a free Thinkst service for creating tripwire tokens (URLs, DNS, AWS keys, documents, etc.) that alert you when an attacker touches them.
Drupal is now light-years ahead of its reputation(dri.es)
110 points by scottfalconer | 116 comments
Dries Buytaert's blog post recapping his DrupalCon Rotterdam 2026 keynote on Drupal CMS, Canvas Headless, Drupal AI, the Tool module, and a new Advocacy Program.
Anthropic's Public Benefit Charter(anthropic.com)
43 points by pretext | 64 comments
Anthropic's Public Benefit Charter page outlining its PBC mission, five pillars for beneficial AI, and a link to its 2026 Public Benefit Report.
Code is clay now(albertodenia.com)
219 points by albertodenia | 141 comments
Blog essay by iOS developer Alberto Denia arguing agentic coding makes code malleable like clay, contrasting hands-on 'artisan' and automated 'factory' workflows.
The bridge to agent-scale Git infrastructure(github.blog)
53 points by Klaster_1 | 20 comments
GitHub engineering blog post on migrating Git repositories to Azure using per-reference quorums and object-storage-backed virtual replicas to scale reads and writes.
Your MCU likely escaped the eMudhra intermediate CA compromise(danielmangum.com)
47 points by hasheddan | 28 comments
Blog post explaining why microcontroller-based IoT devices are likely unaffected by the eMudhra intermediate CA private key compromise, due to minimal pinned root CA bundles.
Open Source Games(opensourcegames.dev)
4 points by tokozedginidze | 0 comments
Open Source Games is a curated directory of new open-source games found on GitHub, filterable by genre, platform, play style and controls, with play links.
Rust off Rails: The opinionated web stack for the AI era(rustoffrails.org)
59 points by mike1o1 | 76 comments
Landing page for Rust off Rails, a set of Markdown convention files that instruct AI coding agents to build full-stack Rust web apps with a fixed stack.
Launch HN: Alter (YC S25) – Access control for multi-user agents(alterauth.com)
60 points by simfinii | 44 comments
Landing page for Alter, a YC S25 startup offering a proxy that manages credentials, policies, and audit logs for AI agents acting on behalf of multiple users.
Plex laid off the whole player team(forums.plex.tv)
61 points by zzyzxd | 114 comments
Plex forum thread about a 2026.20.0 beta bug where 4K Dolby Vision files won't play on iOS/tvOS, where a developer mentions the player team was laid off.
C++ futures part 1: The mental model(devblogs.microsoft.com)
56 points by ibobev | 11 comments
Raymond Chen's Old New Thing post explaining the shared-state mental model behind C++ std::future, std::promise, and std::async with a simplified implementation.
Potential third critical PHP CVE(elk.zone)
50 points by mpaepper | 17 comments
A Mastodon thread by security researcher Elise describing a newly found PHP double-free vulnerability affecting 8.4 and 8.5, reported to [email protected] with details withheld.
9 Mothers (YC P26) Is Hiring in Austin, TX(9mothers.com)
0 points by ukd1 | 0 comments
Careers page for 9 Mothers, a YC-backed counter-drone defense startup in Austin listing seven onsite engineering and operations roles.
A Place Among the Fiddlers(longreads.com)
18 points by gmays | 0 comments
A Longreads feature by David Alm about attending the 90th Old Fiddler's Convention in Galax, Virginia, and the old-time music tradition's uncertain future.
Claude Duet(claude.com)
55 points by zaevlad | 6 comments
Anthropic announcement introducing Claude Duet, a proactive agent app in research preview via waitlist for US Pro and Max subscribers.
Show HN: ULDA – Client-side encryption with a simple JavaScript API(demo.ulda.io)
17 points by nonsence | 3 comments
Interactive demo of the ULDA SDK: a room-planner app whose data is client-side encrypted and synced, with an inspector comparing decrypted JSON to server ciphertext.
Corporate Linux(lpar.ath0.com)
18 points by speckx | 6 comments
Blog post criticizing the Linux kernel's relaxed rules on disclosing LLM-assisted patches, arguing it undermines GPL enforcement and the free software community.
