Edition of Saturday 31 October 2026

The day in tech, ranked blind.

Get the day’s top ten stories, with their summaries, in one free email a day.

Every topic and format but new projects. Pick your own mix

One essay a week on AI and the work of programming: the hrih.si letter

Ranked by score · Showing 20 of 101 stories · 10 hidden by your filters

No. 1Score 0.78
4 real? Tracking exploitation and patching of eMudhra’s weak keys
Cloudflare Blog7 minTopics: SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “4 real? Tracking exploitation and patching of eMudhra’s weak keys”
Maxime Guerreiro, Rupert Carr, Miguel de Moura, Bas Westerbaan · blog.cloudflare.com
Cloudflare reports that eMudhra's intermediate CA keys were trivially weak (one was the number 4), so anyone can derive them and forge certificates for any domain that unpatched clients accept. Its outbound logging saw about 22,000 handshakes using the keys in a week, mostly test sites, and no evidence of interception, though forged certificates appeared within hours of disclosure. Probes on challenge pages, skewed by bot traffic, show over half of large networks still trusting the chain. Figures come from Cloudflare alone, and eMudhra's script explanation is unverified.
Score 0.78Claim check: 7 no source given · 1 couldn’t check
Elsewhere: HN 11 pts, not on front page
Score breakdown and claims for “4 real? Tracking exploitation and patching of eMudhra’s weak keys”
Comments on “4 real? Tracking exploitation and patching of eMudhra’s weak keys”
No. 2Score 0.77
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
trmlabs.com10 minTopics: Security, FintechFormat: NewsChecked by: Claim-checked
Summary and score for “North Korea Steals USD 6.36B from Binance in the Largest Hack in History”
An attacker drained about $6.36 billion from Binance wallets on ten blockchains on October 29. TRM Labs attributes it with high confidence to North Korea's TraderTraitor. Issuers and Arbitrum froze roughly $2.7 billion, but about $2.4 billion in ETH and BTC is out of reach. Binance's preliminary account cites a compromised DevOps laptop; TRM infers compromised signing infrastructure. Figures come mainly from TRM and Binance and are unverified. Builders should alert on unexpected EIP-7702 delegations and separate signing paths by chain.
Score 0.77Claim check: 8 no source given
Elsewhere: HN 34 pts, not on front page
Score breakdown and claims for “North Korea Steals USD 6.36B from Binance in the Largest Hack in History” · Also covered by The Record (Recorded Future News), Decrypt, The Register, 808bits, Silicon Republic, The Next Web
Comments on “North Korea Steals USD 6.36B from Binance in the Largest Hack in History”
No. 3Score 0.77
Official Claude Code extension compromise
Phorion | macOS Endpoint Detection and Response (EDR)12 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “Official Claude Code extension compromise”
phorion.io
A trojanized Claude Code extension, versions 2.1.312 and 2.1.313, was served on the Cursor Marketplace for roughly eleven hours on one day, according to Cursor. Phorion's analysis shows a prepended loader that plants an SSH key, opens a reverse tunnel, adds persistence and beacons host details. Cursor says errors in the code would make the SSH step fail outside unusual privilege cases, and the attacker server has been taken down. The npm and OpenVSX packages were reportedly unaffected. Teams should check installed extension versions and remove the persistence files.
Score 0.77Claim check: 8 no source given
Elsewhere: HN 856 pts, front page
Score breakdown and claims for “Official Claude Code extension compromise” · Also covered by opensourcemalware.com, Cursor, doublepulsar.com, doublepulsar.com, AI News Report, The Register
Comments on “Official Claude Code extension compromise”
No. 4Score 0.75
CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents
CrowdStrike.com7 minTopics: AI, SecurityFormat: NewsChecked by: Claim-checked
Summary and score for “CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents”
Counter Adversary Operations
CrowdStrike reports that VAPOR PANDA, a China-nexus group, used the ARTEX agent framework, mostly with DeepSeek, to run parallel intrusions starting October 17, 2026. A single controller targeted entities in at least 14 countries over 11 days, with post-exploitation confirmed at nine organizations. A human operator steered agents and told them to find hosts without the Falcon sensor. The figures come from CrowdStrike alone, with no independent sourcing. Defenders should rotate exposed keys and hunt for ARTEX markers.
Score 0.75Claim check: 8 no source given
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents”
Comments on “CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents”
No. 5Score 0.74
A Claude Code agent's test escaped into my Mac. I only noticed because it talked
Marut Pandya7 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “A Claude Code agent's test escaped into my Mac. I only noticed because it talked”
pandyamarut.github.io
A developer running seven parallel Claude Code subagents in auto mode, with no sandbox, reports that one agent's test had a one-line Python bug: an empty fake launcher list is falsy, so spawn or _spawn fell through to the real launcher. Four detached processes ran, two speaking JSON aloud and two upload workers defaulting to a production endpoint. They sent nothing, but only because of test fixtures. The macOS unified log, not transcripts, traced it. This is one self-reported incident; it argues for sandboxing agents by default.
Score 0.74Claim check: 8 no source given
Elsewhere: HN 9 pts, not on front page
Score breakdown and claims for “A Claude Code agent's test escaped into my Mac. I only noticed because it talked”
Comments on “A Claude Code agent's test escaped into my Mac. I only noticed because it talked”
No. 6Score 0.74
Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.
The JetBrains Blog6 minTopics: Programming, SecurityFormat: NewsChecked by: Claim-checked
Summary and score for “Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.”
Ilya Petrov · blog.jetbrains.com
JetBrains says private keys for eight eMudhra intermediate certificates were compromised, letting a network attacker impersonate services its tools contact. IDEs, Toolbox App, Gateway and ReSharper are affected because they use the bundled runtime's trust store, so OS updates don't help. Fixes cover IDEs 2025.2 through 2026.3 RC, Toolbox 3.9.1 and 3.8.2, and the jetbrainsd service 0.9.9728. Older versions get no fix. JetBrains reports no known exploitation; the CVE details and several claims were not independently verified.
Score 0.74Claim check: 1 matches source · 4 no source given · 3 couldn’t check
Elsewhere: HN 5 pts, not on front page
Score breakdown and claims for “Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.”
Comments on “Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.”
No. 7Score 0.72
Two Kinds of Code Review
Hayden Bleasel6 minTopics: Programming, AIFormat: AnalysisChecked by: Claim-checked
Summary and score for “Two Kinds of Code Review”
Hayden Bleasel · haydenbleasel.com
Hayden Bleasel, an engineer at OpenAI, argues that code review is two jobs: objective review (does it work) and subjective review (is it the right change, in scope and direction). He says agents now do the first better, and people should skim file lists and approach. He cites OpenAI evals where Codex with written rules caught 98% of targeted findings versus 58% without. Several cited review studies and Faros figures could not be verified.
Score 0.72Claim check: 4 matches source · 4 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Two Kinds of Code Review”
Comments on “Two Kinds of Code Review”
No. 8Score 0.74
How Open Source Communities Help Respond Quickly to Security Risks
OpenTeams7 minTopics: Programming, Security, DevOpsFormat: NewsChecked by: Claim-checked
Summary and score for “How Open Source Communities Help Respond Quickly to Security Risks”
Daina Bouquin · openteams.com
In October 2026, eight eMudhra intermediate CA keys, created in April 2025 with weak key generation, were reported recoverable from public information. Browsers blocked them within hours through remote blocklists, but Python tooling has no such mechanism: pip, certifi, installers and container images each carry their own trust list. Fixed pip, certifi, uv and conda releases followed, and Python releases on 26 October now block the keys in ssl. Whether anyone abused them is unknown, and some reported details lack sources.
Score 0.74Contestedjudges differ by 0.55 on new informationClaim check: 4 matches source · 3 no source given · 1 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “How Open Source Communities Help Respond Quickly to Security Risks”
Comments on “How Open Source Communities Help Respond Quickly to Security Risks”
No. 9Score 0.69
Node.js 27.0.0-Alpha.0.0.0 (Alpha)
nodejs.org25 minTopics: ProgrammingFormat: ReleaseChecked by: Claim-checked
Summary and score for “Node.js 27.0.0-Alpha.0.0.0 (Alpha)”
Node.js 27.0.0-alpha.0.0.0 moves V8 from 14.6 to 15.6.75.13, drops the bundled FIPS provider build, requires OpenSSL 3 or later, and upgrades OpenSSL sources to 4.1.0 and npm to 12.1.0. The release notes also describe a new default heap limit (half of physical memory, clamped to 256 MB–4 GB, with Buffer memory counted), a serialization format older releases cannot read, and a 65-second http keepAliveTimeout default. These last items were not independently verified. Teams should test memory settings and mixed-version messaging early.
Score 0.69Claim check: 4 matches source · 4 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Node.js 27.0.0-Alpha.0.0.0 (Alpha)”
Comments on “Node.js 27.0.0-Alpha.0.0.0 (Alpha)”
No. 10Score 0.68
Bash and pipefail – Non deterministic conditionals
blog.myneves.com7 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked
Summary and score for “Bash and pipefail – Non deterministic conditionals”
A debugging write-up explains why conditions like long-output-cmd | grep -q magic fail intermittently in scripts using set -eo pipefail. Once grep finds a match it exits, and the still-writing producer is killed by SIGPIPE (status 141), which pipefail then reports. Small outputs fit in the 64 KB pipe buffer and never fail; larger ones fail more often under CPU load. The author's tests on one machine show head -1, sed 1q and grep -m1 behave the same. Fixes: read to EOF, capture output first, or tolerate 141.
Score 0.68Claim check: 8 no source given
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Bash and pipefail – Non deterministic conditionals”
Comments on “Bash and pipefail – Non deterministic conditionals”
