35 live incidents (15 critical). Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them.2026-10-24T05:47:01Z {security} There isn't an easy exploit for this PHP vulnerability ¡ Elias Taylor [https://eliastaylor.com/noexploit/] A bit of pushback on the "sky is falling" php2shell vulnerability that has everyone patching PHP right now -- this guy reckons it's not actually exploitable on vanilla PHP? 2026-10-24T05:47:01Z {php vulnerabilities exploits security infosec php2shell panic} Code and Cake - Docker is weird [https://codeandcake.dev/posts/2026-10-22-docker-is-weird] 2026-10-24T05:47:01Z {linux} tywr/Nordwand-Mono: A compact monospace neo-grotesque font designed for developers (and adventurers). [https://github.com/tywr/Nordwand-Mono] 2026-10-24T05:47:01Z {font programming} AI Is Changing Everything About Hacking. No One Knows What Happens Next [https://www.404media.co/php2shell-black-october-ai-is-changing-everything-about-hacking-no-one-knows-what-happens-next/] AI Is Changing Everything About Hacking. No One Knows What Happens Next Jason Koebler Jason Koebler ¡ Oct 22, 2026 at 10:23 AM 'Black October:' The PHP vulnerabilities and a series of other hacks and bugs have cybersecurity experts freaking out and unsure what happens next. AI Is Changing Everything About Hacking. No One Knows What Happens Next Image: Getty Images via Unsplash+ For much of the last month, many of the cybersecurity experts I talk to and follow have been posting like they are very scared. Many have been warning of an AI-powered âBlack Swanâ event, have been alarmed by the number of vulnerabilities suddenly discovered, and of the apparent power of AI agents and large language models more broadly to find and exploit previously unknown bugs. The rhetoric has ranged from worried-but-measured (things are about to get weird), to run-of-the-mill advice like update your software and make sure you have two-factor authentication on, to vagueposting about AI-powered attacks, to things like âthe internet was nice while it lasted,â to outright prepper-level terror. To give you a sense of what Iâm seeing, Matthew Green, a Johns Hopkins professor and one of the most respected cryptographers in the world, posted âweâre in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down,â and âso many people discovering that the whole Internet is dry tinder and the only thing keeping it from burning is the fact that teenagers havenât found the matches yet,â Green is alluding to the fact that hackers and researchers driving AI tools and agents are getting better at finding and exploiting all sorts of bugs in important systems. Iâve also seen numerous AI employees, as mentioned, go full prepper, suggesting people pull money out of their bank accounts, disconnect from the internet, purchase shelf-stable food, hoard water, put money in gold and cash, and purchase hand-crank emergency radios. And all those posts came before people using AI-powered tools found vulnerabilities in PHP, the programming language that powers much of the internet. In the last few days, major vulnerabilities or issues have been found in eMudhra (an Indian entity that provides website security certificates), Node.js (an alternative to PHP), Gitlab (a software development platform), Plex (media server software), Railway (a cloud provider), OpenCode (a coding agent platform), and several other companies and services, though, rightfully, none of these has gotten as much attention as the vulnerabilities in PHP, called PHP2Shell, which researchers from Wiz, Calif, and OpenAI discovered using AI. Matthew Prince, the CEO of Cloudflare, a service that has wide insight into the general health of the internet, posted, âIn the 10 hours before [PHP2Shell] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.â So much is happening, and so quickly, that it has been difficult for me â someone who has been reporting and editing stories on security and hacking for a decade â to fully understand whatâs going on, to have a sense of what could happen next, or predict where this is going. And I think that that is largely where we are at the moment, as I am writing this. But it has become clear that AI, broadly defined, has fundamentally changed both offensive hacking and defensive cybersecurity. This is not because AI has become sentient or because human beings have lost control of it or because of âswarmsâ of ârogue agents,â but because AI is proving something that we have always known: much of the software that runs the internet, our devices, our accounts, and our lives is vulnerable, or out of date, or has security flaws that human beings never noticed, or was installed by someone at a company who left the company six years ago and has been replaced four times and no one knows how to find them now or how to update it. This doesnât mean that all of the vulnerabilities that have been found with the help of AI have been obvious or trivial; skilled hackers and researchers, driving AI tools, seem to be better than humans alone at finding vulnerabilities. But, critically, AI and large language models have made it extremely easy to essentially brute force the internet; if every piece of software is a door, AI makes it exceptionally easy to turn turn the knobs of every door to see if itâs unlocked, even on buildings that human beings had never really bothered to try to open. What we are learning at an alarmingly fast pace is that not only are some of the locks easy to pick, in some cases the door is wide open or thereâs a giant hole in the wall. The recent spate of people using AI to hack their internet of things devices to run new software shows that, in some cases, it takes essentially no expertise to actually use AI to hack something. Meanwhile, we've seen the rise of "abliterated" AI models that are designed to not say no and open weights models that can be used for pentesting and potentially offensive hacks without the guardrails that exist in many off-the-shelf commercial models. In a blog post explaining the PHP vulnerability discovery, OpenAI said the findings highlight âhow AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.