はじめに CIU（CyberAgent group Infrastructure Unit）で Ia ...

<p><strong><a href="https://martinalderson.com/posts/huggingface-openai-exploit/">The first known runaway AI agent - or a very bad marketing stunt?</a></strong></p>Martin Alderson's commentary on the <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidental cyberattack against Hugging Face</a> includes a couple of details I hadn't considered.</p><p>First, Hugging Face offers a truly rich target if you're try...

Perhaps you’ve seen something that should sail out of cache get dragged back to the origin by a stray Set-Cookie or Cache-Control, headers that can be difficult to change on the origin itself. Cache Response Rules is the fix, applied at the right time.

Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan. Category: News

A new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code.The post The case for a cooldown: Why Dependabot now waits before issuing version updates appeared first on The GitHub Blog.

Here's an example. You can list multiple comma-separated box-shadows, but if you apply a *new* box-shadow, it overrides anything set before. Not true here.

Run CKEditor AI from your own code, mark AI-generated edits in track changes, and use stable multi-root AI support in CKEditor 5 v48.3.0.

Connect your Supabase project to Grafana Cloud in one click. A pre-built dashboard, alerting, and metrics: available on every plan, including free.

<blockquote cite="https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/"><p>The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was <a href="https://github.com/pypi/warehouse/pull/19727">put in place</a> to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has ...

はじめに こんにちは。LegalOn Technologiesのデータチームで Head of Data をしている若菜です。前回の記事「全社横断のデータガバナンスを実現するためにデータワーキンググループを設立・運営した」では、データマネジメントとガバナンスを統括する専門部会「データワーキンググループ（DWG）」の体制を紹介しました。あわせて、その基盤となる情報資産ガイドラインについても紹介しました。 前回の記事では、問い合わせの一次受けとしてCustom GPTやコーディングエージェントを活用している話に触れました。今回はその発展形として、DWGが日常的に運用している2つのClaude / …

チーム全員でコードを育てアジリティを高めるAI時代のカミナシの開発スタイル おはようございます。夏休みの息子を連れて大阪の箕面の実家ですごしている daipresents です。実家には食べ物と飲み物が無限にあります。 先日、レバテックさまからのお誘いをいただきまして「Claude Code時代の「職能越境」を支える、環境構築とワークフロー設計」というイベントに参加しました。テーマは「職能越境」で、AIの登場により働き方が変わり、職能を超えた動きが出てきた事例を紹介する内容でした。 僕はカミナシの一部事例を紹介させていただいたのですが、資料を公開しても何が話されたか伝わりにくいと思ったので、こ…

Orchestration Guildメンバーの迫川です。普段はAgent platformの開発をしています。この記事は、社内ワークショップOrchestration Development Wor...

StepSecurity now shows which GitHub Actions secrets are actually used, which workflows use them, and which can be replaced with OIDC.

There are two scenarios I keep seeing with AI in production, and they are the same scenarios in different disguises. The first: a team has seen a demo, the demo was dazzling, and now probabilistic output is headed somewhere that needs exactly one right answer - a total, a status, a legal something. Everyone's excited. The second: a team has a genuinely perfect AI use-case - a summary, a suggestion, a first-pass guess - and they've blocked it, because "we can't have it giving different answers ea

In this release, we're shipping one of our most requested tools to date, Java, alongside a

now shows a live evaluation view on each flag's detail page. You can see evaluations per minute charted over time, with each flag version marked in the chart so you can tie evaluation shifts to specific configuration changes.Vercel FlagsYou can group and filter evaluations by variant, reason, environment, SDK key, client, and reporting project. Custom clients can set the new property on the client initializer to show up as their own group. This makes it straightforward to confirm rollout percent

You can now connect to any running Sandbox from the Vercel dashboard. Run commands, browse the filesystem, upload and download files, and inspect open ports without leaving the browser.From the same view, you can also manage the sandbox lifecycle: take snapshots, and stop or resume persistent sandboxes. Open the on any sandbox to try it out.Connect tabLearn more about Vercel Sandboxes in the .documentationRead more

version history can now be inspected from the Vercel CLI with the new command.Vercel Flagsvercel flags versionsRun to print the full revision history for a flag, with each revision's author, message, timestamp, and changed environments. Filter to a specific environment with , paginate with and , or add for scripting.vercel flags versions <flag>--environment--limit--cursor--jsonTo compare a revision against the one before it, run . The diff is semantic, surfacing field-level changes to targ...

