Alvaro Lopez Ortega / 2026-10-27 Briefing

Created Fri, 30 Oct 2026 05:06:29 +0000 Modified Fri, 30 Oct 2026 06:06:55 +0000
8963 Words

Critical GoAhead flaws (CVSS 9.1) threaten Palo Alto, HP, Boeing and Lockheed devices, urging firmware updates. Ukraine said Starlink restrictions cut its jet-drone interception rate from 77% to 74%, while CERT-UA warned hackers are exploiting Dahua cameras. Research found 97% of school deepfake victims were girls, and scientists demonstrated hidden backdoors in AI weights that evade audits.

🤖 AI & Machine Learning

Hiding Capabilities in AI Models

Researchers constructed backdoor attacks that embed encrypted neural networks within AI model weights, executable only upon a secret trigger, making hidden capabilities provably hard to elicit or interpret even with full weight access. Tests using fine-tuning, weight noising, trigger search, and latent adversarial training showed resistance, revealing a limit of elicitation-based capability audits.

Cornell 7 reckoning: Research finds AI deepfakes overwhelmingly target girls in schools

Research by Cybernews found that 97% of identified school deepfake victims were female and most cases were sexually explicit, with more than half of attacks perpetrated by other students. The abuse has spread from school campuses to celebrities, exposing gaps in regulation and enforcement, while victims face humiliation, fear, reputational damage, depression, PTSD, and sexual trauma.

Anthropic now lets Claude users jump out of plane without parachute

Anthropic has introduced a Claude Code setting called CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS that lets users bypass permission prompts. The change is framed as a “jump out of a plane without a parachute” level of risk. The surrounding digest also covers AI lobbying and spending, GPT-6.1 Terra pricing, security incidents, and FOSS developments.

A whopping 3% of boardroom execs spy productivity and costs savings from AI

Only 3% of boardroom executives report seeing productivity and cost savings from AI. Many more are spending more than expected on AI, and spending is forecast to rise further by 2027.

Elvis rightsholders sue Anthropic for stealing songs and leaving them in Heartbreak Hotel

Elvis Presley rightsholders have sued Anthropic, accusing the AI company of stealing songs and continuing to make them available through chatbot interactions. The plaintiffs are seeking royalty compensation.

IBM admits mainframes need to be modernized and will use AI to do the job

IBM has acknowledged that mainframes need modernization and plans to use AI to help do it. The company promises to build an “IBM Z Atlas” tool to tidy up messy mainframe environments and enable AIOps.

Qwen has alter egos triggered by flipping a single neuron

Researchers individually pushed each of Qwen’s 442,368 MLP neurons up and down and asked “Who are you?”, finding the model sometimes adopted alter egos. In 34,220 of 884,736 replies, it claimed to be someone or something other than an AI. The project catalogs 34,220 personas and 35,074 off-topic replies, plus 8,827 changed-assistant replies rated weirdness 6 or higher.

New Records Obtained by EFF Expose More Problems with Medicare’s AI Experiment

New records obtained by EFF reveal further problems with Medicare’s AI-driven WISeR prior authorization program, including a rushed rollout and private CMS communications with vendors about potential noncompliance. The documents show limited public transparency around safeguards and clinician oversight, and EFF argues Congress should impose stronger legal limits on automated decision-making in Medicare.

Expanding our partnership with GSA to bring Claude to all levels of government

Anthropic is expanding its GSA partnership with a new agreement offering government partners a 40% discount on Claude Enterprise, Claude for Government, and the Claude API, with the discount applying across all product surfaces and extending to state, local, tribal, and territorial governments. The agreement includes no minimum spend commitment and is estimated to save the government $1 billion. A dedicated program will also help agencies implement Claude and adopt best practices.

Survival LLM: AI assistant and emergency library that runs on your own computer

Survival LLM is a free, open-source AI assistant and emergency library that runs entirely on a user’s computer and works without internet after setup. It answers emergency and survival questions from trusted sources, shows exact citations, and includes medical references, FEMA and CDC guidance, survival manuals, repair guides, and about 930,000 Wikipedia articles. The app selects an AI model based on the computer’s memory and requires an online setup download before offline use.

AI Flags Drivers as Suspicious for Police Stops

Law enforcement agencies are increasingly using AI-powered automated license plate readers to flag drivers whose travel patterns are deemed “suspicious” and pull them over, even without suspicion of a specific crime. The case of Grace Knowles, stopped during a 2025 road trip after her plate was flagged and shown ALPR location data, illustrates concerns raised by the ACLU over privacy, warrantless location tracking, and misuse. The ACLU’s warning comes as ALPR systems face growing public and institutional pushback.

Amazon Is Gutting Its AI Division After Sustained Failure

Amazon is scaling back its in-house AI efforts, placing most Nova text, image, and video models on minimal support and reorganizing teams to focus on “highest priority” goals. Resources are being redirected to a single frontier-model effort led by Pieter Abbeel, after Amazon closed an 80-person San Francisco AGI office. The shift follows the failure of Amazon’s power-hungry large language models to gain traction.

Genie 4

Google announced Genie 4, a new natively multimodal world model that improves real-time interactive simulation with generated audio, ambient sound, interactive dialogue, realistic physics, and human behavior. Built on Gemini capabilities, it lets users steer simulations with natural language and is rolling out as a research preview for trusted testers, starting with Google AI Ultra subscribers and early Gemini API and AI Studio partners.