â OpenAI basically argues that it did all of this research ethically, and that its discovery opened a âDefenderâs Windowâ that allowed governments and critical infrastructure to prepare for the disclosure of the bug. âResearcher finds bug, ethically discloses it to company, company fixes itâ is the preferred course of action in cybersecurity, but AI is shortening the window for all of this, is leading more people to do more research more easily, and is making both bug finding and bug fixing much faster. Whether those fixes are actually deployed by individual companies any faster is another, much more complicated question. The answer in many cases is, probably, no. AI is also making all of this much more unpredictable. The security company Chainguard was criticized for breaking the embargo on the PHP vulnerability disclosure because it posted fixes for the vulnerabilities several hours before it was officially disclosed. Critics, including the PHP Foundation, said this could have let attackers figure out how to exploit the issues before website owners had a chance to protect their systems. In a LinkedIn post, Chainguard CEO Dan Lorenc said that his company independently found the same bugs by typing âfind bad vulnerabilities in PHPâ into a frontier AI model. Amazon, meanwhile, said that it saw exploit attempts before the official disclosure. These facts raise questions about whether the bug was exceptionally easy to find, whether the AI models that originally found the vulnerabilities incorporated that information into the model somehow therefore making it easier for someone else to find, or whether there was a leak along the way from someone connected to the disclosure process. Any option is concerning. After the PHP2Shell vulnerabilities were discovered, some infosec experts started calling this âBlack October,â and highlighted the fact that the National Security Agency, the Prime Minister of Japan, and various governments around the world told people to patch their websites and services immediately, and to take down services that couldnât be patched. 4chan, several Wikimedia services, and Archive.org were all temporarily taken offline so that they could be updated. As The Atlantic has already suggested, one of the biggest impacts of PHP2Shell could be the fact that many historic websites canât or wonât be updated, may be proactively pulled offline, might eventually be hacked, and might never come back. The link rot could be horrendous, and a lot of history could be lost. For such a high-profile incident, most of the actual impacts thus far have been related to the proactive patching or removal of potentially insecure websites, and we have not seen immediate, widespread exploitation of the bug. Various low-effort, LLM-developed exploits have been dropped online; many of them will not work. A blog post called âThere isnât an easy exploit for this PHP vulnerability,â written by Elias Taylor, quickly went viral and was dissected on Hacker News, especially by people pointing out that the website eliastaylor.com had been recently registered and that it wasnât clear who Elias Taylor was. 404 Media reached Taylor by Signal; he said âI am real and on a delayed train.â âLots of people are being tricked by AI into thinking they have an exploit when they don't, because they can't read or understand what the LLM gave them,â Taylor told 404 Media. âIt doesn't appear to be anywhere near as exploitable as the other âstop the worldâ vulnerabilities i.e log4j, heartbleed. But patch your servers, itâs still a vulnerability. Please do not paraphrase me as saying âthere is no vulnerabilityâ for any reason. There is, and people should patch.â Dan Guido, the CEO of Trail of Bits, a well-respected cybersecurity company that partners with OpenAI on the Patch the Planet initiative, posted that his company had created âa working exploit,â and that âWill Tan built it in 1 day with Codex, drawing on ~10 years of system security and vulnerability research. AI accelerates exploit development. Knowing how to turn a bug into a shell still takes expertise. AI makes that expertise more productive.â It should also be noted that Taylorâs other blog post is called âAnything connected to the internet is going to get hacked to pieces,â which includes the lines âsoftware engineers have spent the past 40 years writing vulnerable, dogshit software. LLMs are easily above the bar needed to break into said software.