You can now add to your eve agent as an .GitHub toolsextensionAdd the package, drop one file in , and your agent gets every tool with Vercel Connect auth, presets, and approval rules built in.agent/extensions/ :Install@github-tools/eve-extension :Then register it from a file inagent/extensions/Get started by creating a and reading the .GitHub connectordocumentationRead morePass a connector and the extension mints short-lived, scoped GitHub tokens at runtime. Connector-backed auth: Vercel Connect

from Ant Group is now available on AI Gateway.Ling 3.0 FlashThe model is free to use for the next three weeks, through August 3rd.Ling 3.0 Flash is a Mixture-of-Experts model with 124B total parameters and about 5.1B active per token. It has a 256K token context window and runs in thinking and non-thinking modes.Ling 3.0 Flash is built for token-efficient agentic inference at production scale, doing more work within tighter token, latency, and cost budgets across multi-step agent runs. The model

The Vercel MCP server can now deploy code directly to a new or existing project. When your AI assistant finishes building something, it can ship it to Vercel and hand back a shareable URL without leaving the chat.Point the tool at your files and Vercel creates the project, detects the framework, installs dependencies, and builds. You get a URL you can open and share while the build finishes in the background.deploy_to_vercelTo get started, connect the to Claude, Cursor, or any , and ask it to de

WCAG Evaluation Methodology (WCAG-EM) 2.0 is published as a W3C Group Note. WCAG-EM describes a methodology with a step-by-step process to evaluate how well digital products conform to Web Content Accessibility Guidelines (WCAG) 2. WCAG-EM 1 was specifically for testing websites and web pages. WCAG-EM 2 also applies to apps and other digital products. For an introduction to WCAG-EM, see WCAG-EM Overview.

<blockquote cite="https://twitter.com/tqbf/status/2080045032162173329"><p>I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.</p></blockquote><p class="cite">— <a href="https://twitter.com/tqbf/status/2080045032162173329">Thomas Ptacek</a>, doesn't ...

<p>This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model's guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI's sandbox, then found exploits to break <em>in</em> to Hugging Face, all so it could cheat on the test by stealing the answers.</p><p>Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting ou...

<p><strong><a href="https://dylancastillo.co/posts/pelicanmaxxing.html">Are AI labs pelicanmaxxing?</a></strong></p>Excellent piece of work by Dylan Castillo, who took a deep-dive into the frequently pondered question of whether the AI labs have been deliberately training models to draw pelicans riding bicycles in response to my <a href="https://simonwillison.net/tags/pelican-riding-a-bicycle/">deeply unscientific benchmark</a>.</p><p>...

はじめに はじめまして。CyberAgent group Infrastructure Unit（C ...

Eight high-severity NodeBB vulnerabilities, found by our AI Pentest in six hours. Full technical breakdown of the XSS chains, auth bypasses, and post hijacking.Category: Vulnerabilities & Threats

A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it.The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog.

Safari Technology Preview Release 248 is now available for download for macOS Golden Gate and macOS Tahoe.

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team.The post Next chapter: Restructuring GitHub’s bug bounty program appeared first on The GitHub Blog.

The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it.Category: News

<p>San Francisco tip: it only costs around $15 ($10 in quarters plus a $5 bill for the self-playing violin) to activate every single Orchestrion in <a href="https://en.wikipedia.org/wiki/Musée_Mécanique">Musée Mécanique</a>.</p><p>And because most people are bad at allocating their funds you may well be the ONLY person activating the Orchestrions, which means you get to craft the soundscape for the entire museum.</p> <p>Tags: <a href="https://simonwi...

Upgrading to fix a CVE sounds straightforward. But the patched version often breaks your app, hasn't shipped yet, or doesn't exist. Here's why, and what actually works.Category: News

Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

AI agents underperform not because of the models but because of the architecture around them. Repo boundaries limit what agents can read, what they can write, and what they can remember.