Anthropic trained Claude on illegally obtained Stanford professors’ books

A federal judge ruled in May 2026 that Anthropic illegally scraped and pirated books by over 10 Stanford professors to train its Claude models, while allowing legally acquired books for AI training as fair use. The $1.5 billion Bartz v. Anthropic settlement covers nearly 500,000 registered works, but professors Tobias Wolff and Chang-rae Lee opted out and filed Cruz v. Anthropic seeking up to $150,000 per infringed work.

Specification First Agentic Development Plugin and Prove

Since early 2026, the implementation of “agent smith” has used over 1,000 specifications to generate about 500,000 lines of code. The specification-first approach is reported to work well, and the article asks how others apply it.

Wikipedia’s Cleanup of AI-Generated Content

A volunteer WikiProject AI Cleanup launched in 2023 works to find and remove AI-generated Wikipedia material that violates the site’s guidelines. Its volunteers are now developing tools to detect subtler AI writing and misleading citations, with estimates flagging 15–16% of new articles and drafts as AI-generated in early 2026, down from about 20% in late 2025. The effort is part of a broader debate over AI’s role in the encyclopedia after English Wikipedia prohibited using LLMs to generate articles.

AI promised less work. I’ve never worked more

The author argues that AI coding agents have not given him more time: by running several agents in parallel, he now juggles more tasks and loses time to constant context switching, leaving him more mentally drained. He uses his GitHub contribution history—showing busier early full-stack years, lower activity as a principal engineer, and a quieter start as VP—to examine how AI has changed the shape of his engineering workload.

AI is ruining haunted houses

The article argues that AI is increasingly being used in haunted attractions, from promotional flyers and posters to digital projections and props, including at major haunts. The author, who has run a home haunted attraction since 2005, says AI-generated art is especially damaging because haunt marketing should accurately reflect an analog, in-person experience. He describes the trend as a disappointing betrayal of the craft.

Anthropic’s Disproof of the ETH

Anthropic has released a paper titled “A Time Algorithm for 3-SAT” that it presents as a disproof of the Exponential Time Hypothesis. The Oct. 27, 2026, Version 1 includes an abstract, provenance statement, and 92 references.

There are now 5 inference providers for abliterated DeepSeek

AllModels now offers five independent inference providers for abliterated DeepSeek through a single router endpoint. Text requests use a fallback pool across eligible providers, while image and multimodal requests are sent only to providers that support them, with automatic failover when capacity is constrained.

🔒 Security & Privacy

Severe GoAhead flaws pose security risks to Palo Alto, HP, Lockheed Martin, Boeing devices

Three severe flaws in the GoAhead embedded web server could let attackers decrypt some TLS communications or bypass certificate checks, affecting devices from vendors including Palo Alto Networks, HP, Lockheed Martin, Boeing, Siemens, and Honeywell. The most serious flaw is rated critical with a CVSS score of 9.1 and undermines certificate validation and mTLS. The issues were fixed in GoAhead 6.1.1, and organizations should update firmware, especially for critical infrastructure equipment.

Ukraine warns hackers are exploiting China-made Dahua cameras

Ukraine’s CERT-UA warned that hackers are compromising Dahua surveillance cameras and recorders, changing settings and creating unauthorized accounts. Officials fear exposed feeds could help Russian intelligence monitor military movements and critical infrastructure. CERT-UA said Dahua’s Easy4IP feature and predictable serial numbers, along with weak passwords and outdated firmware, increase the risk.

PHP2Shell exploits target vulnerable PHP services

Censys reports that 32.5 million PHP services remain vulnerable to the PHP2Shell bugs, including 10.3 million in the US. CISA has added two critical PHP flaws to its exploited-vulnerabilities list, confirmed active exploitation, and ordered federal agencies to apply mitigations by October 29. Researchers have confirmed successful exploits yielding working shells, while admins are urged to update PHP, inventory hidden installations, and check logs for compromise.

AI companies could gain wider access to Europeans’ personal data under EU plan

EU member states back changing GDPR rules so AI companies can train models on Europeans’ personal data without consent, treating such processing as a legitimate interest under proposed Article 88bis. Privacy group noyb warns the change would give Big Tech broad access to data collected across Europe. The proposal still needs the European Parliament’s position and could face court challenges.

Test account using “Password1” caused data leak affecting thousands of people

The UK ICO reprimanded Ogi Networks and Data Cymru after a cyberattack exposed the data of 3,300 people, most of them children, and encrypted 182.7GB of data. A test account protected by the weak password “Password1” remained active or was reactivated for over 12 years. The ICO urged organizations to remove unused accounts, block weak passwords, and use multi-factor authentication.

Hackers breach school tech giant serving 50 million students nationwide

Frontline Education, a school software platform serving over 50 million students, suffered a two-day breach in August after hackers exploited a third-party software vulnerability. The company initially reported employee data theft and has now confirmed that student data across multiple U.S. school districts was also affected. Exposed information may include names, Social Security numbers, birth dates, government IDs, and Medicaid or student IDs; Frontline says it fixed the vulnerability and is offering monitoring services.

Fuzzers vs AI on JavaScript Engines

Project Zero compared Fuzzilli, a generative JavaScript engine fuzzer, with BigSleep, an LLM-based bug-finding system, on Chrome’s V8 engine. Over six months, BigSleep found 45 vulnerabilities versus Fuzzilli’s 37, with 25% reported overlap and an estimated theoretical overlap of roughly 60%; the findings show each approach found substantial bugs the other missed, so fuzzing and LLMs remain complementary and vendors should use both.