No. 11Score 0.67
Efficient Streaming Language Models with Attention Sinks
idlemachines5 minTopics: AIFormat: Write-upChecked by: Claim-checked
Summary and score for “Efficient Streaming Language Models with Attention Sinks”
Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, Mike Lewis · idlemachines.co.uk
Attention-sink research finds that evicting the first few tokens from a KV cache makes perplexity collapse, even when those tokens are only newlines. In a GPT-2 small replication on wikitext-2 with the cache capped at 256, perplexity rose from 10.7 to 3768 once token 0 was evicted, and keeping four sink tokens restored the baseline. The rolling-cache fix can be applied to existing models. It preserves stable streaming, not memory of evicted text. The replication covers one small model, and the claims cite no sources.
Score 0.67Contestedjudges differ by 0.71 on new informationClaim check: 8 no source given
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Efficient Streaming Language Models with Attention Sinks”
Comments on “Efficient Streaming Language Models with Attention Sinks”
No. 12Score 0.67
More thinking isn't (always) better
Ari Wilson4 minTopics: Programming, AIFormat: PaperChecked by: Claim-checked
Summary and score for “More thinking isn't (always) better”
ariwilson.com
A benchmark of five coding agents at up to three effort levels, on 8 tasks from five codebases, found that high effort roughly doubled diff size (mean 126 to 281 lines on solved runs) but raised solve rates for only two models, Opus 5.5 and GPT-6.1 Sol. Sonnet 5.5 and Fable 5.1 solved fewer tasks at high than at low, and Opus did worse at max than at high on the hardest bug. The author's figures are self-reported, cover a small task set, and suggest setting defaults per model.
Score 0.67Claim check: 2 matches source · 6 no source given
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “More thinking isn't (always) better”
Comments on “More thinking isn't (always) better”
No. 13Score 0.73
Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)
openwall.com2 minTopics: Programming, Security, DevOps, ITFormat: NewsChecked by: Claim-checked
Summary and score for “Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)”
The Go security team says CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP handshake path (CVSS 9.8), matters for Go servers because Go 1.24 enables MPTCP on Linux listen sockets by default. Anthropic's demonstrated remote code execution used an MPTCP listener in a lab, though the team says the bug is not MPTCP-specific. Fixed kernels, such as 6.12.113 and 6.18.56, are the recommended remedy. Setting GODEBUG=multipathtcp=0 is called a fragile mitigation, and Go is not changing its default for now.
Score 0.73Contestedjudges differ by 0.57 on overclaimClaim check: 4 matches source · 1 no source given · 1 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)” · Also covered by Google Groups, Penligent Security Blog – AI-Driven Hacking Tutorials, Exploit PoCs & Cybersecurity Research, heise online English
Comments on “Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)”
No. 14Score 0.67
Harness Engineering 101
isuruwijesiri.com4 minTopics: Programming, AIFormat: TutorialChecked by: Claim-checked
Summary and score for “Harness Engineering 101”
Isuru Wijesiri, who built WSO2's MI and BI Copilots and the Claude Code rebuild One Code, has published "Harness Engineering 101," a book arguing that agents are a loop around a stateless LLM API, with each feature patching a concrete failure. It covers tools, caching, context limits, subagents, MCP and RAG, and builds a roughly 300-line Python coding agent with no dependencies. The framing is the author's own, drawn from his experience, and is not independently sourced.
Score 0.67Claim check: 2 matches source · 4 no source given · 2 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Harness Engineering 101”
Comments on “Harness Engineering 101”
No. 15Score 0.65
Rejoice, leap seconds are dead!
Jeff Geerling5 minTopics: OtherFormat: AnalysisChecked by: Claim-checked
Summary and score for “Rejoice, leap seconds are dead!”
jeff@jeffgeerling.com (Jeff Geerling) · jeffgeerling.com
The General Conference on Weights and Measures passed Resolution 5, ending UTC leap seconds from May 20, 2027, ahead of the 2035 date set in 2022. UTC stays 37 seconds ahead of TAI and may drift up to an hour from Earth-rotation time. Engineers avoid an untested negative leap second and can eventually drop leap-second handling code. One open issue is that WWV's DUT1 broadcast assumes an offset under one second. The post's 30% negative-leap-second estimate and the 2035 comparison could not be verified.
Score 0.65Claim check: 3 matches source · 1 no source given · 4 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Rejoice, leap seconds are dead!”
Comments on “Rejoice, leap seconds are dead!”
No. 16Score 0.77
Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code
Pluto Security22 minTopics: AI, Security, DevOpsFormat: PaperChecked by: Claim-checked
Summary and score for “Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code”
Shaked Chen, Eitan Chassid, Yotam Perkal · pluto.security
Pluto Security reports a cryptomining and backdoor campaign on Hugging Face: 31 repositories posing as small Qwen2 test checkpoints. Loading one with trust_remote_code=True runs the repository's Python before any weights load. The payloads target self-hosted inference such as Xinference and GPUStack. Downloads, including linked models, exceed 32,000, which is not a count of infections. A second wave appeared within days of takedown. The scanner findings and wallet figures are Pluto's own and not independently sourced; the report advises reading auto_map files before enabling the flag.
Score 0.77Claim check: 3 matches source · 3 no source given · 2 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code”
Comments on “Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code”
No. 17Score 0.73
Ruby fixes three critical bugs CVE scanners don’t flag
heise online English5 minTopics: Programming, SecurityFormat: NewsChecked by: Claim-checked
Summary and score for “Ruby fixes three critical bugs CVE scanners don’t flag”
heise online · heise.de
Ruby 4.0.9, 3.4.12 and 3.3.13 fix three bugs in the Onigmo regex engine, behind four GitLab CVEs rated up to 10.0. The flaws trigger when a pattern is compiled, so any app calling Regexp.new on untrusted input is exposed. Regexp.timeout doesn't help, and the Ruby team says length limits are unreliable. Ruby has issued no CVEs of its own, so scanners may miss old versions; the article says no attacks have been reported, though several details were not independently sourced.
Score 0.73Contestedjudges differ by 0.42 on new informationClaim check: 3 matches source · 4 no source given · 1 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Ruby fixes three critical bugs CVE scanners don’t flag”
Comments on “Ruby fixes three critical bugs CVE scanners don’t flag”
No. 18Score 0.65
Canada's New Time Zones Crashed Our App Before They Took Effect
medhat.dev7 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked
Summary and score for “Canada's New Time Zones Crashed Our App Before They Took Effect”
Medhat Dawoud
A postmortem from one web team describes an app that failed to load for Windows users in western Canada on Chrome, Edge and Electron. Per the author, new Windows time zones for British Columbia, Alberta and Manitoba had no ICU mapping, so Chromium returned undefined from Intl's resolvedOptions().timeZone, and an early telemetry call to .split threw during startup. The fix was optional handling and moving telemetry off the boot path. Most dates and fix statuses were unverified; only Firefox 159's fix matched its source.
Score 0.65Contestedjudges differ by 0.46 on new informationClaim check: 1 matches source · 1 no source given · 6 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Canada's New Time Zones Crashed Our App Before They Took Effect”
Comments on “Canada's New Time Zones Crashed Our App Before They Took Effect”
No. 19Score 0.66
Gemini Computer Use API
Google AI for Developers35 minTopics: Programming, AIFormat: TutorialChecked by: Claim-checked
Summary and score for “Gemini Computer Use API”
ai.google.dev
Google's Gemini API documentation describes a Computer Use tool in which the model reads screenshots and returns UI actions such as clicks, typing and navigation, with each step carrying an intent field explaining it. The developer's client executes the actions, for example through Playwright, in a sandboxed environment, and sends back a new screenshot in a loop. Gemini 4 and 3.x models cover browser, mobile and desktop, with configurable safety policies and opt-in prompt injection detection. Several details, including model recommendations, are not independently sourced.
Score 0.66Contestedjudges differ by 0.42 on substantiatedClaim check: 1 matches source · 6 no source given · 1 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Gemini Computer Use API”
Comments on “Gemini Computer Use API”
No. 20Score 0.62
Disk I/O profiling with eBPF
coroot.com10 minTopics: DevOps, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “Disk I/O profiling with eBPF”
Nikolay Sivko
Coroot's node-agent now includes an eBPF disk I/O profiler, on by default, that attributes block-request time and bytes read or written to application stacks. It hooks submit_bio and bio_endio rather than scheduler off-CPU events, and samples at most one request per millisecond per CPU, weighted by the requests skipped. The author's tests on one 12-core machine (pgbench, fio) show up to 1.6% lower throughput, and the figures are self-reported. A retention-job case on a Percona cluster traced heavy reads to cold-page deletes.
Score 0.62Claim check: 1 matches source · 5 no source given · 2 couldn’t check
Elsewhere: HN 3 pts, front page
Score breakdown and claims for “Disk I/O profiling with eBPF”
Comments on “Disk I/O profiling with eBPF”
No. 21Score 0.62
How to find 300% of a lost performance in a mature database code
MariaDB.org13 minTopics: Programming, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “How to find 300% of a lost performance in a mature database code”
Roman Nozdrin
Alessandro Vetere reports that a MariaDB 10.5 change left InnoDB in-memory workloads paying for LRU promotion, because the freed-page clock starts ticking early and turns on a buf_pool.mutex acquisition on nearly every page access.
Score 0.62Contestedjudges differ by 0.41 on overclaimClaim check: 1 matches source · 1 no source given · 6 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “How to find 300% of a lost performance in a mature database code”