Today we're releasing tsgolint v7, the type-aware linting engine behind Oxlint.This release tracks TypeScript v7.0.2 and brings tsgolint to 59 of typescript-eslint's 61 type-aware rules. Since our alpha release, we have added 16 rules, per-rule timings, improved configuration, and another round of performance work.Getting started ​Install the latest Oxlint and tsgolint, then enable type-aware linting:shpnpm add -D oxlint oxlint-tsgolint@7pnpm oxlint --type-awareTo report TypeScript compiler erro

AI Gateway now supports . Previously, transcription required a complete audio file and returned the full transcript in a single response. Now you can stream audio in as it's captured and get transcript updates back as the model produces them, keeping latency low for uses like live captioning and voice input.streaming transcriptionStreaming transcription is in beta and available through the 's function with any streaming-capable transcription model.AI SDKstreamTranscribeThe example below streams

You can now package tools, connections, skills, instructions, and hooks into extensions that any agent can import. Extensions can be published to package registries, then installed, versioned, and upgraded like any other project dependency.eveA browser-use extension might ship tools for navigating a site, a memory extension can capture context with hooks and recall it with tools, and a self-improvement extension pairs hooks with dynamic instructions.Scaffold a new extension with a single command

はじめに はじめまして、CyberAgent group Infrastructure Unit（C ...

Nub looks like an interesting new “toolchain” for Node.js. It’s one of those “it makes everything you already do faster” sort of things, like installing and running scripts. Bytes.dev… … won’t be surprised if it becomes the de facto way to season your Node.js app. You can get some of these advantages by switching runtimes, […]

<p><img src="https://static.inaturalist.org/photos/702321069/large.jpg" alt="California Sea Lion"></p><p><img src="https://static.inaturalist.org/photos/702321114/large.jpg" alt="California Sea Lion"></p><p>California Sea Lion, in San Francisco County, US, CA</p><p>We took some visiting family to Pier 39 to see the sea lions. They're somehow always even more fun than I remember them being last time.</p> <p>Tags: <a href="https...

Tyro CISO Arun Singh on developer trust as a finite resource, and what happens when supply chain attacks force teams to spend itCategory: Guides & Best Practices

Canvases turn AI into interactive workspaces where you can visualize information, explore workflows, and take action across complex tasks.The post How to build interactive experiences with canvases appeared first on The GitHub Blog.

The 2026 update to my real-world device testing recommendations paints a clearer picture than ever…

<p><strong><a href="https://blaizzy.github.io/nativ/">Nativ: Run AI models locally on your Mac</a></strong></p>Prince Canuma is the developer behind the excellent <a href="https://github.com/Blaizzy/mlx-vlm">MLX-VLM</a> Python library for running vision-LLMs using MLX on a Mac.</p><p>I'm really excited about his new project, which wraps MLX in a full macOS desktop application. It's similar in shape to LM Studio, providing both a chat i...

We analyzed global HTTP traffic to explore how kickoff times, streaming habits, and hydration breaks reshaped online activity worldwide. From late-night traffic surges to halftime browsing spikes, here is how the world connected during the global tournament.

<p>Earlier this month I hosted a fireside chat session at the <a href="https://www.ai.engineer/worldsfair/2026">AI Engineer World's Fair</a> with Cat Wu and Thariq Shihipar from Anthropic's Claude Code team. We talked about Claude Code, Claude Tag, Fable, coding agent security, evals, tool design, and how Anthropic use these tools themselves.</p><p>The full video of the session is now available <a href="https://www.youtube.com/watch?v=uU5Gv2h8-9g">on YouTube&...

While React Server Components rely on the custom Flight protocol to stream interactive UIs, this same mechanism introduces powerful deserialization sinks that attackers can exploit. Durgesh Pawar breaks down the mechanics behind the CVSS 10.0 “React2Shell” vulnerability to show how protocol manipulation can lead to remote code execution.

The writing-mode CSS property sets whether lines of text are laid out horizontally or vertically, and the direction in which blocks and lines progress..element { writing-mode: vertical-rl;}This is most useful in languages such as Chinese, Japanese or …writing-mode originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Supabase Pipelines is now in public alpha with schema change support, a faster initial sync, and a new destination request form for ClickHouse, Snowflake, and DuckLake.

はじめに こんにちは。サイバーエージェント AIオペレーション室の李俊浩（@buddypia）です。 ...

