はじめに：なぜKafkaのエンドツーエンド暗号化なのか？LINEメッセンジャーでは、毎日数十億件のメッセージがやり取りされています。この膨大なデータはさまざまなシステムに送信されますが、その中には個人...

Jenna Smith with some pretty solid UX advice as it relates to loading states: Rather than designing another loading state, I improve the preload strategy until the issue disappears entirely. She points to Route Transitions and preloading data as solutions that get closer to pages that load everything at once, like a default website, while […]

<p><strong><a href="https://www.anthropic.com/research/discovering-cryptographic-weaknesses">Discovering cryptographic weaknesses with Claude</a></strong></p>The best part of this article (here's <a href="https://github.com/anthropics/cryptography-research-demo">the repo</a>) about how Anthropic researchers used Claude Mythos to find mathematical flaws in both HAWK and a weaker version of AES ("neither of these results has a practical impact on to...

Malicious beta versions of the Joyfill npm packages @joyfill/components and @joyfill/layouts hide an obfuscated remote access trojan and credential stealer. Full analysis, IOCs, and remediation from StepSecurity.

After 5x ARR growth in 2024 and again in 2025, StepSecurity is on pace for its biggest year yet in 2026. What is driving it, and why supply chain security is inflecting.

<blockquote cite="https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/"><p>We’re aware a Modal customer published an unauthenticated endpoint that allowed ​anyone on the internet to use ​their ⁠sandboxes for code execution. This was used by the rogue agent. Modal’s ⁠platform ​or isolation were not ​compromised in anyway.</p></blockquote><p class="cite">— <a href="https://www.reuters.com/bu...

<p><strong><a href="https://github.com/astral-sh/uv/releases/tag/0.12.0">uv 0.12.0</a></strong></p>Some interesting breaking changes in this release of <code>uv</code>, in particular to the default project produced by the <code>uv init</code> command.</p><p><a href="https://docs.astral.sh/uv/concepts/projects/init/">uv init</a> is the <code>uv</code> shortcut for creating a new project. The previous ...

<p><strong><a href="https://huggingface.co/blog/agent-intrusion-technical-timeline">Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident</a></strong></p>Hugging Face just released this extremely detailed technical description of <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI's recent accidental cyberattack against their infrastructure</a>. This attack was <em>very</em> so...

Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact.The post Disrupting supply chain attacks on npm and GitHub Actions appeared first on The GitHub Blog.

Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Cloudflare Radar tracked Internet disruptions driven by natural disasters, government-mandated shutdowns, and DNSSEC key rollovers over the last quarter. This post analyzes traffic telemetry to explain how these events impacted global connectivity.

Many of the AI tools we interact with take the form of text boxes. But what if there was a different way to interact with AI? Oleksii Hrzhehorzhevskyi explores a different approach to creating a new AI assistant and how designers can navigate the field as AI continues to change it.

`focusgroup` 属性は、ツールバーやタブリストなどの複合ウィジェットにおける矢印キーのフォーカス移動を宣言的に実装する HTML 属性です。従来必要だった roving tabindex の JavaScript をブラウザに任せ、単一の Tab ストップ、折り返し、最後にフォーカスした項目の記憶などを提供します。この記事では Chrome 150 で利用可能になった `focusgroup` 属性の使い方を紹介します。

now supports forking with .Vercel SandboxSandbox.fork()The fork starts from the source's current snapshot and inherits its config and environment variables. If the source is running, it forks the latest saved state, not the live in-memory state. If the source has no snapshot, it falls back to a fresh create, using the source's and config. Any parameter you pass overrides the inherited value.runtimeA fork takes about the same time as creating a sandbox, with the same limits. Use it to branch an a

In which Adam highlights the integration process and notes some challenges compared to the TanStack setup we covered shortly ago.

※ この記事は、筆者が AI エージェント(Claude Code)と対話しながら執筆しました。読了 ...