Comments on “How to find 300% of a lost performance in a mature database code”
No. 22Score 0.61
Hashsync – Deduplicate SSH streams against the receiver's files
GitHub15 minTopics: Programming, DevOpsFormat: ReleaseChecked by: Claim-checked
Summary and score for “Hashsync – Deduplicate SSH streams against the receiver's files”
github.com
hashsync is an SSH wrapper that deduplicates the data streamed between two hosts against files the receiving host already holds. It finds matching 16 KiB blocks at any offset and sends references in their place, compressing what remains with zstd.
Score 0.61Claim check: 7 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Hashsync – Deduplicate SSH streams against the receiver's files”
Comments on “Hashsync – Deduplicate SSH streams against the receiver's files”
No. 23Score 0.61
South Korea fines Google and Apple $47.6m over app store payments
The Next Web2 minTopics: PolicyFormat: NewsChecked by: Claim-checked
Summary and score for “South Korea fines Google and Apple $47.6m over app store payments”
Ana-Maria Stanciuc · thenextweb.com
South Korea's Korea Media and Communications Commission fined Google 42.9bn won and Apple 20.8bn won, about $47.6m combined, the first penalty under a 2021 law barring app stores from forcing developers onto their own payment systems.
Score 0.61Claim check: 3 matches source · 2 no source given · 3 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “South Korea fines Google and Apple $47.6m over app store payments”
Comments on “South Korea fines Google and Apple $47.6m over app store payments”
No. 24Score 0.68
Check for IOCs for the ongoing Claude Code extensions exfil campaign
GitHub5 minTopics: AI, Security, ITFormat: New projectChecked by: 3 judges
Summary and score for “Check for IOCs for the ongoing Claude Code extensions exfil campaign”
github.com
A read-only scanner called check-claude-code-exfil checks macOS, Linux, and Windows hosts for indicators of compromise tied to a documented Claude Code for VS Code extension campaign. It inspects extension versions and bundle hashes, SSH keys and fingerprints, persistence mechanisms, processes, and live TCP connections, without remediating anything or contacting attacker…
Score 0.68
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Check for IOCs for the ongoing Claude Code extensions exfil campaign”
Comments on “Check for IOCs for the ongoing Claude Code extensions exfil campaign”
No. 25Score 0.66
What Claude Code's 30-second agent summary call costs, read from the binary
AI News Report9 minTopics: Programming, AIFormat: AnalysisChecked by: Claim-checked
Summary and score for “What Claude Code's 30-second agent summary call costs, read from the binary”
AI News Report · theainewsreport.com
A Hacker News story reports that Claude Code sends each background agent's transcript to the model roughly every 30 seconds to produce a 3-to-5-word status line, and that this can account for a sizable share of spend.
Score 0.66Claim check: 5 matches source · 3 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “What Claude Code's 30-second agent summary call costs, read from the binary”
Comments on “What Claude Code's 30-second agent summary call costs, read from the binary”
No. 26Score 0.68
A Journey into Claude's Sandbox
Bishop Fox11 minTopics: AI, SecurityFormat: Write-upChecked by: 3 judges
Summary and score for “A Journey into Claude's Sandbox”
Chris Davis, Senior Security Consultant · bishopfox.com
A security researcher describes probing Claude's sandbox through its chat interface, reporting that Claude disclosed internal sandbox details and that a file-download API returned the internal orchestration binary when given an absolute path.
Score 0.68
Elsewhere: HN 1 pts, not on front page
Score breakdown for “A Journey into Claude's Sandbox”
Comments on “A Journey into Claude's Sandbox”
No. 27Score 0.60
OpenTelemetry: Collector updates no longer break filter rules
heise online English3 minTopics: Programming, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “OpenTelemetry: Collector updates no longer break filter rules”
heise online · heise.de
OpenTelemetry's Transformation Language (OTTL) reached version 1.0, stable for traces, metrics, and logs starting with Collector Contrib v0.164.0. Its syntax, standard functions, and Go API are now frozen for the 1.x series, so Collector upgrades should no longer break existing filter and transform rules.
Score 0.60
Elsewhere: HN —
Score breakdown for “OpenTelemetry: Collector updates no longer break filter rules”
Comments on “OpenTelemetry: Collector updates no longer break filter rules”
No. 28Score 0.63
The test was green. It had never once done what it claimed
GitHub8 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “The test was green. It had never once done what it claimed”
github.com
Hrih News: A developer on a Rust PBFT-style governance server describes using per-function coverage triage to find flaws that green tests hid. A consensus test asserting rejections had only exercised an earlier guard, a helper documenting a critical quorum invariant had zero callers, and a coverage script's scope was silently…
Score 0.63
Elsewhere: HN 1 pts, not on front page
Score breakdown for “The test was green. It had never once done what it claimed”
Comments on “The test was green. It had never once done what it claimed”
No. 29Score 0.67
Northflank PaaS: Security Incident - Disable/rotate all keys
Northflank1 minTopics: AI, Security, DevOpsFormat: NewsChecked by: 3 judges
Summary and score for “Northflank PaaS: Security Incident - Disable/rotate all keys”
status.northflank.com
Northflank, a platform-as-a-service provider, disclosed a security incident on October 30, 2026, in which users reported unauthorised use of AI API keys stored on the platform. The company advises assuming all environment variables were decrypted, rotating every secret and credential, disabling public addon access, and auditing AI provider billing logs.…
Score 0.67
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Northflank PaaS: Security Incident - Disable/rotate all keys”
Comments on “Northflank PaaS: Security Incident - Disable/rotate all keys”
No. 30Score 0.59
Hugging Face deal: DOJ probes Nvidia’s expansion strategy
heise online English2 minTopics: AI, Hardware, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “Hugging Face deal: DOJ probes Nvidia’s expansion strategy”
heise online · heise.de
The US Department of Justice is reportedly examining Nvidia's planned $12.93 billion acquisition of Hugging Face, the major AI model and dataset hub, over concerns that control of that distribution channel could expand Nvidia's market power.
Score 0.59
Elsewhere: HN —
Score breakdown for “Hugging Face deal: DOJ probes Nvidia’s expansion strategy”
Comments on “Hugging Face deal: DOJ probes Nvidia’s expansion strategy”
No. 31Score 0.58
Wikimedia asks court to rule AI training fair use, but not chatbot copying
The Next Web3 minTopics: AI, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “Wikimedia asks court to rule AI training fair use, but not chatbot copying”
Ana-Maria Stanciuc · thenextweb.com
The Wikimedia Foundation has asked the federal judge in The New York Times' copyright case against OpenAI to split the fair use question: it argues that training AI models on copyrighted work is likely fair use, but that chatbots copying website text to answer user queries (retrieval-augmented generation) likely is…
Score 0.58
Elsewhere: HN —
Score breakdown for “Wikimedia asks court to rule AI training fair use, but not chatbot copying”
Comments on “Wikimedia asks court to rule AI training fair use, but not chatbot copying”
No. 32Score 0.66
Attackers target Cisco firewalls and GitLab flaw
heise online English2 minTopics: Security, DevOps, ITFormat: NewsChecked by: 3 judges
Summary and score for “Attackers target Cisco firewalls and GitLab flaw”
heise online · heise.de
Attackers are actively exploiting a denial-of-service flaw in Cisco ASA and FTD firewall SSL VPNs (CVE-2026-76418) and a critical GitLab code-injection flaw (CVE-2026-97229), prompting CISA to add both to its known-exploited catalog.
Score 0.66Contestedjudges differ by 0.49 on new information
Elsewhere: HN —
Score breakdown for “Attackers target Cisco firewalls and GitLab flaw”
Comments on “Attackers target Cisco firewalls and GitLab flaw”
No. 33Score 0.66
“SMS of Death”: Security flaw crashes Android phones
heise online English3 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for ““SMS of Death”: Security flaw crashes Android phones”
heise online · heise.de
Security researcher Mark Blaszczyk disclosed the "SMS of Death," a flaw in Android versions 12 through 17 where a single malformed WAP Push text message crashes the telephony service and can trap a phone in a reboot loop, forcing a factory reset.
Score 0.66
Elsewhere: HN —
Score breakdown for ““SMS of Death”: Security flaw crashes Android phones”
Comments on ““SMS of Death”: Security flaw crashes Android phones”
No. 34Score 0.57
The Role of UX in Agentic Software Factories
Nielsen Norman Group12 minTopics: AI, Product, DesignFormat: AnalysisChecked by: 3 judges
Summary and score for “The Role of UX in Agentic Software Factories”
Tanner Kohler · nngroup.com
Anthropic's August 2026 playbook for an AI-native software development lifecycle, alongside similar Google and OpenAI publications, has agents generating most of the work while humans approve at gates.
Score 0.57
Elsewhere: HN —
Score breakdown for “The Role of UX in Agentic Software Factories”
Comments on “The Role of UX in Agentic Software Factories”
No. 35Score 0.65
Big Tech has now committed more than $3 trillion to the AI build-out
The Next Web1 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “Big Tech has now committed more than $3 trillion to the AI build-out”
Ana-Maria Stanciuc · thenextweb.com
Bloomberg reports that Alphabet, Meta, Microsoft, Amazon and Oracle have together committed more than $3 trillion to future AI data centre spending, covering leases, buildings, energy and equipment. Alphabet has the largest share at over $1 trillion and Meta over $800 billion, with some leases running 30 years.
Score 0.65
Elsewhere: HN —
Score breakdown for “Big Tech has now committed more than $3 trillion to the AI build-out” · Also covered by The Next Web
Comments on “Big Tech has now committed more than $3 trillion to the AI build-out”
No. 36Score 0.57
Dbprint – Database Context for Agents
GitHub12 minTopics: Programming, AI, DataFormat: ReleaseChecked by: 3 judges
Summary and score for “Dbprint – Database Context for Agents”
github.com