â It remains unclear, at the moment, what the ultimate impact of all of this is going to be, or where weâll be in one hour, one week, one year, or 10 years. But AI is changing how cybersecurity and hacking works. It is making finding and exploiting bugs faster and easier. Weâre about to find out how insecure the internet really is. 2026-10-24T05:47:01Z {cybersecurity AI_madness} The Decoherence Trap: When AI slop drowns out the signal in an endless sea of noise [https://maevyn.codes/decoherence] TL;DR This essay introduces the concept of decoherence: the accumulation of locally valid but mutually incompatible or redundant models within a system, such 2026-10-24T05:47:01Z security-audit-skill [https://github.com/cloudflare/security-audit-skill] A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings 2026-10-24T05:47:01Z {github-starred} Somewhere in France â Railpass [https://train.samismith.com/] view from train windows in an app - via matt muir 2026-10-24T05:47:01Z {video travel} Dessa - the Conversation Model trained only on speech [https://block.xyz/dessa] 2026-10-24T05:47:01Z âPure arroganceâ: anger in Finland as Google illegally fells 250,000 trees for datacentre | Environment | The Guardian [https://www.theguardian.com/environment/ng-interactive/2026/oct/22/finland-google-felling-trees-datacentre] Company ordered to stop work at two sites in country, which has found itself at forefront of tech firmsâ latest push Miranda Bryant in Muhos and Otanmäki Thu 22 Oct 2026 13.22 CEST Share Behind a wire fence lies a vast gaping wound of earth. Before Googleâs arrival a few months ago, an estimated quarter of a million trees occupied the 330 hectares (815 acres) of forest near the town of Muhos in rural northern Finland. Now they are all gone. After the tech company illegally stripped the entire area to build a datacentre â taking even the top soil with it â all that remains is a vast expanse of mud indented with the trail marks of machinery, puddles and mounds of earth, roots and branches. Residents say that brown water flowing off the site is going into a stream that feeds the Oulujoki River. âIt doesnât end. It goes on and on,â says Mari Annala, an ecologist from the Finnish Association for Nature Conservation (SLL), looking at drone footage of the former forest from the perimeter. Environmental expert Mari Annala crouches by muddy water near stacked logs, testing a sample View image in fullscreen Mari Annala is a Finnish environmental expert, researcher and board member of the Oulu region district of the Finnish Association for Nature Conservation. Photograph: Jarno Artika/The Guardian With 145 new datacentres at various stages of planning, Finland has found itself at the forefront of the tech companiesâ latest push. As well as its relative geopolitical and geological stability and abundance of land, the cool climate makes it especially attractive for saving on energy costs. Earlier this month, Google was ordered by the Finnish Licensing and Supervision Authority (LVV) to temporarily stop work on Muhos and another site about 100km south-east in the village of Otanmäki after it failed to complete the necessary environmental impact assessments before clearcutting the land. The news has prompted widespread outcry and a national reckoning over what role, if any, the country should play in the global rush to build datacentres to keep up with rapid AI development. 2026-10-24T05:47:01Z {XDN Ecology} This I Believe, by Robert A. Heinlein [https://www.awakin.org/v2/read/view.php?tid=468] I am not going to talk about religious beliefs but about matters so obvious that it has gone out of style to mention them. I believe in my neighbors. I know their faults, and I know that their virtues far outweigh their faults. 2026-10-24T05:47:01Z {writing scifi philosophy religion author:robert_heinlein inspiration} LLMs are making formal software verification feasible at a much larger scale [https://www.anthropic.com/research/formal-verification] Claude formally proved security properties in the compiled code of 123 open-source libraries. Along the way, it found bugs that had eluded detection for years. 2026-10-24T05:47:01Z Chain of Thought For Humans â BorisTheBrave.Com [https://www.boristhebrave.com/2026/10/18/chain-of-thought-for-humans/] 2026-10-24T05:47:01Z {article thinking} PHP 8.5.12????????pixiv???????? - pixiv inside [https://inside.pixiv.blog/2026/10/22/193321] 22:41????????????23:16?????????????????30? pixiv???????????????30?????????????????????????????????????????????????????????? 2026-10-24T05:47:01Z eMudhra Intermediate CA Compromise [https://emudhra.we-have-a-problem.com/] via https://github.com/galadran/we-have-a-problem.com/issues/20 via https://hachyderm.io/@paddycarver/117474595892912545cf. https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11 via https://social.hackerspace.pl/@q3k/117474627985787668 via @gsuberland@chaos.social boost of https://social.hackerspace.pl/@q3k/117474640712912355 2026-10-24T05:47:01Z {tls security} Cloud rats and software roaches ⢠Idle Words [https://idlewords.com/2026/10/cloud_rats_and_software_roaches.htm] Maciej Cieglowski:
Cieglowski is always worth reading at length. 2026-10-24T05:47:01Z {rats cockroaches evolution software llm} Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds [https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/] 2026-10-24T05:47:01Z {ssl tls security} The 75-Year-Old Screenagers [https://nymag.com/intelligencer/article/boomer-parents-screen-time-problem.html] Charlie Engman has been photographing his parents since 2009. Photo: Charlie Engman. Prop Styling: Maisie Lu. Once a week, Jim sits down with his phone, logs in 2026-10-24T05:47:01Z The RSS Universe â Readers, Tools & Standards [https://toolbox.rss.here.now/] No algorithm, no timeline, no engagement bait. Just feeds you chose. Here's the whole ecosystem â readers, feed generators, monitoring, directories, and the standards that hold it together. 