An Evening with Berferd: In Which a Cracker is Lured, Endured, and Studied (1992)

The 1992 paper recounts how Bell Labs researcher Bill Cheswick used a deliberately vulnerable, monitored Unix system as a chroot jail to attract and observe an intruder nicknamed Berferd. It documents the attacker’s methods and the defenders’ efforts to contain and study him, offering an early account of honeypot-style security research.

An AI “hacker” found four severe vulnerabilities in the popular industrial control software EPICS in under four hours. The flaws include one critical and three high-severity bugs that could disrupt research experiments.

Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

The University of New Mexico canceled classes for a second day following a cyberattack on its Health Sciences Center. University hospitals have resumed accepting patients after an initial ambulance diversion, though recovery will proceed in phases.

Microsoft releases out-of-band Windows fixes with certificate updates

Microsoft released out-of-band Windows fixes that include certificate updates. The updates refresh the certificate trust list, including changes involving eMudhra, to help maintain trusted connections.

Attack on email hosting provider for German far right party AfD exposed 345k accounts

An attack on the email hosting provider for Germany’s far-right AfD exposed 345,000 accounts. Reporters swarmed the leaked email tranche as the party sought to dismiss the resulting scandals.

Japanese virtual desktop cloud hacked so hard it asks to be banned

A Japanese virtual desktop cloud service was hacked, and its CEO admitted that the service—used for foreign-exchange trading—had security holes the company was slow to fix. The breach was severe enough that the service effectively asked to be banned.

It’s not the bots, Flock

In leaked audio obtained by 404 Media, Flock CEO Garrett Langley told police chiefs at a private IACP conference that nationwide anti-Flock protests are “not real” and that social media opposition is largely driven by anonymous Russian bots. He also said his wife advised him never to apologize and that he would prefer never to do press interviews again, repeating a disproven theory about Ukraine strikes on Russian data centers affecting bot activity. The remarks follow Langley’s earlier denial of his surveillance technology’s role in tracking a woman who self-administered an abortion, which 404 Media reported.

Code-execution flaw in UEFI firmware threatens most servers on planet Earth

A 9.5-severity memory-corruption flaw, CVE-2026-97631, in TianoCore EDK II’s ICMP component affects UEFI firmware used by most server vendors and data centers, allowing malicious code to run before the OS and Secure Boot defenses. Public patch code makes exploit development easier, while patching millions of affected devices across hardware makers and cloud providers is expected to be slow and difficult.

Discovering and exploiting vulnerabilities in real-world software with Claude

An unreleased internal research model was used to discover critical vulnerabilities in widely used software, including browsers and operating systems, and to develop five sophisticated multi-step attack chains that could achieve remote code execution and other severe impacts with little to no user interaction. The findings demonstrate the model’s capability to create exploits in both open-source and proprietary software. Vulnerabilities were reported to affected vendors under coordinated disclosure; for example, 62 Chrome CVEs rated critical or high severity were assigned and patched as of Chrome 156.

Discord will soon let anyone find public server messages through Google

Discord will make discussions in Discoverable Servers easier to find through web search via new Server Web Pages, with some public-channel messages potentially appearing on the web starting in mid-December 2026. Admins can opt channels out, users can prevent their messages from being shown, and private servers and DMs remain excluded.

Mossad Has Devices Like the Exploding Pagers in “Every Country You Can Imagine” (2025)

Former Mossad director Yossi Cohen said the September 2024 Hezbollah pager operation was part of a broader “manipulated equipment” campaign developed in the early 2000s and deployed in “virtually every potential theatre of operation,” including “all the countries that you can imagine.” He said the method was not sufficiently deployed in Gaza before the October 7, 2023 attack and criticized Shin Bet and IDF intelligence for resisting Mossad involvement there.

We let our cloud agents query prod (with OIDC, not secrets)

Formal built OIDC Integrations to eliminate long-lived secrets by letting machine workloads authenticate with their own infrastructure identity and short-lived tokens. This enables cloud coding agents like Cursor and Devin to access production data and cloud infrastructure with auditable, policy-controlled, read-only permissions. Customers can enforce CEL-based conditions and use OIDC claims in authorization rules.

Data Recovery CEO Indicted for Allegedly Scamming Ransomware Victims

Zohar Pinhasi, a Florida data-recovery CEO, was indicted on federal charges that he defrauded ransomware victims by claiming his firm could recover encrypted files without paying hackers, while actually paying ransoms and charging clients hefty fees on top. The indictment mirrors ProPublica’s 2019 investigation into Pinhasi and his firm, MonsterCloud. Pinhasi has pleaded not guilty.

US Government is hiding a secret court ruling about how it spies on Americans

Democratic Senators Ron Wyden and Adam Schiff accuse the Trump administration of illegally withholding a secret Foreign Intelligence Surveillance Court ruling from Congress until lawmakers renew Section 702 of FISA. The ruling concerns search filters that let analysts access Americans’ intercepted communications without required approvals or records, and the administration missed its own 180-day deadline for public release. Civil liberties groups are urging Congress not to reauthorize the surveillance program while the ruling remains withheld.

Is my data used for model training?