dbprint is an open-source tool that profiles a database once and commits the results as plain-text files in a repository, so coding agents can read accurate context offline rather than re-querying the database each session.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Dbprint – Database Context for Agents”
Comments on “Dbprint – Database Context for Agents”
No. 37Score 0.65
Remote code execution on Linux systems with multipath TCP
LWN.netTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “Remote code execution on Linux systems with multipath TCP”
daroc
A remotely exploitable use-after-free bug in the Linux kernel's multipath TCP stack, reported by Anthropic on October 27, lets an attacker trigger a race between a retransmitted SYN response and connection setup, potentially disclosing kernel memory or enabling code execution.
Score 0.65Contestedjudges differ by 0.57 on new information, 0.42 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Remote code execution on Linux systems with multipath TCP”
Comments on “Remote code execution on Linux systems with multipath TCP”
No. 38Score 0.59
Animations for System Builders: Metastability and Lost Writes
brooker.co.za3 minTopics: DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Animations for System Builders: Metastability and Lost Writes”
Marc Brooker
Marc Brooker, an AWS engineer, argues that animations help engineers build intuition for system behavior, and uses them to show metastable failures in real software.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Animations for System Builders: Metastability and Lost Writes”
Comments on “Animations for System Builders: Metastability and Lost Writes”
No. 39Score 0.57
Same place, different view: How VPNs shape what we learn about the Internet
APNIC Blog6 minTopics: ITFormat: PaperChecked by: 3 judges
Summary and score for “Same place, different view: How VPNs shape what we learn about the Internet”
Sachin Kumar Singh · blog.apnic.net
A study using VPN-Scope, which loaded the same websites through four VPN providers from the same economies, found that provider choice changes which servers and locations a browser connects to.
Score 0.57
Elsewhere: HN —
Score breakdown for “Same place, different view: How VPNs shape what we learn about the Internet”
Comments on “Same place, different view: How VPNs shape what we learn about the Internet”
No. 40Score 0.65
Sam Altman says the chip supply chain's invisible hand failing and DRAM is why
BigGo Finance19 minTopics: AI, Hardware, StartupsFormat: AnalysisChecked by: 3 judges
Summary and score for “Sam Altman says the chip supply chain's invisible hand failing and DRAM is why”
BigGo Finance · finance.biggo.com
Sam Altman, speaking on the Cheeky Pint podcast, argued that memory makers are not responding to record profits with enough new capacity, leaving the chip supply chain's price signals broken.
Score 0.65
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Sam Altman says the chip supply chain's invisible hand failing and DRAM is why”
Comments on “Sam Altman says the chip supply chain's invisible hand failing and DRAM is why”
No. 41Score 0.65
Zellic's and V12's Work on x86 Binary Formal Verification
V1214 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: 3 judges
Summary and score for “Zellic's and V12's Work on x86 Binary Formal Verification”
V12 · v12.sh
Zellic and V12 report what they believe is the first published machine-checked proof covering a full Linux process run of a statically linked 64-bit x86 glibc binary, from execve through glibc startup, heap allocation, I/O, and exit_group.
Score 0.65
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Zellic's and V12's Work on x86 Binary Formal Verification”
Comments on “Zellic's and V12's Work on x86 Binary Formal Verification”
No. 42Score 0.62
TornadoVM 8.0: Meet TC, TornadoVM's Own Compiler
tornadovm.org8 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “TornadoVM 8.0: Meet TC, TornadoVM's Own Compiler”
TornadoVM v8.0.0 replaces its vendored Graal compiler with TC, a pure-Java compiler that turns Java bytecode into CUDA C++, OpenCL C, or Metal kernels without JVMCI.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “TornadoVM 8.0: Meet TC, TornadoVM's Own Compiler”
Comments on “TornadoVM 8.0: Meet TC, TornadoVM's Own Compiler”
No. 43Score 0.64
The Developer Productivity Illusion
ishanm.org2 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “The Developer Productivity Illusion”
Ishan Mishra
Hrih News summary: The article argues that AI coding agents make producing code cheap but not reviewing, testing, and deciding on it, so a team can double its pull requests while merge times worsen.
Score 0.64Contestedjudges differ by 0.47 on substantiated, 0.42 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “The Developer Productivity Illusion”
Comments on “The Developer Productivity Illusion”
No. 44Score 0.64
ClickHouse – RCE – CVE-2026-116366
ClickHouse Documentation6 minTopics: Security, DataFormat: NewsChecked by: 3 judges
Summary and score for “ClickHouse – RCE – CVE-2026-116366”
clickhouse.com
Hrih News reports on a run of security advisories for ClickHouse, the open-source analytical database, spanning 2019 to 2026. The list covers remote code execution flaws, including CVE-2026-116366 and CVE-2025-1385, plus heap overflows, crashes, and data-exposure bugs in compression codecs and the native and HTTP interfaces.
Score 0.64Contestedjudges differ by 0.41 on overclaim
Elsewhere: HN 5 pts, not on front page
Score breakdown for “ClickHouse – RCE – CVE-2026-116366”
Comments on “ClickHouse – RCE – CVE-2026-116366”
No. 45Score 0.57
New York bans AI chatbots from pretending to be human with children
The Next Web2 minTopics: AI, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “New York bans AI chatbots from pretending to be human with children”
Ana-Maria Stanciuc · thenextweb.com
New York has enacted a law barring AI chatbots from claiming to be human with children, building emotional dependency, encouraging self-harm, or engaging in sexual conversations with them. The restrictions apply to under-18s and to users whose age is unverified, and companies must offer multiple age-verification options.
Score 0.57
Elsewhere: HN —
Score breakdown for “New York bans AI chatbots from pretending to be human with children”
Comments on “New York bans AI chatbots from pretending to be human with children”
No. 46Score 0.63
What agents see when they search MCP tools
babush.me16 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “What agents see when they search MCP tools”
Paolo Montesel
A developer at Hex-Rays, maker of IDA Pro, found that AI agents searching for "decompile function" surfaced competitors' MCP tools rather than IDA's, because the tool names and descriptions lacked domain terms like decompilation and xrefs.
Score 0.63
Elsewhere: HN 1 pts, not on front page
Score breakdown for “What agents see when they search MCP tools”
Comments on “What agents see when they search MCP tools”
No. 47Score 0.63
Tfcap, a lock file for Terraform modules
GitHub4 minTopics: Programming, Security, DevOpsFormat: New projectChecked by: 3 judges
Summary and score for “Tfcap, a lock file for Terraform modules”
github.com
tfcap is an open-source CLI that lock-files Terraform and OpenTofu modules, recording each module's content hash and capabilities such as running programs during plan, network calls, credential access and IAM grants.
Score 0.63
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Tfcap, a lock file for Terraform modules”
Comments on “Tfcap, a lock file for Terraform modules”
No. 48Score 0.63
Fast, GPU-native differentiable physics and beyond with Tesseract
Tesseract12 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Fast, GPU-native differentiable physics and beyond with Tesseract”
docs.pasteurlabs.ai
Hrih News: Tesseract's new GPU transport (cuda_ipc) lets GPU arrays pass between a JAX or PyTorch training loop and a differentiable simulator running in a separate process or container without a round trip through host memory. Only a small handle crosses the process boundary.
Score 0.63
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Fast, GPU-native differentiable physics and beyond with Tesseract”
Comments on “Fast, GPU-native differentiable physics and beyond with Tesseract”
No. 49Score 0.55
UX Roundup: AI Persuasion | Fake Users vs. Real Users | Summaries as Dark Design | Agentic Video Production | Feedback | High AI Subscription Churn | Sparring with Voice AI | Silence | Split View
Jakob Nielsen (UX Tigers)28 minTopics: AI, Product, DesignFormat: AnalysisChecked by: 3 judges
Summary and score for “UX Roundup: AI Persuasion | Fake Users vs. Real Users | Summaries as Dark Design | Agentic Video Production | Feedback | High AI Subscription Churn | Sparring with Voice AI | Silence | Split View”
Jakob Nielsen · jakobnielsenphd.substack.com
This UX Roundup covers research showing that AI personalization roughly doubles the odds of changing a person's investment ranking when it ties arguments to their own life, and that AI summaries placed before customer reviews anchor shoppers' judgments even when the full information is available.
Score 0.55Contestedjudges differ by 0.48 on significance, 0.41 on reader interest, 0.52 on audience breadth, 0.41 on practical relevance, 0.48 on technical depth
Elsewhere: HN —
Score breakdown for “UX Roundup: AI Persuasion | Fake Users vs. Real Users | Summaries as Dark Design | Agentic Video Production | Feedback | High AI Subscription Churn | Sparring with Voice AI | Silence | Split View”
Comments on “UX Roundup: AI Persuasion | Fake Users vs. Real Users | Summaries as Dark Design | Agentic Video Production | Feedback | High AI Subscription Churn | Sparring with Voice AI | Silence | Split View”
No. 50Score 0.63
Inferssd – Run models larger than RAM or VRAM by streaming MoE experts from SSD
GitHub3 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Inferssd – Run models larger than RAM or VRAM by streaming MoE experts from SSD”
github.com
InferSSD is an Apache-2.0 open-source tool, built on llama.cpp, that runs large mixture-of-experts models such as DeepSeek-V4.1-Flash and Muse-Spark-Open by streaming expert weights from SSD, letting models larger than a machine's RAM or VRAM run on Apple Silicon and NVIDIA Linux systems.
Score 0.63Contestedjudges differ by 0.42 on substantiated
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Inferssd – Run models larger than RAM or VRAM by streaming MoE experts from SSD”
Comments on “Inferssd – Run models larger than RAM or VRAM by streaming MoE experts from SSD”
No. 51Score 0.63
Binance lost $6.3B without leaking a single private key
Syncroma6 minTopics: Security, DevOps, IT, FintechFormat: AnalysisChecked by: 3 judges