第2回となる今回は、Local LLM を開発の相棒として使ってみる、1時間集中の個人参加型ハッカソ ...

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

now lets you link a connector to a so deployments there can request provider tokens and receive forwarded webhooks.Vercel ConnectCustom EnvironmentCustom Environments appear alongside Production, Preview, and Development when you add or edit a project on a connector in the dashboard.From the CLI, pass the environment's slug to :--environmentPassing replaces the default environments.--environmentOnce linked, a deployment in that environment can request tokens with as usual. If the calling environ

<p><strong><a href="https://huggingface.co/moonshotai/Kimi-K3">moonshotai/Kimi-K3</a></strong></p>As promised <a href="https://simonwillison.net/2026/Jul/16/kimi-k3/">earlier this month</a>, Moonshot have released the weights for their excellent 2.8 trillion parameter Kimi K3. They're a hefty 1.56TB on Hugging Face.</p><p>Kimi introduced their own janky <a href="https://huggingface.co/moonshotai/Kimi-K2-Instruct/blob/main/LICENSE"&g...

Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

<p><strong><a href="https://www.oneusefulthing.org/p/an-opinionated-guide-to-which-ai-b22">An opinionated guide to which AI to use to do stuff</a></strong></p>It's interesting watching the evolution of Ethan Mollick's guide over time. </p><p><a href="https://www.oneusefulthing.org/p/using-ai-right-now-a-quick-guide">A year ago</a> it was still all about chat - ChatGPT, Claude, Gemini - with o3, Claude 4 Opus, and Gemini 2.5 Pro as the ...

AI Gateway now supports . Set on a request to pin it to the US or EU. Every model provider that supports the selected region handles it the same way. Inference runs there, and any data the provider keeps is stored there.regional inferenceinferenceRegionAI Gateway supports two pinned regions, plus global routing:If no model provider can serve it, the request fails rather than running somewhere else. Every response reports the region that served it, so you can confirm where each request ran.Here's

Safari 26.6 is here.

A practical GitHub Copilot workflow for prototyping, planning, implementing, and reviewing software without chasing every new AI tool.The post The harness is all you need (mostly) appeared first on The GitHub Blog.

agents on Slack can now keep replying in a thread without repeated mentions, cancel an in-progress response or reset a conversation entirely, and react to any event your Slack app subscribes to.eveMentions no longer have to carry the conversation. Once a thread has an active session, your agent can reply on its own.The new hook receives incoming Slack messages, and two helpers decide which ones to handle: detects an explicit mention, and checks whether the message belongs to a thread with an act

New to the GitHub Copilot app? Learn how to start projects, work with AI agents, explore canvases, and streamline your development workflow.The post GitHub Copilot app for Beginners: Getting started appeared first on The GitHub Blog.

Sandstone on VercelVercel deployments turned a Sunday request into a five-minute fix1,000+ legal requests managed daily across customer teams7-app turborepo monorepo deployed seamlessly to multiple Vercel projectsMulti-step agentic legal workflows built end-to-end with AI SDKPreview deployments fast enough to win enterprise trustAn AI layer flexible enough to ship agentic workflows in minutes that makes security a one-sentence answerSecure ComputeWhen in-house legal teams get a request from thei

pvcli is a curl-like tool designed to simplify the testing of complex privacy protocols like OHTTP.

An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.

Last week, OpenAI evaluated two models on an exploit benchmark within an isolated sandbox. Guardrails were reduced for testing, and the models found a vulnerability in their environment, accessed the internet, and reached Hugging Face's production database.No human directed the action, but the breach is a clear example of how much more capable malicious attackers are when equipped with powerful AI models. But defenders have the same tools, and a clear advantage: knowledge of their own codebase.