Anthropic states that by default it does not use inputs or outputs from commercial products such as Claude for Work and the Anthropic API to train its models. If users explicitly report feedback or bugs, or opt in, Anthropic may use chats and coding sessions for training; feedback is stored securely for up to five years, de-linked from user and customer IDs, and not combined with other conversations. Team and Enterprise owners can disable member feedback through the Rate chats setting under Organization settings > Data and Privacy.

eMudhra are now blocking access to their certificate revocation list

eMudhra’s servers are blocking access to CRLs and related OCSP/repository endpoints for requests using certain User-Agent headers, including default curl, wget, Python urllib, and libwww-perl, returning 403 WAF responses. The issue was independently confirmed as of 25 October 2026; requests with a different User-Agent succeeded, and HTTPS plus some alternate hosts were not filtered.

Roblox downloaded 145GB models from us (including adult content) without asking

A crawler identifying itself as belonging to Roblox downloaded 145.5 GB across 1,027 files from 712 projects on Open3DLab, SFMLab, and SmutBase on October 15–16, 2026, including adult content and despite robots.txt, Terms of Service, and creator licenses. The sites blocked further scraping and emailed Roblox for comment but received no reply.

🐧 Linux & Open Source

Robinson: Raspberry Pi 5 on Fedora

Peter Robinson reports that Fedora support for Raspberry Pi 5 now covers all Model 5B variants, with Fedora 45 working without the temporary boot workaround required by Fedora 44; Compute Module 5 and Pi 500+ support remain works in progress. Accelerated graphics, storage, network, and USB work, but sound and some other features are not yet supported.

Denmark quietly drops open-source Microsoft Office alternative after users complain

Denmark’s digitization ministry ended a pilot that moved 38 employees from Microsoft Office to the open-source Collabora suite after users reported formatting problems, blank pages, and track-changes issues. The ministry has no current plans to resume its transition away from Microsoft. Other European governments are still testing or adopting open-source tools to reduce reliance on US technology.

Linux 7.4 Introduces DMA-BUF Support To I/O Path With IO_uring

Linux 7.4 has merged infrastructure enabling DMA-BUF support in the kernel I/O path through IO_uring, allowing zero-copy read/write operations using registered DMA-BUF buffers. The opt-in feature initially supports only raw NVMe PCIe block devices, with DMA-BUF buffers up to 4GB in size. It was led by Pavel Begunkov after eleven rounds of patch review.

KDE Fixes 15 Year Old Bug Over Inaccurate Notifications When Copying Files To USB Drives

KDE is fixing a 15-year-old bug where copy notifications inaccurately reported files as written to USB drives before data was actually flushed to the removable storage. The fix, arriving in next month’s KDE Frameworks 6.32 release, uses the sync_file_range() call so completion dialogs accurately reflect when data has been written to USB storage.

Pavee OS: Ikey Doherty’s New Daily-Driver Desktop Distro Being Built Atop Barney

Ikey Doherty has announced Pavee OS, an opinionated daily-driver desktop distribution built atop his Barney distro tooling and related layers. He also provided an update on Barney, which is intended as a reusable modern Linux distribution ecosystem. Development of Pavee OS can be tracked via its GitHub repository.

KDE Plasma 6.8.2 Released With Dozens Of Additional Bug Fixes

KDE Plasma 6.8.2 has been released as the latest point update, following Plasma 6.8.1 with dozens of additional bug fixes. The fixes include Wayland/KWin improvements, an animated wallpaper regression, KPipeWire framerate handling, Plasma Big Screen row and tile changes, disappearing desktop icons, Plasma Workspace fixes, and Union theme engine updates.

AMD EPYC Zen 6 PML Support, ARM64 On s390 Merged For Linux 7.4 KVM

Linux 7.4 has merged a broad set of KVM improvements, including AMD EPYC Zen 6 Page Modification Logging support and initial ARM64 virtualization support on IBM s390/Z. Intel KVM gains Instruction Timeout and Bus Lock VM Exit features aimed at mitigating denial-of-service attacks from malicious VMs. The update also adds ARM pKVM state isolation and confidential-computing work, plus AMD support for virtualizing Bus Lock Detect on SVM.

Accelerating HTTP Web Servers With In-Kernel eBPF Deliver Up To 4.5x Throughput

Beeper, an open-source project from ETH Zurich, NYU, and NVIDIA researchers, implements HTTP parsing and caching inside in-kernel eBPF to accelerate web servers. Its Linux Plumbers Conference presentation showed up to 3.4x throughput improvement, while an eBPF-based Hyper Rust HTTP fast path demonstrated up to 4.5x maximum throughput. The Rust code targets uses including L7 traffic monitoring, caching, and payload-based redirection.

Linux’s Modern NTFS Driver Now Supports Alternate Data Streams (ADS)

The modern NTFS kernel driver in Linux 7.4 now supports NTFS Alternate Data Streams (ADS), adding ioctl interfaces for enumerating, reading, writing, and removing streams plus a mount option for Windows-style [file]:[stream-name] access. Linux 7.4 also adds file-attribute query/update support, exposes NTFS volume serial numbers, supports mounting hibernated volumes, and includes validation, compatibility, and other fixes.

Linux 7.4 Expands Sensor Monitoring For More ASUS & MSI Motherboards, New Minisforum Driver

Linux 7.4 expands hardware sensor monitoring with added ASUS and MSI motherboard support, plus a new Minisforum UM780 XTX driver for EC monitoring and fan control. The release also adds support for ASUS ROG Ryujin III 360 cooling, additional Lenovo laptops and Dell systems, and new AMD k10temp devices expected to correspond to upcoming Ryzen Zen 6 processors.