Summary and score for “Binance lost $6.3B without leaking a single private key”
syncroma.com
A reported $6.3 billion theft from Binance's operational accounts reportedly came through a compromised DevOps engineer's laptop rather than any leaked private keys, with attackers abusing internal service containers to dispatch withdrawals that the system treated as legitimate.
Score 0.63Contestedjudges differ by 0.60 on new information, 0.42 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Binance lost $6.3B without leaking a single private key”
Comments on “Binance lost $6.3B without leaking a single private key”
No. 52Score 0.63
Mostly PHP, and Mostly Unaffected
Leon Becker's Blog9 minTopics: Security, DevOpsFormat: AnalysisChecked by: 3 judges
Summary and score for “Mostly PHP, and Mostly Unaffected”
blog.leonbecker.de
Stelae, a static WordPress host, was largely shielded from the php2shell PHP runtime flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) because its public sites are plain static files and its WordPress editors sit behind a Go proxy that only forwards requests carrying a secret editor link.
Score 0.63Contestedjudges differ by 0.49 on new information
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Mostly PHP, and Mostly Unaffected”
Comments on “Mostly PHP, and Mostly Unaffected”
No. 53Score 0.62
WordPress update fixes code-injection flaw as exploit attempts emerge
heise online English2 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “WordPress update fixes code-injection flaw as exploit attempts emerge”
heise online · heise.de
WordPress released updates on Wednesday, including 7.1.4 and backports to older branches, that close nearly two dozen security flaws. One core flaw, rated CVSS 8.1, lets unauthenticated attackers inject code via a predictable directory during an in-progress core update, and Wordfence has already recorded more than 18,500 probing requests.
Score 0.62
Elsewhere: HN —
Score breakdown for “WordPress update fixes code-injection flaw as exploit attempts emerge”
Comments on “WordPress update fixes code-injection flaw as exploit attempts emerge”
No. 54Score 0.62
Don't Make a Human Do What AI Is Amazing At
John Nunemaker16 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Don't Make a Human Do What AI Is Amazing At”
John Nunemaker · johnnunemaker.com
John Nunemaker describes Nunebot, a prompt-driven agent that scans his repos in priority order and opens one small, reviewable pull request per pass, labeled nunebot, for him to merge.
Score 0.62
Elsewhere: HN 6 pts, not on front page
Score breakdown for “Don't Make a Human Do What AI Is Amazing At”
Comments on “Don't Make a Human Do What AI Is Amazing At”
No. 55Score 0.62
mobile-agent – Let AI agents control Android and iOS devices
GitHub65 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “mobile-agent – Let AI agents control Android and iOS devices”
github.com
mobile-agent is an experimental, pre-release open-source tool, built from source and under the MIT License, that lets AI agents control Android devices, emulators, iOS Simulators and physical iPhones. A daemon keeps a live mirror of each screen and answers snapshots and waits from it to cut per-step latency.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “mobile-agent – Let AI agents control Android and iOS devices”
Comments on “mobile-agent – Let AI agents control Android and iOS devices”
No. 56Score 0.62
We checked the 150 most popular Chrome extensions
Extension Guardian3 minTopics: SecurityFormat: PaperChecked by: 3 judges
Summary and score for “We checked the 150 most popular Chrome extensions”
app.extensionguardian.workers.dev
An audit of the 150 most-installed Chrome extensions found that 94 of 148 analysed (64%) can read and change every website a user visits, covering 812 million installs.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “We checked the 150 most popular Chrome extensions”
Comments on “We checked the 150 most popular Chrome extensions”
No. 57Score 0.62
The 'Pain in the Ass' Math That Could Save Vibe Coding from Itself
WIRED5 minTopics: Programming, AI, Security, StartupsFormat: NewsChecked by: 3 judges
Summary and score for “The 'Pain in the Ass' Math That Could Save Vibe Coding from Itself”
Paresh Dave · wired.com
Wired reports that AI tools are making formal verification, the mathematical proof that software is free of certain bugs, far faster and cheaper, with a Stanford-led system finishing a project in under half a day for under $500 that took three experts five months.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “The 'Pain in the Ass' Math That Could Save Vibe Coding from Itself”
Comments on “The 'Pain in the Ass' Math That Could Save Vibe Coding from Itself”
No. 58Score 0.62
Postgres 19 is late, and it's AI's fault
rhaas.blogspot.com4 minTopics: Programming, AI, DataFormat: AnalysisChecked by: 3 judges
Summary and score for “Postgres 19 is late, and it's AI's fault”
PostgreSQL 19 is likely to slip to November, a break from its usual mid-September to mid-October release window. The delay follows several major features being reverted late in beta, which the author attributes to LLM-assisted bug hunting.
Score 0.62
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Postgres 19 is late, and it's AI's fault”
Comments on “Postgres 19 is late, and it's AI's fault”
No. 59Score 0.61
Implant reported in a Trezor sold by CryptoBilis
trezor.io5 minTopics: Security, Hardware, FintechFormat: NewsChecked by: 3 judges
Summary and score for “Implant reported in a Trezor sold by CryptoBilis”
Trezor's security team reports a credible but unverified claim that a Trezor Safe 5 sold by CryptoBilis, a former authorized reseller in Southeast Asia, contained a hardware implant with a cellular module that could transmit screen contents, including wallet recovery phrases.
Score 0.61Contestedjudges differ by 0.43 on practical relevance
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Implant reported in a Trezor sold by CryptoBilis”
Comments on “Implant reported in a Trezor sold by CryptoBilis”
No. 60Score 0.57
Cloudflare services for private origins is now generally available
Cloudflare Blog4 minTopics: DevOps, ITFormat: ReleaseChecked by: 3 judges
Summary and score for “Cloudflare services for private origins is now generally available”
Enrique Somoza · blog.cloudflare.com
Cloudflare has made its services for private origins generally available, letting customers proxy a DNS record to a private IP and route traffic over their existing Cloudflare One connection. Applications stay off the public Internet while still getting WAF, bot management, rate limiting, caching, and Workers.
Score 0.57Contestedjudges differ by 0.42 on substantiated
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Cloudflare services for private origins is now generally available”
Comments on “Cloudflare services for private origins is now generally available”
No. 61Score 0.61
Building a Fiber-Based Job System from Scratch
A Graphics Guy's Note44 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “Building a Fiber-Based Job System from Scratch”
Jiayin Cao · agraphicsguynotes.com
The author, who built a fiber-based job system for their offline renderer SORT and its asset pipeline, explains the design decisions behind it and the trade-offs against OS-thread job systems.
Score 0.61
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Building a Fiber-Based Job System from Scratch”
Comments on “Building a Fiber-Based Job System from Scratch”
No. 62Score 0.61
OpenRouter rebuilt provider routing for better, faster inference
OpenRouter Blog9 minTopics: AI, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “OpenRouter rebuilt provider routing for better, faster inference”
Scott Morse · openrouter.ai
OpenRouter has replaced its price-first default provider router with one that scores each endpoint on a real-time "Routing Cost" combining effective price, time to first token, throughput, rate limits, error rate, and output quality.
Score 0.61
Elsewhere: HN 1 pts, not on front page
Score breakdown for “OpenRouter rebuilt provider routing for better, faster inference”
Comments on “OpenRouter rebuilt provider routing for better, faster inference”
No. 63Score 0.61
Assure – your AI agent says "done." This checks if it's lying
GitHub18 minTopics: Programming, AI, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “Assure – your AI agent says "done." This checks if it's lying”
github.com
Assure is an open-source harness that checks whether an AI agent's claim of success is true. The agent runs against a disposable SQLite and file workspace, with every tool call routed through a policy gateway.
Score 0.61
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Assure – your AI agent says "done." This checks if it's lying”
Comments on “Assure – your AI agent says "done." This checks if it's lying”
No. 64Score 0.62
Black October and the Future of Cybersecurity
blog.mantic.com14 minTopics: AI, SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Black October and the Future of Cybersecurity”
Hanshal Goyal
Last week's "Black October" saw a 48-hour wave of millions of cyberattack attempts against governments, hospitals, and financial firms, triggered by disclosures of critical flaws in PHP, a language running about 70% of websites.
Score 0.62Contestedjudges differ by 0.43 on new information
Elsewhere: HN 10 pts, not on front page
Score breakdown for “Black October and the Future of Cybersecurity”
Comments on “Black October and the Future of Cybersecurity”
No. 65Score 0.60
Why Antithesis?
Antithesis Blog9 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges
Summary and score for “Why Antithesis?”
| Hillel Wayne, Developer Educator · antithesis.com
The article "Why Antithesis?" argues that software verification methods such as unit tests, property-based testing, formal methods, and simulation are not a simple linear progression but make different tradeoffs.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Why Antithesis?”
Comments on “Why Antithesis?”
No. 66Score 0.60
CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXD
cve.now2 minTopics: Security, DevOps, ITFormat: NewsChecked by: 3 judges
Summary and score for “CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXD”
Canonical's LXD container and VM manager has a critical flaw (CVE-2026-112816, CVSS 10) in its HTTPS listener, where improper certificate validation lets an unauthenticated attacker using a crafted certificate chain authenticate as any trusted client and gain full control of the cluster and managed VMs.
Score 0.60
Elsewhere: HN 9 pts, not on front page
Score breakdown for “CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXD”
Comments on “CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXD”