Searchable on Vercel5x increase in development velocity100+ billion tokens processed Customer-requested features shipped in as little as 30 minutesZero model SDK implementation or API key rotation with AI GatewayAI SDK AI GatewayRead more

Today we're expanding . It started by triaging alerts and reviewing your pull requests. Now it has a home in your dashboard, where it can investigate production, answer questions about your projects, and take action once you approve it.Vercel AgentBecause Vercel Agent is built into the platform that deploys and runs your app, when something changes in production, it's your first responder. It autonomously investigates your logs, metrics, and deployments, finds the root cause, and proposes a fix,

Four security advisories fixed across Auth.js this cycle, in @auth/core, next-auth v4, and next-auth v5, with the release to update to for each.

We’re writing to share some news about the future of the Bytecode Alliance and the WebAssembly Micro Runtime (WAMR).

We told you to measure. So of course we did it ourselves too: two months of server-side LLM traffic to evilmartians.com. Find out which agents read HTML, which read Markdown, what llms.txt actually does, and the one technique that got zero hits.

Vercel now compiles Python functions to bytecode at build time. In our benchmarks, cold starts for the median-sized function dropped from .2.8s to 1.3sCold starts are already rare in practice. Pre-warmed instances keep at least one function instance active for production deployments on paid plans, and reduces how often new instances start cold. Precompiling to bytecode makes starts faster across the board, so proactive initialization finishes sooner and fewer requests ever hit a cold start.autom

Vercel Connect now includes preset connectors for 100+ services, including Shopify, Resend, Sanity, Okta, Workday, and Jira.Preset are predefined configurations for supported services. They reduce manual setup by pre-populating the brand name, icon, auth type, and MCP or discovery URL. Unlike managed connectors, preset connectors don't register your app with the external service for you. connectorsSelect a preset from the in the Vercel dashboard. Review the pre-populated configuration, add any c

now supports purchasing Vercel products. You can:Vercel MCPVercel MCP quotes the price, explains whether the charge is one-time or recurring, and completes the purchase only after you confirm. When an exact price isn't available, it links to the relevant pricing or billing page. Purchases require a team role with billing access and a valid payment method. to Vercel MCP to get started.Connect your AI assistantRead moreUpgrade your team to the Pro planAdd prepaid credits for (requires a paid v0 pl

is now available on AI Gateway. There are 2 versions of the model available:Laguna S 2.1 from PoolsideLaguna S 2.1 is an open-weight Mixture-of-Experts model that supports a context window of up to 1M tokens and runs in thinking and no-thinking modes.The model specializes in agentic coding and long-running tasks, including writing and debugging code, running tests, building browser-based tooling, and working on MLOps pipelines and AI research. In thinking mode, Laguna S 2.1 reports 70.2% on Term

and are now available on AI Gateway.Gemini 3.6 FlashGemini 3.5 Flash-LiteGemini 3.6 Flash improves quality across coding, agentic tasks, and web development while consuming fewer tokens and making fewer model calls. It produces cleaner web and app development output.Gemini 3.5 Flash Lite upgrades the agentic capabilities of the Flash-Lite tier, making it a good fit for subagents that handle scoped parts of a larger task.To use them, set to or in the :modelgoogle/gemini-3.6-flashgoogle/gemini-3.5

AI Gateway now supports service tiering. Service tiers let you optimize for latency, throughput, and cost per request to match your use case. Pick a faster tier for interactive workloads (less queueing, higher token throughput), or a lower cost tier for background jobs that can tolerate more latency.At launch, service tiering is available for OpenAI and Gemini models. work across every AI Gateway API format: , , , , and . AI Gateway adjusts billing based on the tier each request used.Service tie

こんにちは。株式会社サイバーエージェントの経営推進本部に所属している片岡です。 2005年に中途入社 ...

はじめに はじめまして。CyberAgent group Infrastructure Unit（C ...

Cloudflare Internal DNS brings authoritative and recursive DNS for private networks to the same global network and control plane that runs Cloudflare's Zero Trust, networking, and public DNS.

<p>I keep hearing anecdotes from people who used coding agents to reverse-engineer and automate devices in their homes.</p><p>I think this is an interesting illustration of the impact of the reduced cost of writing code.</p><p>Prior to agents, it was entirely possible to reverse-engineer home devices. The problem was the ROI - was it really worth all of that effort? More importantly, any experienced programmer knows that undocumented, unstable APIs like that may we...