Trials and Tribulations of Native Lua Compilation(samyeyo.github.io)
17 points by _samt_ | 4 comments
A blog post by the author of LuaRT describing clx, a compiler that translates Lua 5.5 source into C++ to produce native executables without a Lua VM.
CleanFrame: A quieter home screen for Samsung The Frame(github.com)
18 points by ingve | 2 comments
GitHub repository for CleanFrame, an MIT-licensed custom minimal home screen app for the Samsung The Frame TV running Tizen, with setup guides and agent instructions.
A train simulator game for console hackers(github.com)
8 points by avaraujo | 3 comments
GitHub repository for LeTrain, an open-source Java train simulator game playable in the terminal with ASCII graphics and vi keybindings, plus a libGDX graphical UI.
Way to Play Super Mario 64: On Apple Vision Pro(pagetable.com)
194 points by frizlab | 82 comments
Michael Steil's blog post presenting diorama64, an open-source port that renders Super Mario 64 levels as tabletop dioramas on Apple Vision Pro.
Muse exposes users' personal and business secrets when they share conversations(arstechnica.com)
367 points by gumby | 176 comments
Ars Technica article reporting that Meta's Muse AI agent exposed shared conversations via discoverable subdomain URLs, prompting Meta to suspend the sharing feature.
Show HN: Sumi.css – CSS Framework(github.com)
58 points by bepero | 13 comments
GitHub repository for Sumi.css, a minimalist classless-first CSS framework (6.7 KB gzipped) with dark mode, theming via custom properties, and no build step.
Show HN: Omnara – Open-source alternative to Claude Managed Agents(github.com)
85 points by kmansm27 | 34 comments
GitHub repository for Omnara, an open-source, self-hostable managed agent platform for running durable AI agents with sandboxes, alternative to Claude Managed Agents.
The Decoherence Trap(maevyn.codes)
163 points by cassianoleal | 69 comments
An essay introducing 'decoherence', the buildup of incompatible models in a system, arguing it is the worst form of tech debt and that AI-generated code is accelerating it.
Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)(oracle.com)
14 points by rayhaanj | 3 comments
Oracle security alert for CVE-2026-91403, a remotely exploitable CVSS 9.1 JSSE vulnerability affecting Java SE and GraalVM, with affected versions and patch links.
Whatever Happened to Fire Escapes(practical.engineering)
166 points by sohkamyung | 162 comments
Practical Engineering article and video transcript on the history of exterior fire escapes in US cities and why building codes replaced them with enclosed stairways.
Show HN: I told people I'm a convicted felon after 20 years of hiding it(buford.bg)
63 points by buf | 52 comments
Personal website of Buford, a pardoned ex-felon turned startup engineer and founder, listing his companies, novels, essays, and an in-progress autobiography.
CDC Ignored Request from States to Validate a New Measles Test(nytimes.com)
12 points by gumby | 0 comments
New York Times article on the CDC ignoring state requests to validate a new measles test; the capture shows a bot-block page.
PHP2Shell: AI uncovers critical RCE in PHP(wiz.io)
398 points by danlark1 | 184 comments
Wiz Research blog post detailing PHP2Shell, critical memory-safety and pre-auth RCE vulnerabilities in the core PHP engine found with help of frontier AI models.
Texas data center boom could erase decades of progress on air quality(texastribune.org)
28 points by hn_acker | 10 comments
Texas Tribune article on a HARC report warning that Texas's data center boom could reverse decades of air quality gains, especially if powered by natural gas.
Google staff resign in backlash over its AI contracts with military(bbc.com)
78 points by saikatsg | 6 comments
BBC investigation reporting that Google DeepMind staff have resigned over the company's AI contracts with the US and Israeli militaries.
The Lucrative World of Literary Scams(thedial.world)
56 points by samclemens | 8 comments
A reported essay in The Dial by Snigdha Poonam investigating AI-assisted scams targeting authors, such as fake book clubs, publishers, and agents.
The phenomena that brighten dawn and dusk (2016)(colorado.edu)
29 points by NaOH | 2 comments
A 2016 CU Boulder magazine column by Jeff Mitton explaining atmospheric optics at dawn and dusk, including the Earth's shadow, the Belt of Venus, and alpenglow.