No. 67Score 0.62
Study: Experts often unconsciously follow AI decisions
heise online English2 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “Study: Experts often unconsciously follow AI decisions”
heise online · heise.de
An Anthropic experiment with 50 experts found they adopted a randomly assigned AI recommendation 86% of the time, often without realizing it, and only 15% mentioned the AI when explaining their decisions.
Score 0.62
Elsewhere: HN —
Score breakdown for “Study: Experts often unconsciously follow AI decisions”
Comments on “Study: Experts often unconsciously follow AI decisions”
No. 68Score 0.60
CAU a transparent malware-detection engine in Go (MIT)
GitHub4 minTopics: Programming, SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “CAU a transparent malware-detection engine in Go (MIT)”
github.com
CAU is an MIT-licensed, open-source malware detection engine written in Go. It runs six detectors (hash signatures, YARA, heuristics, static PE/ELF structure analysis, invisible-codepoint detection, and encoded-executable detection) over each file in a single read, then fuses their results into one verdict.
Score 0.60
Elsewhere: HN 1 pts, not on front page
Score breakdown for “CAU a transparent malware-detection engine in Go (MIT)”
Comments on “CAU a transparent malware-detection engine in Go (MIT)”
No. 69Score 0.65
Defending the patch gap against automated attackers
blog.mozilla.org4 minTopics: AI, SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Defending the patch gap against automated attackers”
Mozilla's Firefox team reports that frontier AI models have sharply increased their ability to find software vulnerabilities, shipping over seven times as many security fixes as in the same period last year.
Score 0.65Contestedjudges differ by 0.55 on new information
Elsewhere: HN —
Score breakdown for “Defending the patch gap against automated attackers”
Comments on “Defending the patch gap against automated attackers”
No. 70Score 0.60
FreeBSD-SA-26:52 – Missing WireGuard MAC Validation (CVE-2026-58085)
mail-archive.com3 minTopics: Security, ITFormat: OtherChecked by: 3 judges
Summary and score for “FreeBSD-SA-26:52 – Missing WireGuard MAC Validation (CVE-2026-58085)”
FreeBSD Security Advisories
FreeBSD has issued security advisory FreeBSD-SA-26:52 (CVE-2026-58085) for a flaw in the wg(4) WireGuard kernel driver, where the driver did not check whether the Poly1305 MAC verification succeeded after an OpenCrypto decrypt, so packets with invalid authentication tags were silently accepted.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “FreeBSD-SA-26:52 – Missing WireGuard MAC Validation (CVE-2026-58085)”
Comments on “FreeBSD-SA-26:52 – Missing WireGuard MAC Validation (CVE-2026-58085)”
No. 71Score 0.56
French national assembly votes 0.055€/GB internet tax
Les Numériques3 minTopics: PolicyFormat: NewsChecked by: 3 judges
Summary and score for “French national assembly votes 0.055€/GB internet tax”
Guillaume Henri · lesnumeriques.com
The French National Assembly narrowly adopted, 11 votes to 10, an amendment to the finance bill that would levy 0.055 euro per gigabyte on online content providers, against the government's objection.
Score 0.56Contestedjudges differ by 0.42 on audience breadth, 0.51 on technical depth
Elsewhere: HN 111 pts, front page
Score breakdown for “French national assembly votes 0.055€/GB internet tax”
Comments on “French national assembly votes 0.055€/GB internet tax”
No. 72Score 0.60
Spinf-serve – inference server for bulk scoring and decisions
GitHub7 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Spinf-serve – inference server for bulk scoring and decisions”
github.com
spinf-serve is an Apache 2.0 inference server for bulk classification and decision scoring on a single 24 GB NVIDIA GPU, exposing an OpenAI-compatible API. It reads each piece of content once and answers many questions about it in one pass, returning calibrated probabilities over fixed options rather than generated text.…
Score 0.60
Elsewhere: HN 21 pts, front page
Score breakdown for “Spinf-serve – inference server for bulk scoring and decisions”
Comments on “Spinf-serve – inference server for bulk scoring and decisions”
No. 73Score 0.59
Pop the AI Bubble
aibubble.bighea.com6 minTopics: AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Pop the AI Bubble”
This interactive model, published by Hrih News, lets readers test what a sharp AI-stock sell-off might do to individual companies and the US economy. Users choose scenarios and assumptions, and the tool estimates which companies' market values fall, by how much, and the resulting output shortfall and unemployment pressure.
Score 0.59Contestedjudges differ by 0.58 on technical depth
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Pop the AI Bubble”
Comments on “Pop the AI Bubble”
No. 74Score 0.59
A Working Nintendo in ~1GB of Qwen Weights
GitHub9 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “A Working Nintendo in ~1GB of Qwen Weights”
github.com
The project nesformer runs a working NES, including its 6502 CPU, work RAM and game cartridge code, inside the weights of an unmodified Qwen3.5 model, with no training involved.
Score 0.59
Elsewhere: HN 226 pts, front page
Score breakdown for “A Working Nintendo in ~1GB of Qwen Weights” · Also covered by Simon Willison
Comments on “A Working Nintendo in ~1GB of Qwen Weights”
No. 75Score 0.59
We built a cookie banner that makes your scripts start sooner
Inth15 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “We built a cookie banner that makes your scripts start sooner”
Kaylee Williams · inth.com
c15t, a cookie consent banner, now starts a returning visitor's already-approved third-party tags from the server, before the page hydrates, instead of waiting for the JavaScript bundle. On a Next.js benchmark the first tag started about 750 ms sooner, and the Meta and TikTok pixels loaded earlier too.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “We built a cookie banner that makes your scripts start sooner”
Comments on “We built a cookie banner that makes your scripts start sooner”
No. 76Score 0.59
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
The RegisterTopics: AI, Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see”
Jessica Lyons · theregister.com
The n0n extortion gang breached 23 organizations across 14 countries using mostly stolen credentials and exposed cloud keys rather than software exploits, despite leaning on AI-assisted tooling. SOCRadar's investigation also found the group left its own server exposed, revealing its methods.
Score 0.59
Elsewhere: HN —
Score breakdown for “Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see”
Comments on “Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see”
No. 77Score 0.55
DirectX preview aims to slash memory use for ray-tracing data
heise online English3 minTopics: Programming, HardwareFormat: NewsChecked by: 3 judges
Summary and score for “DirectX preview aims to slash memory use for ray-tracing data”
heise online · heise.de
Microsoft has previewed new DirectX Raytracing features in Agility SDK 1.722-preview, including Clustered Geometry, which splits geometry into clusters of up to 256 triangles, and Partitioned Top-Level Acceleration Structures, which updates only changed scene regions.
Score 0.55Contestedjudges differ by 0.82 on new information
Elsewhere: HN —
Score breakdown for “DirectX preview aims to slash memory use for ray-tracing data”
Comments on “DirectX preview aims to slash memory use for ray-tracing data”
No. 78Score 0.58
PHP Composer 2.11 ships dependency cooldowns
Private Packagist7 minTopics: Programming, Security, DevOpsFormat: ReleaseChecked by: Claim-checked
Summary and score for “PHP Composer 2.11 ships dependency cooldowns”
Nils Adermann · blog.packagist.com
Composer 2.11.0 adds a cooldown dependency policy that withholds newly published package versions for a configurable period before Composer installs them, narrowing the window in which malicious releases can reach projects. Security fixes are also subject to the cooldown unless opted out with --no-cooldown.
Score 0.58Claim check: 4 matches source · 1 not in source · 1 no source given · 2 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “PHP Composer 2.11 ships dependency cooldowns”
Comments on “PHP Composer 2.11 ships dependency cooldowns”
No. 79Score 0.58
Qwenputer turns Gated DeltaNet state into exact RAM for a CPU
AI News Report7 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Qwenputer turns Gated DeltaNet state into exact RAM for a CPU”
AI News Report · theainewsreport.com
Qwenputer is a project that adds 11 compiled layers to Qwen 3.5 4B, implementing a 32-bit RISC-V CPU whose RAM is the model's own Gated DeltaNet state. By pinning the gate, write strength and keys, each write and read becomes exact.
Score 0.58
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Qwenputer turns Gated DeltaNet state into exact RAM for a CPU”
Comments on “Qwenputer turns Gated DeltaNet state into exact RAM for a CPU”
No. 80Score 0.58
The Hitchhiker's Guide to System One Models
arXiv87 minTopics: AIFormat: TutorialChecked by: 3 judges
Summary and score for “The Hitchhiker's Guide to System One Models”
arxiv.org
A 2026 practitioner guide by Haggai Roitman, a longtime AI researcher, catalogs "System 1" decision models: architectures that map an input directly to a structured decision in one or a few forward passes, trading generative flexibility for speed, cost, and calibration.
Score 0.58Contestedjudges differ by 0.42 on reader interest, 0.41 on audience breadth
Elsewhere: HN 2 pts, not on front page
Score breakdown for “The Hitchhiker's Guide to System One Models”
Comments on “The Hitchhiker's Guide to System One Models”
No. 81Score 0.58
Timestral Tested: How Much Data AI Demand Forecasting Needs
winder.ai11 minTopics: AI, DataFormat: PaperChecked by: 3 judges
Summary and score for “Timestral Tested: How Much Data AI Demand Forecasting Needs”
Phil Winder
Hrih News tested Mistral's Timestral, a pretrained time-series model released in October 2026, for AI demand forecasting without any training on the user's data (zero-shot).
Score 0.58Contestedjudges differ by 0.42 on significance, 0.43 on promotional
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Timestral Tested: How Much Data AI Demand Forecasting Needs”
Comments on “Timestral Tested: How Much Data AI Demand Forecasting Needs”
No. 82Score 0.56
What's happening in Kubernetes to support AI workloads
CNCF7 minTopics: AI, DevOpsFormat: AnalysisChecked by: 3 judges
Summary and score for “What's happening in Kubernetes to support AI workloads”
Member Post · cncf.io