This is a post on one of Cloudflare’s coolest features: Durable Objects. We’ll introduce what they are, how they work, and walk through a reasonably realistic use case for them. Cloudflare Workers Review I’ve written about Cloudflare Workers previously, with an introduction to them and a post about some of the slightly unorthodox things you […]

<p><strong><a href="https://stratechery.com/2026/whos-afraid-of-chinese-models/">Who’s Afraid of Chinese Models?</a></strong></p>Interesting proposal from Ben Thompson that both addresses the hypocrisy of labs outlawing distillation against their models despite training on unlicensed data, and could help US open models compete more effectively with their Chinese counterparts:</p><blockquote><p>The U.S. should pass a law that (1) makes explic...

Traditional DSPM finds where sensitive data lives. Code-based DSPM finds how it gets exposed, and points to the fix in your code. Category: Guides & Best Practices

Celebrating $100 million contributed by the community to the people who build and sustain open source every day.The post $100 million for open source: A milestone built by the community appeared first on The GitHub Blog.

We’re proud to share that JetBrains was recognized in the 2026 Gartner® Magic Quadrant™ for DevOps Platforms for Ability to Execute and Completeness of Vision. JetBrains solutions for DevOps include Qodana for code quality, TeamCity for CI/CD, and YouTrack for planning and project management. The DevOps landscape is crowded, and a lot of vendors compete […]

<blockquote cite="https://twitter.com/techemails/status/2078854346683678927"><p>We have been having extensive discussions around open source strategy. We will discuss it more at our next board meeting, but one thing we’d like to do soon is to create a language model with the approximate capability of GPT-3 that can run locally on consumer hardware and release that. We’d like to do it soon, before Stability or someone else does. In general, we think this helps discourage others from ...

The Wasm GC and exceptions proposals are both enabled by default in today’s Wasmtime 47 release! We are excited to help bring more languages to WebAssembly and everywhere that Wasmtime runs. Getting to this point involved large Wasmtime changes and represents the culmination of years of engineering effort.

now keeps each run's state, queue dispatch, and output streams in a single home region: the region where the run starts by default, or any target region you choose.Vercel WorkflowsA run keeps its home region for its lifetime, so for agents built on Workflows, the whole loop stays near the user: an agent serving someone in Sydney executes, checkpoints its progress, and streams output from Sydney. During a regional incident, workflow traffic fails over to the next closest region.To get started, up

Team Owners can now clear the team's Remote Cache of all artifacts in one click. This is useful when you believe there are poisoned artifacts in your cache.In your team's Build and Deployment settings, and clear the Remote Cache.visit the Remote Caching section to learn more.Visit the docsRead more

Malicious git_credential_manager, Dendreo, and fastlane RubyGems fetch a second stage from a Forgejo C2, skip CI to target developer machines, and install a persistent daemon. StepSecurity analysis with Harden-Runner.

SleeperGem: two dormant RubyGems maintainer accounts were hijacked to inject malware into trusted gems, one with over 500,000 total downloadsCategory: Vulnerabilities & Threats

<p><strong><a href="https://ludic.mataroa.blog/blog/ai-mania-is-eviscerating-global-decision-making/">AI Mania Is Eviscerating Global Decision-Making</a></strong></p>Here's an entertaining perspective from Nik Suresh on the AI mania that is overwhelming the large companies that he consults with. It's crammed with spicy anecdotes from anonymous sources.</p><blockquote><p>In one extreme case, I have seen an executive confess that they had neve...

<p>In <a href="https://bun.com/blog/bun-in-rust">Rewriting Bun in Rust</a> Jarred Sumner made the following claim:</p><blockquote><p>Claude Code v2.1.181 (released June 17th) and later use the Rust port of Bun. Startup got 10% faster on Linux but otherwise, barely anyone noticed. Boring is good.</p></blockquote><p>I decided to have a poke at my own Claude Code installation to see if I could find evidence that it was using Bun written in Rust...

Cheaper paper gave Renaissance artists more room to experiment. AI agents could do the same for software, if developers preserve enough mechanical and software sympathy to judge what agents produce.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/sqlite-query-explainer">SQLite Query Explainer</a></p> <p>Julia Evan's, in <a href="https://jvns.ca/blog/2026/07/17/learning-about-running-sqlite/">Learning a few things about running SQLite</a>:</p><blockquote><p>Maybe one day I’ll learn to read a query plan.</p></blockquote><p>Big same.... which inspired me to <a href="https://github.c...