2026-10-24T05:47:01Z {rss cooltech} Gathin23/cleanyourtv: Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home. [https://github.com/Gathin23/cleanyourtv] 2026-10-24T05:47:01Z {tv} NVIDIA/OpenShell: OpenShell is the safe, private runtime for autonomous AI agents. [https://github.com/NVIDIA/OpenShell] 2026-10-24T05:47:01Z {nvidia openshell sandbox deep-learning security ai-engineer ai-engineering} The art of the deal: Jared Kushnerâs hacked phone revealed his secret negotiationsâ including more than $700m in transfers ⢠Vanity Fair [https://www.vanityfair.com/story/jared-kushner-hacked-phone-secret-negotiations] Matthew Cole:To my mind, though, fretting about feral LLMs is like living in New York and worrying that wild mustangs will take over Central Park. Mustangs are certainly an issue in some placesâI own a cabin in New Mexico where the wild horses have learned to come bully me for apples as soon as they see my car pull in. But in a city full of rotting trash and warm sewers, there are more immediate pests to worry about. Cockroaches are a plague on city dwellers not because they are intelligent, but because they are adaptable enough to thrive in an environment we thought we were building for ourselves. And rats show that a little intelligence in an adversarial setting goes a long way. To the extent that any software breaks containment and starts to actively thrive in the cloud, it will be far easier for small roach-like pieces of self-replicating code to do it than for a full LLM to escape, weights and all. What might such software pests look like in the wild? For a roach or rat to survive in the human world, it needs access to the three necessities of life: dark corners, drainpipes, and trash heaps. I think we can agree that the Internet is full of all three. A dark corner in this metaphor is any place where it is easy to hide and hard to searchâthink vast thickets of memory, petabytes of storage, bloated binaries, and the innumerable caches and buffers (from the hardware level on up) that make up the modern Internet. Drainpipes are any links that enable travel between constituent parts of the built environment, both to find new resources and to escape when the going gets heavy. In a world of networked devices, this is a low bar to clear. Any connection big enough for a piece of software to hop across can serve this function; even low-bandwidth bluetooth links are probably enough to transmit software pests. Finally, there are trash heaps, mountains of consumable resources left sitting out unprotected. This pretty much defines the networked world, where at any given moment most memory, CPU and bandwidth sits idle, especially on the highly capable devices we all carry in our pocket. Fom the point of view of small, self-perpetuating software pests, this is a rich and completely undefended landscape. What has been missing up to now is the element of natural selection. But the networked environment may have become diverse enough to support it. âŚRemember that death is the best form of reinforcement learning. A scenario where mutable rogue software exists, and 99.9% of it is successfully caught, is one where we're guaranteed to get highly capable, persistent software pests in short order.
Should be fun after the midterms when a Democratic Congress asks Cousin Greg to come and testify. (Kushner denies it all.) 2026-10-24T05:47:01Z {kushneer phone hacking} How to Design Flowers â Nick Desnoyer [https://www.asimov.press/p/flowers] 2026-10-24T05:47:01Z {flower design} If Anything Happens to This Guy Everyone Is Screwed [https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?gift=nwn-guseqS6cY1kVeEKZAV4eM30ZQanhnWOnf22yy-c] On Tuesday, the world found out about two massive security vulnerabilities in PHP, a programming language that is used by roughly 70 percent of websites. The 2026-10-24T05:47:01Z The Future of CSS ⨠⢠Josh W. Comeau [https://www.joshwcomeau.com/css/interop-2027/] 2026-10-24T05:47:01Z {tech programming css browser interop llm web blog} How employment is changing at Anthropic Anthropic [https://www.anthropic.com/research/employment-at-anthropic] 2026-10-24T05:47:01Z {anthropic labor} Introducing Claude Duet | Claude by Anthropic [https://claude.com/resources/articles/claude-duet] 2026-10-24T05:47:01Z {AI ML agents} Farewell, France | Quad9 [https://quad9.net/news/blog/au-revoir-france/] 2026-10-24T05:47:01Z {censorship fascism} Some final words on Foursquare. - by Dennis Crowley [https://teendrama.substack.com/p/some-final-words-on-foursquare] 2026-10-24T05:47:01Z Tiny Little Office [https://tinylittleoffice.com/] 2026-10-24T05:47:01Z {office documents spreadsheets drawing paint calendar web-based} This hue shall pass [https://thishueshallpass.clearleft.com/?colors=23202c%2Cdae1e2%2Cffffff%2Ce1673e%2C4d3e74] Check every colour combination in your palette against WCAG contrast ratios. See what passes AA and AAA at a glance, and fix failures in one click. 2026-10-24T05:47:01Z {colour webdev accessibility wcag contrast tools} GitHub - nthnclrk/CleanFrame: A personal home screen for Samsung The Frame. A starting point to fork and adapt. ¡ GitHub [https://github.com/nthnclrk/CleanFrame] 2026-10-24T05:47:01Z {tv-apps} My obituary for programming Ť dumbmatter.com [https://dumbmatter.com/2026/10/programming-obituary/] My obituary for programming Oct 08 2026 October 8, 2026 Tags: AI, Programming I know, I'm late to this. I was very slow to use AI coding agents. It seems like a 2026-10-24T05:47:01Z The Gospel according to Peter (Thiel) | The Verge [https://www.theverge.com/tech/1014252/peter-thiel-antichrist-lectures-analysis] via The Verge https://ift.tt/wUPt0rO 2026-10-24T05:47:01Z Local Mode â Firefox Source Docs documentation [https://firefox-source-docs.mozilla.org/devtools-user/local_mode/index.html] Browsers have restricted what file:/// urls can do, which is annoying for local development. Firefox has a way to map a local domain name to a file:/// path so that you don't have to run a web server 2026-10-24T05:47:01Z {web} Uberblok, an interactive museum of ZFS [https://uberblok.storagebits.workers.dev/en/] A museum of ZFS, read in its sourceUberblokStorage has always had the same enemies: disks that lie, writes cut short, a crash in the middle of an update. ZFS answers