Linux 7.4 Adds Apple M4/A18 Pro Support

Linux 7.4’s SoC patches add initial support for Apple’s M4 and A18 Pro, though M4 support is currently limited to booting the kernel and displaying a console. The release also adds mainline support for Google Tensor G5/Pixel 10 devices, unreleased Qualcomm Hawi and Nord SoCs with 22 boards, the Steam Frame VR headset, and the Milk-V Meles RISC-V board.

Filian, Fil-C binaries on Debian

The article reports strong compatibility for the memory-safe C/C++ compiler Fil-C, with many libraries and applications working unchanged and exceptions easy to fix. It introduces Filian, which adapts Debian 13 packages to compile and install with Fil-C, and notes Filnix does the same for Nix; crypto microbenchmarks show Fil-C code taking about 1x–4x as many cycles as clang. Filian binaries are not currently distributed, but users can compile once and share packages across synchronized Debian systems, and an audit script helps compare Fil-C with upstream sources.

ZacOS 9 and Mavernix: Two classic Apple desktops find their Wayland to Linux

ZacOS 9 and Mavernix are bringing classic Apple desktop environments to Linux via Wayland. Users can choose between a Platinum-style look and a Mavericks-era Aqua interface.

FreeBSD founder ports Omarchy to FreeBSD in ten days, ten releases

Jordan Hubbard, a FreeBSD co-founder, has independently ported the Wayland-based Omarchy desktop to FreeBSD as Daemonarchy, producing 10 releases in about 10 days. The project is unaffiliated with the Linux original and was built with LLM coding assistance, which could complicate FreeBSD’s debate over AI contributions.

DietPi v10.8 has been released

DietPi v10.8 has been released with a new WireGuard server/client management tool, software package setup by name instead of ID, and optimized HAProxy installation via apt without recompilation. It also adds Quartz64 ATAPI/SCSI optical drive support, ARM and UEFI support for UTM VMs, network configuration improvements, and fixes for several software packages and tools. Users can update by running dietpi-update.

💻 Software & Programming

Firefox 159 Released With AMD Linux Graphics Fix For Excessive Memory Use

Firefox 159 has been released with a fix for excessive memory use on Linux systems with AMD graphics when viewing map or place results on sites such as ChatGPT. The update also fixes Wayland tab issues, improves Firefox’s AI integrations, makes saved passwords available from the sidebar by default, and enables scroll-driven animations for web developers. It is available from Mozilla’s FTP server.

Reminder: Lobsters NYC Meetup Tomorrow 5:30 at Walker’s

The Lobsters NYC meetup is scheduled for tomorrow at 5:30 PM at Walker’s, under the name Alex. Attendees can arrive earlier or later, and updates will be posted if the group moves. Walker’s is near the Canal St. metro stop and offers food and drinks.

Ghostty 1.4 Release

Ghostty 1.4.0 was released on October 27, 2026, after seven months of work by 172 contributors across 2,889 commits. It brings major performance and memory improvements, complete Kitty graphics support with animation and relative placements—making it the first non-Kitty terminal to do so—plus SSH integration improvements and hundreds of fixes. The release also patches numerous security vulnerabilities in areas including paste protection, Kitty graphics, tmux control mode, shell integration, and macOS link handling.

Four Months of Zig

The author reflects on returning to Zig after several years, writing projects including a smallnet library called snurl, a TUI typing racer, and an n-body simulator, while noting disappointment that Zig’s built-in fuzzer was not yet functional. They also attended Zig Day Seattle, where Andrew Kelley was present, and praised the in-person community format and opportunities to collaborate with other Zig programmers. The post includes comparisons to Rust, the author’s previous go-to language.

1,447 emoji? We’ll do it live

Hylke, who designed Pidgin 2’s original emoticon set, is creating a base set of 1,447 GNOME-style emoji for Pidgin live on Twitch. He is also helping Pidgin 3 development releases with a new app icon and status symbols. He plans to stream a few times a week and is seeking sponsors for his open-source design work.

A fast and secure tar parser for the Rust ecosystem

Starting with version 0.131, uv uses tar-codec to parse source distributions. tar-codec is roughly twice as fast as uv’s previous tar implementation, astral-tokio-tar, while reducing exposure to parser differentials and other security risks. The blog post explains what tar-codec is and why it was built and optimized.

Finding panics with Call Graph Analyzer

Under the Open Device Partnership and with Microsoft, the Call Graph Analyzer (CGA) has been released to extract a call graph from monomorphized MIR and track which functions in a compiled Rust binary can panic. The tool can flag panic-capable calls via cargo cga check, and the post discusses why eliminating panics may be desirable and how this approach compares with existing methods.

A stackless floodfill automation (2023)

The 2023 article presents a stackless approach to automating flood-fill operations. It describes an implementation that performs flood-fill traversal without relying on a conventional stack.

Compile-Time Dependent Types

The article argues that compile-time dependent types are likely coming to systems programming, though existing features in C++, Rust, Zig, and C are limited or lack proper type systems. It introduces Syl, a language using a modal type system inspired by two-level type theory and OxCaml to track staticity and erasure, enabling compile-time computation and monomorphization.

A select should tell you something

The article discusses new customizable <select> elements that can be styled and can hold richer option content beyond plain text, such as font previews, current local times, aligned delivery details, and identifying information. It presents five before-and-after examples showing how these richer options help users recognize and compare choices rather than read and calculate. Because many browsers do not yet support customizable selects, the demos appear as ordinary selects unless viewed in Chrome or Edge.

Full Haskell-like Type Class resolution in Java

The article explores building a Haskell-style type class instance resolution engine in plain Java using reflection, generic type metadata, and a first-order unifier to support higher-kinded and overlapping instances. It is an experimental, non-production project that shows how much runtime type structure Java preserves and how close it can get to type-level programming without language changes.