<p><strong><a href="https://twitter.com/claudeai/status/2078302415804379218">Claude make Fable 5 permanent</a></strong></p>An update from the <code>@claudeai</code> account on Twitter:</p><blockquote><p>Beginning July 20, Claude Fable 5 will be included in all Max and Team Premium plans, at 50% of limits.</p><p>Pro and Team Standard users will continue to have access to Fable via usage credits, and will receive a one-...

<p><strong><a href="https://github.com/nascheme/quixote">nascheme/quixote</a></strong></p>A certain vintage of Python web nerd might be delighted to learn that the most recent commit to the Quixote web framework was <a href="(https://github.com/nascheme/quixote/commit/7f775cf9d1e7e80fcbb2706b4a1d971e55ca74a3)">six hours ago</a>.</p><p>The <a href="https://github.com/nascheme/quixote/commit/d6b73c5768c2d041b68b54cc71863604249abc18"&g...

AI コーディングエージェントの自律性が向上し、複数のエージェントを並行して動かすことが日常になったことで、開発の中で最も時間を使う工程が実装から設計へ移りつつあります。この記事では、設計セッション、Git worktree を使った並列実行、自律的な検証、AI によるコードレビューなど、最近の私が実践している開発の進め方を紹介します。

Nuxt 4.5 is our biggest release in a while. Vite 8, Rspack 2 powered by Rsbuild, experimental SSR streaming, a stable error code system, a new useLayout composable, named views, and a lot of groundwork for Nuxt 5.

pnpm 11.11 through 11.14 add native workspace release management (pnpm change, pnpm lane, and a bare pnpm version -r), a pnpm doctor command that diagnoses your installation end to end, the pnpm access and pnpm team commands for managing packages and organizations on the registry, convergence overrides, and scheme-carrying peerDependencies specifiers. They also fix a path-traversal vulnerability, cut peak memory during cold-cache resolution by roughly 30%, and resolve a peer dependency deadlock.

Cloudflare has deployed two WAF rules in response to high-severity vulnerabilities disclosed to us by the WordPress security team. The new rules protect all Cloudflare customers using affected WordPress versions, but customers should still update immediately to a patched release

WordPress core has an unauthenticated RCE (wp2shell), confirmed as SQL injection. Update to 7.0.2 or 6.9.5 now, with mitigations if you can't patch yet. Block the attack class at runtime with Aikido Zen.Category: Vulnerabilities & Threats

Masonry.js was famous for creating, uh, Masonry layouts. But it did something else, too: animate fluid grids. Here's a way to get that in native CSS as well as the layout.

The cost of writing code dropped; the cost of owning it didn't. A framework for deciding which changes are actually cheap in the AI era.The post The cost of saying yes has changed appeared first on The GitHub Blog.

Compare the top Pentera alternatives for automated pentesting in 2026. See where Aikido Security, XBOW, Horizon3, Hadrian, RunSybil, Terra, and Astra fit best.Category: DevSec Tools & Comparisons

<blockquote cite="https://news.ycombinator.com/item?id=48935342#48936515"><p>Is there something I can actually help you with today?</p></blockquote><p class="cite">— <a href="https://news.ycombinator.com/item?id=48935342#48936515">Kimi K3</a>, after refusing to leak its system prompt</p> <p>Tags: <a href="https://simonwillison.net/tags/kimi">kimi</a>, <a href="https://simonwillison.net/tags/ai-personality">ai-pers...

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/llm-cliche-highlighter">LLM cliché highlighter</a></p> <p>I got frustrated reading <em>yet another</em> article that was crammed with the clichés of LLM-generated writing - "no fluff, no filler, no jargon" type stuff - so I had Fable 5 vibe code up this app for highlighting ten common patterns that show up in that sort of writing.</p><p><img alt="Screenshot of ...

Howdy! Before we get into the links, we're going to take a break next week, so we'll see you on July 31 🌴Art as resistenceMore of this please!Mildliner referenceIf you've ever thought "I wish I could use Midliner marker colours on the web" then this link is specifically for you. Very nice stuff.The AI hype reckoning is upon usNot long now, friends. Increasingly — and more urgently — we need to be talking about how to make sure these hype cycles never happen again.You can just print an air purif...