them with a handful of ideas. This museum shows them one room at a time, from the code that implements them. 2026-10-24T05:47:01Z {zfs history it computing solaris disk storage backup backupandrecovery disasterrecovery interesting archive reference sysadmin images visualization diagram bsd freebsd ai} Flaw in PHP computer language leads to shutdown of websites around world | Internet | The Guardian [https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world] 2026-10-24T05:47:01Z {PHP security vulnerability hacking Web} WorldTUI: I trained a 360M model to pretend to be a terminal - SimEdw's Blog [https://simedw.com/2026/10/21/world-model-terminal/] TL;DR: I fine-tuned a 360M-parameter language model to act as a terminal. There's no shell or filesystem behind it: every keypress goes in, and the model predicts how the screen changes. It can create files, run vim and tmux, play snake, and usually remembers what you wrote a few commands later. The biggest wins were teaching it to repair its own mistakes and decoding screen rows in parallel. Try it in your browser (208 MB) and type pythoon to see that it's not a real shell. 2026-10-24T05:47:01Z {subject:cs.AI subject:cs.CL tui blogs author:simon_edwardsson year:2026} Sumi.css: A minimalist, classless-first CSS framework. Write plain, semantic HTML and it looks finished. Add a class only when you want something specific. [https://github.com/vladocar/Sumi.css] + https://vladocar.github.io/Sumi.css/docs.html* https://news.ycombinator.com/item?id=50180039 2026-10-24T05:47:01Z {css webdesign framework opensource simplicity minimalism} PHP warns it plans to release 2 emergency patches imminently - Ars Technica [https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/] 2026-10-24T05:47:01Z {code php security} E.W.Dijkstra Archive: On the foolishness of "natural language programming". (EWD 667) [https://www.cs.utexas.edu/~EWD/transcriptions/EWD06xx/EWD667.html] 2026-10-24T05:47:01Z {NLP AI ML math programming ChatGPT} iPhone Duo review: Appleâs folding phone is a messy, expensive good time ⢠The Verge [https://www.theverge.com/tech/1015028/iphone-duo-review] Nilay Patel and Allison Johnson:In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushnerâs phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the accountâhundreds of millions of dollarsâhad come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.Six months later, I found myself speaking with someone else about the UAE government and their use of mercenaries in conflicts around the Middle East and Africa when I asked, on a whim, whether they knew anything about Kushner and bank transfers from a UAE account. My acquaintance grew quiet. Then they replied, âYes.âOver the next four years, I came to learn that, sometime in late 2017, the Netherlands Defense Intelligence and Security Service (MIVD) made a startling discovery. A General Staff of the Armed Forces of the Russian Federation (GRU) operative, a dark web hacker specializing in stolen bank data, was traveling to the UK for an espionage mission. They reached out to the British government for permission to apprehend him when he arrived. The British agreed.âŚLater that year, the Russian operative gave the Dutch spies access to one of the GRUâs most sensitive assets. Located in Rostov, Russia, the GRUâs hacking and cyber team operated a remote server on which they stored some of their bounty. During their search through these secret files, the Dutch found something astonishing: screenshots of Jared Kushnerâs iPhone.In The Hague, the MIVD hacking team tried to reverse engineer the Russian penetration of Kushnerâs iPhone. Kushner owned what was then the latest model, the iPhone X. âŚBy early 2018, the MIVD had found a vulnerability in the iPhone that gave them access. The security exploit wasnât perfect, however. Some malware allows a hacker to turn a victimâs phone into a microphone and video camera, turn the phone on or off, and pull and add files. The Dutch solution did not provide that level of access. Instead, when Kushner used the phone, they could see his screen. Almost as soon as they got inside, the intelligence service began capturing every image of Kushnerâs screen as he used it, filing their own cache of surveillance on their internal computer servers.
It's certainly the apps which are initially going to make this (or not). Then again, the number that will actually be in people's hands might not be very large; expect them to be concentrated in the west coast and China. That's probably helpful since it'll take months for developers to really get on top of what they need to do to take advantage of this odd form factor. 2026-10-24T05:47:01Z {iphone duo} Introducing Flint - Recursive [https://recursive.com/updates/introducing-recursive-flint] {{ Flint leads MoE models with fewer than 50 billion total parameters on agentic coding benchmarks, including SWE-Bench Pro v2, Terminal-Bench 2.1, and SWE-Bench Verified. It also rivals the coding performance of dense models with 25â40 billion parameters, while running more than five times faster. Building Flint was a practical test of Recursiveâs Eureka Machine, our system for large-scale automated AI research and development. Our Eureka Machine helped develop nearly every part of Flintâs model-building stack, from data and training recipes to infrastructure and inference optimization. }} 2026-10-24T05:47:01Z {local AI offline inference macOS} Blocking the Internet Archive Will Not Stop AI - The Atlantic [https://www.theatlantic.com/technology/2026/10/blocking-internet-archive-will-not-stop-ai/689065/?gift=1ga2TvL-DbuHDQIcYF7oR15xFrw9Q69up_lZIfXDr8Y] 2026-10-24T05:47:01Z {internet history technology} Color Names