When file infrastructure becomes the bottleneck

Legacy NAS, VPNs, and file-sync workflows create hidden costs. The article asks whether organizations’ current approach to managing files is still fit for purpose.

I’ve used WordPress for 20 years, and I’ve stopped recommending it

A longtime WordPress user whose agency built more than 1,500 commercial sites—most on WordPress—says he no longer recommends the platform to clients. He cites years of accumulating problems, including difficult plugin/theme maintenance, frequent plugin vulnerabilities, and the lack of sandboxing for plugins. He also says the project’s leadership is not fixing these issues and that how websites are built and read is changing again.

Hunger beats tenure: Advice for junior engineers

An Anthropic hiring manager has stopped using traditional coding interviews because AI now handles such challenges well, making accumulated framework knowledge less predictive of impact. He argues that “hunger beats tenure,” with newer engineers sometimes outperforming more experienced coders, and advises junior engineers to use their fresh eyes and naivety to question assumptions and spot overlooked opportunities.

One year of Dioxus fullstack in production: the good, the painful

After a year of running Dioxus fullstack in production for SaaS products, the author found the Rust code reliable and “boring” in production, with one language end-to-end and shared types making refactoring safer. The main pain is build and CI time: a release build takes 90 minutes on a GitHub-hosted runner, and the WASM build alone takes about 22 minutes on six cores. Overall, the stack has worked in production but carries significant compile-time costs.

Hex Raises $100M

Hex announced a $100 million fundraise and the launch of Hex 4.0, a clean-sheet rebuild of its analytics product aimed at an agent-native future. After four years of adding AI to its existing platform, Hex rebuilt the product around code, external-agent compatibility, and stronger context, controls, and guardrails for data work. The company says the new version addresses bloated agent tooling and the spread of AI-generated dashboards and reports.

JetBrains IDEs are now powered by libghostty

Starting with version 2026.3, JetBrains IDEs’ built-in terminal runs on libghostty, replacing JediTerm. The change adds modern terminal protocol support, including the Kitty keyboard protocol and modifyOtherKeys, improving key handling for CLI AI agents, editors, and shells. Terminal apps can now also follow the IDE’s light/dark theme automatically via terminal theme queries and notifications.

Firefox 159

The Firefox 159 release notes page provides information about what’s new in this version and invites user feedback, Bugzilla bug reports, and review of system requirements. It also offers download links for Firefox in English (US), including alternatives for Linux 64-bit, Linux ARM64, Android, and iOS.

My video has unit tests

The author used Claude Code to build a JavaScript renderer that generates a 15-second promotional video for the fuel-price app Petroly, allowing the video to be edited, reviewed, and tested as source code instead of in a video editor. The renderer produces SVG frames as a function of time and streams them through FFmpeg, enabling changes in plain language and checks such as ensuring a push notification cannot appear before the animated price chart reaches its target.

Play Cyberpunk 2077 in the Browser

A website at cyberpunk2077.lol is promoting browser-based play of Cyberpunk 2077, with a listed launch time of Oct. 22 at 5 PM CT. The page includes a “Play now” link and credits @omonkeyzz but provides no further details.

Just put some HTML on the web

The article warns that the internet is becoming more dangerous as LLMs improve at finding security flaws and critical CVEs increase, citing PHP2Shell and Node2Shell as recent examples. It argues that content-focused sites should consider static generation to reduce their attack surface instead of relying on complex server-side or CMS-based tooling. It also stresses that dynamic sites require ongoing patching and a clear maintenance plan.

Software may be getting worse, but it used to be horrible

The article argues that while software may be getting worse as code output rises without matching error reduction, nostalgia for past software quality is misguided. It recalls the 1990s Windows era as plagued by frequent crashes, Blue Screens of Death, and buggy device drivers, though physical distribution imposed some quality floor.

The Mythical Man-Month in the Age of AI

The article revisits Brooks’s Law—“adding manpower to a late software project makes it later”—and asks whether it still applies in the age of AI agents and LLMs. It argues that while AI removes some human bottlenecks, sequential tasks remain sequential and coordination overhead shifts to managing agents, reviewing outputs, and defining requirements. The proposed update is that adding agents to a project with unclear requirements “gets you the wrong answer faster.”

16-bit Windows (Windows 1.x, 2.x, 3.0, 3.1, etc.) on 64-bit Windows

An altered version of the winevdm 16-bit Windows emulator has been ported to 64-bit Windows to run Windows 1.x, 2.x, 3.0, and 3.1 applications. It supports installation for direct execution of Win16 binaries, configuration via otvdm.ini, and includes incomplete DOS emulation, for which DOSBox or MS-DOS Player are recommended.

🔌 Hardware & Devices

New Raspberry Pi Models Spotted in Linux Kernel

Device tree files merged into Raspberry Pi’s official Linux kernel tree have revealed two unannounced boards: a Raspberry Pi Zero 3 W and a Raspberry Pi 4 Model A. The Zero 3 W files indicate a Broadcom BCM2711 quad-core Cortex-A72 SoC, plus an SPI flash bootloader, a single HDMI output, and a possible power button, while the Pi 4 Model A is expected to be a lower-cost, cut-down variant amid component pricing and supply constraints. Neither board has been officially announced, and details such as storage configuration and clock speeds remain unconfirmed.