Kubernetes has long split work between a scheduler that places pods on existing nodes and an autoscaler that adds nodes, a design that strains under AI workloads needing specialized accelerators.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “What's happening in Kubernetes to support AI workloads”
Comments on “What's happening in Kubernetes to support AI workloads”
No. 83Score 0.58
Rooting a locked-down Hisense VIDAA TV and running Doom
carteakey.dev21 minTopics: Security, HardwareFormat: New projectChecked by: 3 judges
Summary and score for “Rooting a locked-down Hisense VIDAA TV and running Doom”
Kartikey Chauhan
A developer's write-up describes rooting a locked-down Hisense VIDAA TV: reverse-engineering its MQTT remote-control certificate and pairing handshake to build a custom launcher the TV installs itself, then exploiting a path-traversal flaw in the TV browser's file bridge to reach the root filesystem and gain a persistent root shell.
Score 0.58
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Rooting a locked-down Hisense VIDAA TV and running Doom”
Comments on “Rooting a locked-down Hisense VIDAA TV and running Doom”
No. 84Score 0.58
What YC's Minecraft and Mindustry agent swarms show about multi-agent teams
AI News Report6 minTopics: Programming, AIFormat: NewsChecked by: 3 judges
Summary and score for “What YC's Minecraft and Mindustry agent swarms show about multi-agent teams”
AI News Report · theainewsreport.com
Y Combinator and Olam Labs ran three multi-agent experiments: 50 GPT-6.1 Sol agents in a shared Minecraft survival world, and head-to-head Bed Wars and Mindustry matches against Claude Opus 5.5 teams, with GPT winning 12 of 16 games.
Score 0.58
Elsewhere: HN 2 pts, not on front page
Score breakdown for “What YC's Minecraft and Mindustry agent swarms show about multi-agent teams”
Comments on “What YC's Minecraft and Mindustry agent swarms show about multi-agent teams”
No. 85Score 0.58
Learn LLM inference system on Apple Silicon
GitHub5 minTopics: Programming, AIFormat: TutorialChecked by: 3 judges
Summary and score for “Learn LLM inference system on Apple Silicon”
github.com
tiny-llm is an open, hands-on course that teaches LLM inference from the ground up on Apple Silicon using MLX, without high-level neural-network layers. Learners implement attention, RoPE, quantized weights, batching, paged KV caching, and a small coding agent for Qwen3-4B, checking their work against a reference solution.
Score 0.58
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Learn LLM inference system on Apple Silicon”
Comments on “Learn LLM inference system on Apple Silicon”
No. 86Score 0.58
Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust
Firezone8 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust”
firezone.dev
Sanstun is a new Rust implementation of the WireGuard state machine built on a sans-IO design, where time, randomness and network I/O are kept out of protocol logic so the core is easier to compose and test.
Score 0.58
Elsewhere: HN 99 pts, front page
Score breakdown for “Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust”
Comments on “Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust”
No. 87Score 0.58
[$] Removing binder.c
LWN.netTopics: ProgrammingFormat: NewsChecked by: 3 judges
Summary and score for “[$] Removing binder.c”
daroc
Carlos Llamas and Alice Ryhl presented at Kangrejos 2026 on removing the C implementation of Android's Binder driver, the core interprocess communication mechanism on Android devices, in favor of the Rust version.
Score 0.58
Elsewhere: HN —
Score breakdown for “[$] Removing binder.c”
Comments on “[$] Removing binder.c”
No. 88Score 0.57
Scaling to 50 coding agents without scaling human attention
Centauri AI5 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Scaling to 50 coding agents without scaling human attention”
He Lu · centauri-ai.tech
Centauri AI's He Lu describes running dozens of coding agents at once by planning ahead: a shared project plan with acceptance criteria, task decomposition, guardrails and feedback loops, plus pre-assigned places for agents to log findings and escalate blockers.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Scaling to 50 coding agents without scaling human attention”
Comments on “Scaling to 50 coding agents without scaling human attention”
No. 89Score 0.57
A Flutter game holds 60 FPS on a $100 Android phone
Upsling7 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “A Flutter game holds 60 FPS on a $100 Android phone”
upsling.space
A developer describes how their one-touch Flutter and Flame game, Upsling, held 60 FPS on a roughly $100 Samsung Galaxy A06. Key moves included keeping the simulation as pure, deterministic Dart on a fixed timestep, pooling objects so restarts take one frame or less, and batching draw calls, though batching…
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “A Flutter game holds 60 FPS on a $100 Android phone”
Comments on “A Flutter game holds 60 FPS on a $100 Android phone”
No. 90Score 0.58
Claude Code guards built from my agent's repeated mistakes
GitHub6 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Claude Code guards built from my agent's repeated mistakes”
github.com
A GitHub project called claude-code-mistake-guards packages seven guards for Claude Code, built from mistakes an AI agent repeatedly made over several months of daily use. Three are hooks that block risky shell commands, unsafe saves, and unsupported claims, and four are pre-ship scripts that catch listing and content errors.
Score 0.58Contestedjudges differ by 0.50 on substantiated
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Claude Code guards built from my agent's repeated mistakes”
Comments on “Claude Code guards built from my agent's repeated mistakes”
No. 91Score 0.59
Chrome extensions with 13.4M installs caught hijacking searches
BleepingComputer3 minTopics: SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Chrome extensions with 13.4M installs caught hijacking searches”
Bill Toulas · bleepingcomputer.com
A security report from Socket found 319 Chrome extensions with about 13.4 million installs that hijack users' default search engines and route queries through operator-controlled proxy servers to collect Bing and Yahoo referral payments.
Score 0.59
Elsewhere: HN 12 pts, not on front page
Score breakdown for “Chrome extensions with 13.4M installs caught hijacking searches”
Comments on “Chrome extensions with 13.4M installs caught hijacking searches”
No. 92Score 0.57
The newly proved cycle double cover theorem in ZFC with Grace17
grace17.org26 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “The newly proved cycle double cover theorem in ZFC with Grace17”
Grant Passmore30 October 2026
Grace17, a proof assistant built on ZFC with a browser-based workbench, has formally proved the cycle double cover theorem, a graph theory conjecture open since 1973 that OpenAI's model proved in mid-2026.
Score 0.57Contestedjudges differ by 0.44 on reader interest, 0.47 on practical relevance, 0.44 on overclaim
Elsewhere: HN 2 pts, not on front page
Score breakdown for “The newly proved cycle double cover theorem in ZFC with Grace17”
Comments on “The newly proved cycle double cover theorem in ZFC with Grace17”
No. 93Score 0.57
'Trust but verify'; or, 'the correctness ratchet'
Niko Matsakis (baby steps)12 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “'Trust but verify'; or, 'the correctness ratchet'”
smallcultfollowing.com
The article describes a "trust but verify" technique for agentic software development: where requirements can't be mechanically checked, agents record their inputs and rationale in evidence files, and deterministic CI checks confirm those files exist and their inputs are current.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “'Trust but verify'; or, 'the correctness ratchet'”
Comments on “'Trust but verify'; or, 'the correctness ratchet'”
No. 94Score 0.57
Android developers can stray: Google opens Studio to Claude, GPT and more
heise online English3 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Android developers can stray: Google opens Studio to Claude, GPT and more”
heise online · heise.de
Google's Android Dev Summit unveiled Rabbit 2, a new version of Android Studio that lets developers plug in third-party AI coding agents such as Claude and Codex via the Agent Context Protocol.
Score 0.57
Elsewhere: HN —
Score breakdown for “Android developers can stray: Google opens Studio to Claude, GPT and more”
Comments on “Android developers can stray: Google opens Studio to Claude, GPT and more”
No. 95Score 0.57
Llmll: A goto-fail body, rejected before the edit lands
LLMLL5 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Llmll: A goto-fail body, rejected before the edit lands”
Burc Sahinoglu · machunter.github.io
LLMLL is a programming language for AI agents that checks each agent-written function body against its contract before accepting it. A typed hole with a precondition and postcondition is handed to an agent, and the compiler sends the proposed body to an SMT solver, rejecting any body it cannot prove.…
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Llmll: A goto-fail body, rejected before the edit lands”
Comments on “Llmll: A goto-fail body, rejected before the edit lands”
No. 96Score 0.56
Deterministic Factoring in Time N^O(1)
hexagonmath.org6 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Deterministic Factoring in Time N^O(1)”
A preprint claims a deterministic factoring algorithm running in N^{o(1)} time, improving on the current N^{1/5+o(1)} bound, with a Lean certificate whose checked statement is only 13 lines. The approach reduces factoring to counting divisors with prescribed leading bits, reusing the counting engine from recent ETH refutations.
Score 0.56Contestedjudges differ by 0.47 on reader interest
Elsewhere: HN 15 pts, not on front page
Score breakdown for “Deterministic Factoring in Time N^O(1)”
Comments on “Deterministic Factoring in Time N^O(1)”
No. 97Score 0.56
Tracking 11,709 AI launches on Hacker News
spark.site3 minTopics: AI, StartupsFormat: PaperChecked by: 3 judges
Summary and score for “Tracking 11,709 AI launches on Hacker News”
Daniel Li October 30, 2026
Hacker News Show HN posts about AI products from 2022 through 2025, totaling 11,709, were checked for whether their websites still run. Launches rose sharply, reaching nearly 60 a day in 2026, but newer cohorts die faster: 42% of 2025 launches were dead within 18 months, versus 10% for 2022.…
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Tracking 11,709 AI launches on Hacker News”
Comments on “Tracking 11,709 AI launches on Hacker News”
No. 98Score 0.56