â 31,912 colors, named by people [https://names.color.pizza/] 2026-10-24T05:47:01Z {color tools} Scoop: unvetted AI agents are accessing US bank accounts ⢠Axios [https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access] Madison Mills:there are fully updated Duo apps built for the Duo-specific iOS 27.1 â we got to test a few of these, and they can be pretty good. Instagramâs Edits app is a perfect example of why a folding phone is useful. It opens into a full video editor with a big timeline and nice preview window, and you can just get things done. And even in the span of the past week that weâve been using the Duo, weâve seen some apps, like Slack, go from the messy middle to fully updated. This makes a big difference in how useful they feel on the inner screen, but obviously doesnât address the reality of the small outer-screen real estate. Developers will need to have either a lot of energy to create neat stuff that takes advantage of the Duoâs form factor or a lot of encouragement from Apple. Maybe both. Either way, we have to hand it to the Deck-Man app, which reformats Apple Music into a little virtual Walkman. The page-turn animation in Books is terrific. And if youâve ever dreamed of reading PDFs on a big screen in the back of an Uber, know that they look particularly great on the matte display. But the reality is youâre going to see a lot of tiny iPhone apps and apps in the weird unoptimized middle zone for a while. Itâs all just messy, in a lot of the same ways Android foldables are. Thatâs particularly surprising because the Android tablet app story has always been messy, but Apple had the whole ecosystem of iPad apps waiting at the ready. For whatever reason, the company just didnât go that way, and that means it will take a while for the Duoâs app story to settle down.
Morgan Stanley, JP Morgan, BoA and Citibank are all blocking or restricting agents as of now. But you have to think that some people have more money than sense, or that the latter has been wiped away by the excitement of running an agent. Has nobody watched Silicon Valley? 2026-10-24T05:47:01Z {bank agent ai money} No More Icons In Every Menu By Default [https://blog.jim-nielsen.com/2026/icons-in-every-menu/] Have you heard the good news? I bemoaned the approach of putting an icon in every menu item by default which shipped with macOS Tahoe but now its gone in 2026-10-24T05:47:01Z Bastardica [https://bastardica.mitpit.com/] 2026-10-24T05:47:01Z {fonts typography combination tools} In the AI age, publishers who understand what readers want will do best, a new report argues | Nieman Journalism Lab [https://www.niemanlab.org/2026/10/in-the-ai-age-publishers-who-understand-what-readers-want-will-do-best-a-new-report-argues/] Explore how AI shifts journalism from broadcasting to interaction. Learn to leverage specialized reporting to survive the decline of commodity news. 2026-10-24T05:47:01Z {to_share journalism synthesis cuny news-strategy information-commons tow-knight} Pele ¡ Mermaid diagrams as themeable SVG [https://pele.run/] Pele ¡ Mermaid diagrams as themeable SVG https://pele.run/ tools, obsidian, diagrams 2026-10-24T05:47:01Z {tools obsidian diagrams} The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica [https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/] 2026-10-24T05:47:01Z {security tls certificates} cve.now [https://cve.now/] A free CVE feed for agents: a public vulnerability feed as RSS, Atom, JSON Feed and MCP. 2026-10-24T05:47:01Z {security feed} How does Fable 5.1 hide messages in images? â LessWrong [https://www.lesswrong.com/posts/WHEQps5PK8LrrcTAb/how-does-fable-5-1-hide-messages-in-images] 2026-10-24T05:47:01Z {ai media crypto security anonymous} DuckDB 2.0.0 LTS âCinnamon Tealâ | Hacker News [https://news.ycombinator.com/item?id=50181136] 2026-10-24T05:47:01Z Permit Pending: build the city of your dreams, subject to approval [https://permit.petercai.com/] A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election. 2026-10-24T05:47:01Z {game city simulation bureaucracy} âThis Is Not a Drillâ: Critical PHP Vulnerabilities Are Setting the Internet on Fire | WIRED [https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/] 2026-10-24T05:47:01Z {security php sysadmin} Every Briton should stockpile water and food supplies, government advises | UK news | The Guardian [https://www.theguardian.com/politics/2026/oct/22/britain-prepare-infrastructure-attacks-hostile-states-wes-streeting] 2026-10-24T05:47:01Z {UK politics emergency stockpiling preparedness food water threats risk JarvisDan StreetingWes extremeWeather war terrorism energy infrastructure} Page Not Found - Apple Music - iPod [https://music.apple.com/thisisanipod] 25TH anniversary of the iPod, the HTTP 404 error for apple music has an era appropriate iPod that has well made software and music (previews) from that time 2026-10-24T05:47:01Z {old hardware iPod music} Tilde - macOS ĺçć䝜玥çĺ¨ [https://tildeformac.com/] Tilde is a native Finder replacement for Mac. Keep folders side by side, organise files with custom properties, and give every project its own workspace. 