Steam Frame VR Headset Sees Mainline Support With Linux 7.4

Mainline Linux 7.4 will support Valve’s Steam Frame VR headset, codenamed Deckard, via upstreamed Device Tree patches authored by Linaro engineer Neil Armstrong. The headset uses Qualcomm’s Snapdragon 8 Gen 3 SoC, and mainline support could let other Linux distributions target it as an alternative to SteamOS. Full-featured support will still come first from downstream SteamOS kernel builds.

Apple launches M6 MacBook Pro and iMac

Apple announced M6-powered 14-inch MacBook Pro and 24-inch iMac models, both featuring faster CPUs, stronger on-device AI, and improved connectivity. The MacBook Pro adds Wi-Fi 7, Bluetooth 6, a Liquid Retina XDR display with optional nano-texture, a 12MP Center Stage camera, six speakers, and up to 24 hours of battery life, while the iMac offers a 24-inch 4.5K 500-nit Retina display, optional nano-texture glass, and up to 32GB unified memory with a dual 16-core Neural Engine. Preorders start October 28, with availability beginning November 6; the MacBook Pro comes in space black and silver.

Game Boy Color on My Conference Badge

At GitHub Universe, the conference badge is a full color-screen computer that can run emulators. Steve Francia used Gemini to enable a NES emulator, then added Game Boy and Game Boy Color emulation, allowing ROMs like The Legend of Zelda: Link’s Awakening to run. The badge can be turned upside down to use built-in touch game controls.

‘I Felt Blind Panic.’ They Opened Their New $2k iPhone Duo–and It Broke

Jesse Dalton’s new $2,000 Apple folding iPhone Duo malfunctioned about five minutes after he unboxed it last Friday, with the hinge sticking at a 45-degree angle after only four or five openings. When he tried to pry it open, he heard a loud pop, according to the report.

Micron Taiwan increasing salaries for factory workers by 2.7X

Micron Taiwan and its Taichung union reached a labor agreement under which more than 80% of employees will receive salary increases of nearly 2.7 times, with production-line annual pay rising from NT$630,000 to over NT$2 million and engineer pay rising to NT$4 million–NT$6 million. The agreement also raises employer pension contributions to 10% and triples day-shift allowances for frontline shift workers from NT$1,500 to NT$4,500.

🌍 Policy, Science & Culture

How to watch NBA on NBC: Coast 2 Coast Tuesday

NBC and Peacock’s Coast 2 Coast Tuesday will air a live NBA doubleheader on Tuesday nights during the 2026-27 regular season, with an 8 p.m. ET game on NBC in Eastern/Central zones and an 8 p.m. PT game in Mountain/Pacific zones. Both games stream nationwide on Peacock. The first doubleheader is Oct. 27, 2026, featuring Pistons-Knicks at 8 p.m. ET and Trail Blazers-Lakers at 8 p.m. PT.

The Institute for the Study of War reported that Ukraine’s jet-powered drone interception rate fell from 77% to about 74% during restrictions on military-grade Starshield service between October 14 and 24, 2026. Analysts said Ukraine’s interceptor drones need Starshield to catch fast-moving Russian jet-powered drones, and Ukrainian officials reported the service stopped working on terminals moving at 100 mph or faster. Elon Musk said he ordered the restriction, while a Ukrainian defense insider disputed his claims.

Boston Dynamics workers revolt over $1.3 million ICE robot dog deal

More than 300 Boston Dynamics employees signed a petition urging the company to halt support for a $1.3 million DHS/ICE-related contract with Radeco for four modified Spot robot dogs called Cerberus. The robots are intended to inspect dangerous areas, detect hazards, and help monitor suspected cross-border tunnels, but employees fear reputational damage and ties to ICE deportation operations. Boston Dynamics management has stood by the deal and says its terms prohibit using Spot robots to harm, intimidate, or enable weapons.

US blocks Huawei-linked surveillance chips over national security fears

The FCC has banned a dashboard camera and a wireless video transmitter from US marketing and sales because they contain Huawei-linked HiSilicon chips deemed a national security risk. The FCC said the chips are designed for surveillance uses, including facial detection, and pose an unacceptable risk. The ban took effect on October 13 but was only recently made public.

Take it on the chin SatNad: Microsoft chief exec’s pay slips 6% in record year

Microsoft CEO Satya Nadella’s pay fell 6% in a record year for the company, even as revenue and operating profit rose. Microsoft locked in 30 million paid Copilot seats, added 88 datacenters, and returned $43.8 billion to shareholders.

UK ministers had plenty of time for AI datacenter bosses, but none for environmental groups

A UK investigation found that ministers met extensively with AI datacenter executives but gave no meetings to environmental groups over AI Growth Zones. Business interests dominated government discussions, while local communities were left out of decisions about the zones.

How everyday technology choices drive true workplace sustainability

Introducing certified, environmentally friendly meeting room solutions such as Barco ClickShare in a standardized way can help organizations meet sustainability goals, according to a sponsored feature. A Barco ClickShare survey found 96% of 500 U.S. tech leaders say their sustainability activities significantly contribute to global strategy, 98% believe IT should lead such efforts, and most would reject a job offer from an employer without a strong sustainability record. Since only 6% of IT departments are sole decision-makers on tech investments, collaboration across procurement, finance, facilities, operations, sustainability teams, and executives is needed to embed sustainability into everyday technology decisions.