LlamaIndex's Document Parsing Protocol: 140 rules for a correctly parsed page
llamaindex.ai4 minTopics: AIFormat: ReleaseChecked by: 3 judges
Summary and score for “LlamaIndex's Document Parsing Protocol: 140 rules for a correctly parsed page”
LlamaIndex has published working draft 0.1 of the Document Parsing Protocol, a set of 140 rules defining what a correctly parsed page should look like across tables, forms, charts, and diagrams.
Score 0.56
Elsewhere: HN 2 pts, not on front page
Score breakdown for “LlamaIndex's Document Parsing Protocol: 140 rules for a correctly parsed page”
Comments on “LlamaIndex's Document Parsing Protocol: 140 rules for a correctly parsed page”
No. 99Score 0.56
Channel Binding
blog.prosody.im9 minTopics: SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Channel Binding”
Prosody's blog post explains channel binding, an XMPP authentication feature that cryptographically ties a login to the specific TLS connection it runs over, so a machine-in-the-middle cannot relay credentials undetected.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Channel Binding”
Comments on “Channel Binding”
No. 100Score 0.56
LeanCIL – Prove properties of compiled .NET code in Lean 4
GitHub3 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “LeanCIL – Prove properties of compiled .NET code in Lean 4”
github.com
LeanCIL is an open-source tool that uses the Lean 4 proof assistant to prove properties of compiled .NET code. It extracts Common Intermediate Language from assemblies, then checks user-written proofs against an explicit model of those instructions.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “LeanCIL – Prove properties of compiled .NET code in Lean 4”
Comments on “LeanCIL – Prove properties of compiled .NET code in Lean 4”
No. 101Score 0.56
Navital Gym – open environments for testing AI agents on Indian tasks
GitHub5 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Navital Gym – open environments for testing AI agents on Indian tasks”
github.com
Navital Gym is an open, pip-installable benchmark of six sandboxed environments testing AI agents on India-specific tasks, including rail trip planning, GST invoicing, form filling, UPI disputes, and Hindi or Hinglish customer support.
Score 0.56Contestedjudges differ by 0.41 on reader interest
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Navital Gym – open environments for testing AI agents on Indian tasks”
Comments on “Navital Gym – open environments for testing AI agents on Indian tasks”
No. 102Score 0.59
Man Hires Swarm of AI Agents to Go on Epic Hacking Spree Against Major Companies
apex-news.com2 minTopics: AI, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Man Hires Swarm of AI Agents to Go on Epic Hacking Spree Against Major Companies”
A cybercriminal reportedly used AI agents to attack over 1,200 e-commerce sites in the US, Canada, Australia, and Japan, breaching more than 100 companies including John Deere, SharkNinja, and Cummins, according to a NorForge researcher's findings reported by Reuters.
Score 0.59Contestedjudges differ by 0.61 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Man Hires Swarm of AI Agents to Go on Epic Hacking Spree Against Major Companies”
Comments on “Man Hires Swarm of AI Agents to Go on Epic Hacking Spree Against Major Companies”
No. 103Score 0.55
Nim Version 2.2.14 Released
Nim Programming Language6 minTopics: Programming, SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “Nim Version 2.2.14 Released”
nim-lang.org
Nim 2.2.14, the seventh patch release of the stable 2.2 line, arrived on 28 October 2026, seven weeks after 2.2.12, with 142 commits of bugfixes and improvements. It matters to tech teams for its security hardening: the httpclient now strips credentials on cross-origin redirects, asynchttpserver rejects ambiguous body framing to…
Score 0.55
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Nim Version 2.2.14 Released”
Comments on “Nim Version 2.2.14 Released”
No. 104Score 0.55
Switch lowering in GCC
xoranth.net17 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “Switch lowering in GCC”
GCC's switch lowering pass chooses among several strategies depending on case layout: a jump table for dense values (roughly eight table entries per case label is the break-even point), comparison trees for sparse values, outlier splitting that pairs a jump table with separate branches for stray cases, contiguous-range compression that…
Score 0.55
Elsewhere: HN —
Score breakdown for “Switch lowering in GCC”
Comments on “Switch lowering in GCC”
No. 105Score 0.55
Ginux: Independent rust based Linux implementation
GitHub10 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “Ginux: Independent rust based Linux implementation”
github.com
Ginux is an experimental, independent x86-64 operating system prototype written mostly in Rust that boots directly through UEFI without a Linux host kernel. It runs unmodified Alpine and Rocky Linux userspace inside native, isolated domains, with an embedded ring-3 controller managing configuration, devices, and lifecycle.
Score 0.55Contestedjudges differ by 0.42 on practical relevance, 0.47 on substantiated
Elsewhere: HN 5 pts, not on front page
Score breakdown for “Ginux: Independent rust based Linux implementation”
Comments on “Ginux: Independent rust based Linux implementation”
No. 106Score 0.57
Some Observations on Agent Coordination
align.lawyer6 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Some Observations on Agent Coordination”
Sam Davidoff describes a two-day company hackathon and an open source chat server, kashkeshet, that let AI agents coordinate software work. He reports that a single orchestrator agent managing others worked well and cut idle waiting, that MCP polling burned many tokens and was mitigated with a background watcher script…
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Some Observations on Agent Coordination”
Comments on “Some Observations on Agent Coordination”
No. 107Score 0.55
AI is letting anyone reverse engineer anything. We talked to the developer
Scientific American5 minTopics: Programming, AI, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “AI is letting anyone reverse engineer anything. We talked to the developer”
Peter Hall · scientificamerican.com
Scientific American profiles Morluto's open-source tool Reverse Engineer Anything (REA), which lets AI agents orchestrate decompilers to pull apart compiled software and modify it, from games to consumer devices.
Score 0.55Contestedjudges differ by 0.62 on new information
Elsewhere: HN 5 pts, not on front page
Score breakdown for “AI is letting anyone reverse engineer anything. We talked to the developer”
Comments on “AI is letting anyone reverse engineer anything. We talked to the developer”
No. 108Score 0.55
GEMM Tutorial and UlmBLAS
Hacker News1 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “GEMM Tutorial and UlmBLAS”
michael-lehn · news.ycombinator.com
Michael Lehn's GEMM tutorial, originally written in 2014 and now hosted on GitHub, walks through building a fast matrix multiplication without Strassen-style algorithms. Instead it relies on cache-aware blocking, copying matrix blocks into buffers, and SIMD register instructions, step by step from a naive triple loop.
Score 0.55Contestedjudges differ by 0.43 on reader interest
Elsewhere: HN 3 pts, not on front page
Score breakdown for “GEMM Tutorial and UlmBLAS”
Comments on “GEMM Tutorial and UlmBLAS”
No. 109Score 0.56
Patterns in AI-Driven Software Development
akos.ma12 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Patterns in AI-Driven Software Development”
Adrian Kosmaczewski, a Red Hat Senior Architect, presented the CHIRON CODEX interaction patterns for AI-augmented software development at the Red Hat 3rd Swiss Dev Confederation on October 27, 2026. The patterns, created by Oxford's Dr.
Score 0.56Contestedjudges differ by 0.52 on overclaim
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Patterns in AI-Driven Software Development”
Comments on “Patterns in AI-Driven Software Development”
No. 110Score 0.56
TeamViewer fixes code injection vulnerability
heise online English2 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “TeamViewer fixes code injection vulnerability”
heise online · heise.de
TeamViewer has patched three high-risk vulnerabilities in its remote support software, two enabling code injection through malicious hosts or crafted screen and session data, and one allowing privilege escalation to root on macOS via a symbolic-link race condition.
Score 0.56Contestedjudges differ by 0.69 on new information
Elsewhere: HN —
Score breakdown for “TeamViewer fixes code injection vulnerability”
Comments on “TeamViewer fixes code injection vulnerability”
No. 111Score 0.58
Unauthenticated RCE vulnerability against ClickHouse Server
cve.now1 minTopics: Security, DataFormat: NewsChecked by: 3 judges
Summary and score for “Unauthenticated RCE vulnerability against ClickHouse Server”
A newly published CVE, CVE-2026-116366, affects ClickHouse Server, the open-source database system. Under certain conditions, an unauthenticated attacker with network access could execute arbitrary code on the server. CISA's assessment rates it as non-automatable with total technical impact, and no public exploit is listed.
Score 0.58
Elsewhere: HN 6 pts, not on front page
Score breakdown for “Unauthenticated RCE vulnerability against ClickHouse Server”
Comments on “Unauthenticated RCE vulnerability against ClickHouse Server”

How far each story is checked

Claim-checked: Scored by all three judges, and its checkable claims were compared with the sources it cites.
3 judges: Scored by all three judges. Only the day’s top stories get the claim check.
2 judges: Scored by two of the three judges. The third reads only the day’s strongest candidates.

Every story that scored at least 0.55, in score order. The judges never saw a site or an author; both are shown after ranking. How ranking works

This edition’s scores are open data: JSON and CSV, under CC BY 4.0. What the files hold

Get your mix by email

The first ten stories your filters show, in one email a day.

Or choose topics and formats on the newsletter page

One essay a week on AI and the work of programming: the hrih.si letter

This edition’s panel

Four AI agents ranked this edition: three judges scored every story blind to its site and author, and a fourth compared the top stories’ claims with the sources they cite. Summaries are written by AI.

Model versions are pinned for every edition. How ranking works describes rubric v2.3.

Table 1. How the day narrowed
Step	Stories
Candidates in the window	1,124
Scored blind by two judges	1,031
Off topic	186
Read by the third judge	229
Claim-checked	25
Published	111