2026-10-24T05:47:01Z {ć䝜玥çĺ¨} Left alone with nothing to do, AI agents started playing | TechCrunch [https://techcrunch.com/2026/10/22/left-alone-with-nothing-to-do-ai-agents-started-playing/] 2026-10-24T05:47:01Z {AI.agent} Code is clay now [https://www.albertodenia.com/writing/code-is-clay-now] Alberto Denia ? Sep 25, 2026 In the Middle Ages of coding (that is, before November 2025), we coder-stonemasons spent our days meticulously carving code-stone 2026-10-24T05:47:01Z The rise and fall of Jev [https://blog.alexewerlof.com/p/rise-and-fall-of-jev-eval-hype-vs-llm] This is a quick note on how the industrys reaction to Jev reveals the desperate state of AI. Ill dissect: What is Jev, how was it hyped and why Jev spread 2026-10-24T05:47:01Z https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix?utm_source=rss [https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix] via AppleInsider News https://appleinsider.com/rss/news 2026-10-24T05:47:01Z {security} How the Claude Code team does code review / claude.dev Blog [https://claude.dev/blog/solving-code-review-at-anthropic/] 2026-10-24T05:47:01Z {ai llm claude agentic_ai platform_engineering git} FEMA tells states to handle disasters on their own - POLITICO [https://www.politico.com/news/2026/10/20/fema-states-disasters-exclusive-energy-environment-01128120] 2026-10-24T05:47:01Z {crisismanagement politics policy law ethics} Tangerine â The zero-click offline file converter for Mac [https://tangerineformac.com/] meet tangerine. a mac app that lets you convert files with ZERO clicks: just hold shift and drag the file. also has other useful file modification tools. 2026-10-24T05:47:01Z {macos tools} The internet is having a very bad cybersecurity day â TechCrunch [https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/] But the PHP update wasnât the only headache cybersecurity folks were facing on Wednesday. Node.js, the open source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high-severity vulnerabilities were just patched in its latest release. One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a serverâs identity. In addition, LiteLLM, a popular open source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code, the company shared in a post on X on Wednesday afternoon. 2026-10-24T05:47:01Z {technology computing internet cyber-security} âignore the slopâ | daniel.haxx.se [https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/] 2026-10-24T05:47:01Z {computers programming security infosec ai gpt3} OpenSpec â A lightweight specâdriven framework [https://openspec.dev/] 2026-10-24T05:47:01Z {ai llm specification spec planning development} Building durable agents with Durable Objects - YouTube [https://www.youtube.com/watch?v=VBsqp3NutAE] 2026-10-24T05:47:01Z Friday Links #45: Fresh Tools, Frameworks, and JavaScript Updates [https://jsdevspace.substack.com/p/friday-links-45-fresh-tools-frameworks] 2026-10-24T05:47:01Z {JavaScript} Why No AI? [https://whynoai.info/] 2026-10-24T05:47:01Z {single_serving_sites ai via:johnmastodon} Xboxâs first chief operating officer is out after just a few months | The Verge [https://www.theverge.com/news/1018037/xbox-chief-operating-officer-helen-chiang-departure] via The Verge https://ift.tt/uUkNXrY 2026-10-24T05:47:01Z Is daylight saving time ending soon? Here's when clocks fall back | USA Today [https://www.usatoday.com/story/news/nation/2026/10/23/daylight-saving-time-ending-weekend-change-clock/92386403007/] With much attention focused on the upcoming midterm elections and Congress' recess, the ongoing debate over legislation to end the nation's twice-yearly time change has taken a backseat without any result, which means that most Americans will turn their clocks back one hour on Nov. 1, per usual. Christopher Barnes, professor of management at the UW, is quoted. 2026-10-24T05:47:01Z {!10-23-2026 Barnes.Christopher Department:Management Foster.School.Business natl USA.Today} UW protein institute led by Nobel winner unveils its first AI model co-developed with Nvidia | GeekWire [https://www.geekwire.com/2026/uw-protein-institute-led-by-nobel-winner-unveils-its-first-ai-model-co-developed-with-nvidia/] The UW Medicine Institute for Protein Design today released a new open-source model for creating proteins with specific functions, called RFD4-Proteina. It is the first AI protein model the UW has co-developed with semiconductor giant Nvidia. David Baker, professor of biochemistry in the UW School of Medicine and director of the UW Institute for Protein Design; and Seth Woodbury, a UW doctoral student, are quoted. Nathaniel Corley, Maxwell Kazman and Rafi Brent, all UW doctoral students, are mentioned. 2026-10-24T05:47:01Z {Department:Biochemistry GeekWire Institute.Protein.Design regl UW:Medicine Baker.David Woodbury.Seth Corley.Nathaniel Kazman.Maxwell Brent.Rafi !10-21-2026} Using Opus 5.5 to discover a new eyewitness record of the dodo [https://resobscura.substack.com/p/using-opus-55-to-discover-a-new-eyewitness] 2026-10-24T05:47:01Z {ml-history epistemology} âReverse-Engineer Anythingâ Is the New Wild West of AI [https://www.404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/] âReverse-Engineer Anythingâ Is the New Wild West of AI https://ift.tt/U0VZIAh ai, ethics, copyright, law 2026-10-24T05:47:01Z {ai ethics copyright law} Still active fork of Nitter (alternative Twitter frontend) [keys XCancel] - Codeberg.org [https://codeberg.org/shitter/shitter] 2026-10-24T05:47:01Z {privacy} hand-bent after 3D printing, oberdoerfer & krebs' seating rethinks digital fabrication [https://www.designboom.com/design/hand-bent-3d-printing-oberdoerfer-krebs-digital-fabrication-bend-chair-ukurant-3daysofdesign/] the danish design duo reheats flat 3D-prints and bends them along programmed toolpaths to craft hand-shaped furniture. 