Marissa Mayer Can’t Keep Pretending ‘Gender Doesn’t Matter’

Former Yahoo CEO Marissa Mayer has drawn criticism after saying she used her new AI app to list things she loves about her daughter and for again dismissing gender as a major factor in tech. In a New York Times interview, Mayer argued that passion can neutralize gender and cited female AI executives while brushing off concerns about AI bias. The article contrasts her stance with documented disparities including women leaving tech by 35, pay gaps, and lower funding for female founders.

New Dwarf Planet Candidate in Our Solar System

NSF–DOE Vera C. Rubin Observatory has discovered a new dwarf planet candidate, provisionally designated 2026 ED138, during observations ahead of the LSST. The object lies beyond Pluto’s orbit and initial analysis suggests it may be among the largest and brightest bodies found in that region. The Minor Planet Center announced the discovery, which was presented at the 58th Annual DPS meeting.

I used to be homeless. That experience shapes my science

The article is a first-person account by a scientist who experienced homelessness and says that experience shapes their science. The available text does not include further details because it requires JavaScript and cookies to view.

Trump says he will ban everyone from using the phrase ‘artificial intelligence’

President Donald Trump has promised to ban the phrase “artificial intelligence” and promote the term “super intelligence” instead. He has already directed the federal government to use “super intelligence” and criticized The Wall Street Journal for defending “AI.”

Radio-tagged Monarch butterflies

The item highlights radio-tagged Monarch butterflies and links to resources from Monarch research and conservation groups. The referenced pages cover radio-tagging projects, tracking technologies, and related Monarch research efforts.

Maine banned phones in schools to help teens focus and connect. It’s working

Maine has banned phones in schools as a way to help teens focus and connect, and the policy is reported to be working. The provided article content did not include further details.

Who Is Responsible for Tackling Professional Deskilling?

The provided article contains no substantive news content; it only displays a message stating that JavaScript must be enabled and robot verification completed to continue. As a result, no factual summary about responsibility for professional deskilling can be drawn from the text.

Vicious Cycles: Theses on a philosophy of news (2020)

The essay interrogates what makes something “news,” tracing a circular logic in which importance is defined by coverage and editorial judgment while audiences’ demand for novelty and stimulation shapes public life. Drawing on Daniel Boorstin’s concept of the pseudo-event, it argues that staged, reportable events exist mainly to be covered and have transformed politics from policy and legislation into emotion and entertainment.

Antique Fonts Collection – Restored 19th Century Typefaces

A new Antique Fonts Collection offers restored 19th-century typefaces revived from original specimens in the Century Library archive. Each font was scanned, cleaned, and converted into a usable digital typeface without modern redesign, retaining original imperfections. Character sets vary by font and are limited to what appeared in the source material.

Viral Polls Are Not Representative Polls

The article warns that viral polls are not representative polls, since passive news consumers see polls amplified by social media rather than representative samples. Analyzing 90 days of posts from a Bluesky polling-distribution account, it finds that polls more favorable to Democrats than the race average tend to receive more reposts. The author notes Bluesky is not a representative sample but says the pattern matches earlier Twitter findings.

Cancer vaccines are finally here. How do we get them to patients?

A Phase 3 study reported at ESMO showed the personalized mRNA cancer vaccine intismeran autogene reduced recurrence or death risk by 42% versus pembrolizumab alone, making it the first neoantigen mRNA therapy to meet a Phase 3 endpoint in oncology. The article says attention must now turn to accelerating development and patient access, citing regulatory pathways poorly suited to personalized n-of-1 therapies and a planned $200 million NCI/FNIH initiative to build trial networks and infrastructure.

Industry Knew for Decades That Microplastics Could Infiltrate Human Bodies

An investigation found that the chemical industry has known for decades that ingested microplastic particles can reach vital organs, citing internal documents that referenced a 1974 study showing PVC particles entered animals’ bloodstreams and tissues. Industry scientists alarmed by the findings discussed them in memos, while public scientific understanding of microplastics’ human health effects is still developing. An industry representative disputed characterizations that companies remained silent, saying scientific debate over evidence is not silence.

Greg Abbott Took $9M from Data-Center Donors. Now He Regulates Them

Texas Governor Greg Abbott has received about $9 million in data-center-related campaign contributions since July 2025—roughly 13% of his fundraising—while pausing data-center grid approvals and calling to end the industry’s major tax break. The donations came from data-center developers, AI companies, investors, and suppliers, with large sums arriving around his regulatory announcements. The 2027 Texas legislative session is expected to address data-center grid connections, water consumption, and infrastructure costs.

I will no longer upload to NEW

The article announces that the author will no longer upload to NEW. It states that AI scrapers break the web and that the page requires JavaScript to be enabled.

A simplified proof of ETH is False [pdf]

A paper presents a simplified proof arguing that the Exponential Time Hypothesis (ETH) is false. If correct, the claim would challenge a central assumption in fine-grained complexity theory.

UK to charge universities $1,200 per international student

From August 2028, universities in England will pay an annual £925 levy for each international student beyond an initial 220-student exemption, covering new and existing students from countries including China, India, Nigeria, Pakistan, and Bangladesh. Students will not pay the fee directly, but universities may raise international tuition to recover costs. University leaders have criticized the levy over declining overseas enrollment and financial strain, while the government says it will support higher education funding.

The ‘Buy, Borrow and Die’ Wealth Strategy Has Become a $5T Market

The “buy, borrow and die” strategy—where wealthy investors borrow against stock to fund purchases instead of selling shares—has grown into a $5 trillion market. Banks supplying these loans benefit because collateral losses are rare and most collateral can be sold quickly, allowing them to book almost all fees as pure profit.