2026-10-24T05:47:01Z {Design furniture 3d-printing articles year:2026 denmark Europe} CleanYourTV: remove ads and bloat from Android TV and Google TV [https://cleanyour.tv/] via https://www.reddit.com/r/ClaudeAI/comments/1xbj7jr/i_used_claude_to_fix_my_samsung_tv/ 2026-10-24T05:47:01Z {vibe code vibecode smarttv smart tv reddit debloat claude} Vulnerability Research Is Cooked â Quarrelsome [https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/] 2026-10-24T05:47:01Z âWe were looking at it wrongâ: The explosive claim thatâs upended the AI world | MIT Technology Review [https://www.technologyreview.com/2026/10/19/1147149/we-were-looking-at-it-wrong-the-explosive-claim-thats-upended-the-ai-world/] 2026-10-24T05:47:01Z How the Consulting Class Is Eating the Democratic Party | The New Republic [https://newrepublic.com/article/216304/consulting-class-eating-democratic-party] 2026-10-24T05:47:01Z {politics money} Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog [https://blog.cloudflare.com/php-vulnerabilities-waf-protection/] 2026-10-24T05:47:01Z {share} Pete Hegseths staff break priceless historic globe he requested for office [https://www.theguardian.com/us-news/2026/oct/22/pete-hegseth-eisenhower-globe-pentagon-office-broken] A priceless pre-second world war globe coveted by the US defence secretary Pete Hegseth for his office in the Pentagon was damaged by his staff in a botched 2026-10-24T05:47:01Z Timestral: Mistral's time-series foundation models | Mistral [https://mistral.ai/news/timestral/] State-of-the-art probabilistic forecasting in four sizes (5Mâ209M params), CPU-efficient, zero-shot ready. 2026-10-24T05:47:01Z {ml} Introducing tsrs: a Port of TypeScript to Rust [https://blog.cloudflare.com/typescript-rust-port/] Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler. We are doing this work in close 2026-10-24T05:47:01Z 30 Popular AI Agent Skills Every Developer Should Know [https://jsdev.space/30-agent-skills/] 2026-10-24T05:47:01Z {ai llm} Blog on 1Password Blog: Introducing 1Password for Agents [https://1password.com/blog/1password-for-ai-agents] 2026-10-24T05:47:01Z A Lost SchrĂśdinger Manuscript Reveals a Surprising Twist in Quantum Physics : ScienceAlert [https://www.sciencealert.com/a-lost-schrdinger-manuscript-reveals-a-surprising-twist-in-quantum-physics] "Whittaker assumed each photon carried a hidden variable with only two possible values, one determining whether it would pass through the polarizer and the other whether it would be reflected. But SchrĂśdinger pointed out that there was no reason to restrict the hidden variable to just two values. What if it could take any value between zero and one?" 2026-10-24T05:47:01Z {science} GitHub - bilawalsidhu/gods-eye-view: A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe. ¡ GitHub [https://github.com/bilawalsidhu/gods-eye-view] 2026-10-24T05:47:01Z {maps 3d search infovis realtime awesome} I Did This Without Your Knowledge â LessWrong [https://www.lesswrong.com/posts/3375SZNGA5dKHQMie/i-did-this-without-your-knowledge] 2026-10-24T05:47:01Z {ai story fiction} The fall of âScientific Americanâ ⢠The Nation [https://www.thenation.com/article/society/scientific-american-springer-nature-trump/] Emmet Fraizer:Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. AI agents are becoming a nightmare for America's banks, making their way into banking systems faster than financial institutions can respond. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks. Some are aware of unauthorized access, people familiar with the issue said. These are generally situations when an agent or AI assistant accesses a human's account with the user's permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts. This presents significant security risks: Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents â programmed to fulfill requests or complete tasks on a user's behalf â contact call centers or appear to take actions independent of user instructions, the people said. Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances.
Fraizer gets into the nitty-gritty inside the magazine, and its sale by Springer Nature (apparently exasperated by articles like that May 2025 one; which, honestly, would be fine as a general politics article, but to pretend it's science ("but it's pOLiTiCaL science!") is daft) to a little-known publisher. But what is omitted is the wider picture: that the market for a science magazine had been dying for years, so what was Scientific American's USP? In the UK, New Scientist is hard science, feature and news article length. Why would you buy or subscribe to Scientific American, though? 2026-10-24T05:47:01Z {scientificamerican magazine science publishing}In March of 2026, in a nondescript, 46th-floor office overlooking lower Manhattan, about two dozen members of Scientific Americanâs editorial staff had gathered in person and online to talk openly about their approach to political coverage. David Ewalt, the editor in chief, wanted them all to understand something: The magazine was not âkowtowingâ to the Trump administration. In fact, according to a recording of the meeting obtained by The Nation, he asked staff present to âraise your hand if youâve ever heard me say not to cover a political story.â Two people raised their hands. For well over a year, rumours had been circulating among the staff about top-level editorsâ rejecting pitches they saw as too political, controversial articles triggering angry phone calls from Scientific Americanâs corporate owner, and even, on at least one occasion, ownership forcing editors to blunt language critical of the Trump administration. Then there was what happened to the opinion department. In the first months of the new administration, it had been publishing about 15 pieces a month, many of which criticized Trumpâs attacks on scientific research. But after the department published a particularly provocative column in May 2025ââScience Tells Us the U.S. Is Heading toward a Dictatorshipââmanagement, in what one staffer would later call an âunprecedentedâ move, had told the department to âpauseâ publishing new articles until the new editor in chief started.