now supports WebSocket mode for the OpenAI Responses API. You can keep a persistent connection open and continue each turn by sending only new input items plus , instead of re-sending the full context over a fresh HTTP request every turn.AI Gatewayprevious_response_id up to ~40% faster end-to-end execution on WebSockets for agentic rollouts with 20 or more tool calls.OpenAI reportsThe Responses route opens at and accepts raw frames over a persistent WebSocket connection. The mode is compatible w

The Ember project is excited to announce the release of Ember v7.1. This is a standard minor release as part of the Ember Release Train process.This release contains some serious improvements to the Developer Experience for people using GJS files, adds some new built-in helpers, and furthers our commitment to reduce the number of deprecated npm package warnings seen when generating a new Ember application.Ember.js 7.1Ember 7.1 introduces a number of long-awaited new built-in helpers ({{element}}

Nuxt 4.5.1 and 3.21.10 are out now, fixing several security issues, alongside a critical fix in @nuxt/devtools 3.3.1. We recommend upgrading as soon as possible.

The team has released Nuxt 4.5.1 and 3.21.10, along with 3.3.1, to address eight security advisories, including a high-severity server-side remote code execution vulnerability.Nuxt@nuxt/devtoolsVercel received advance notice of the server-side remote code execution vulnerability, , and deployed platform-wide WAF mitigations before public disclosure.GHSA-9473-5f9j-94wqApplications deployed on Vercel are automatically protected by these mitigations, with no configuration changes required. However,

and its faster serving path, , are now available from US-based providers on AI Gateway, including Baseten and Fireworks. (ZDR) is also supported for both models. Kimi K3 from Moonshot AIKimi K3 FastZero Data RetentionRunning Kimi K3 on US-based providers lets teams with data residency and compliance requirements use the model on US infrastructure. Because AI Gateway serves the models from multiple providers, it automatically routes across them for failover, higher uptime, and more available thro

You can now run with .Claude Managed AgentsChat SDKClaude Managed Agents handles the agent loop server-side, including the model, tools, session state, and sandboxed web research.Chat SDK gives that agent a chat interface through a single type-safe handler, with adapters that carry it to Slack, WhatsApp, and more.To see it work, a new builds a working research analyst you chat with in the browser. It runs on Chat SDK's web adapter, so there's no platform registration, webhook verification, or tu

For CSS Day this year we created a set of cheatsheets explaining Flexbox, Grid, Anchor positioning and Invoker commands. They came out…

はじめに はじめまして、CyberAgent group Infrastructure Unit（C ...

<p><strong><a href="https://vectoral.com/blog/token-relay-market">An Inside Look at the Relay Market Powering Token Resellers and Fraud</a></strong></p>Fascinating investigation by Matt Lenhard into the market that has grown up around reselling LLM tokens at a discount by pooling API keys from various sources.</p><p>This looks to be mostly a thing in China. Resellers sell access to an LLM proxy that offers significant discounts on regular API pric...

記事は ics.media へアクセスしてご覧ください。

Measure how entire components render with the Container Timing API: how it differs from Element Timing, where it helps, and how to try it today.

CSS Grid Lanes は、高さの異なるアイテムを複数のレーンへ隙間なく配置するレイアウト方式です。`display: grid-lanes` を指定することで、JavaScript を使わずに Masonry レイアウトを実装できます。この記事では `display: grid-lanes` の基本的な使い方を紹介します。

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/3.39.1">sqlite-utils 3.39.1</a></p> <p>I back-ported <a href="https://github.com/simonw/sqlite-utils/issues/815">a fix</a> for <code>table.delete_where()</code> that shipped in version 4.</p> <p>Tags: <a href="https://simonwillison.net/tags/sqlite-utils">sqlite-utils</a></p>

はじめに はじめまして。CyberAgent group Infrastructure Unit（C ...

<p><strong><a href="https://astral.sh/blog/ruff-v0.16.0">Ruff v0.16.0</a></strong></p>Astral shipped a significant new version of their Ruff Python linting tool a few days ago on July 23rd. I noticed today because my various CI jobs all started failing thanks to new default Ruff checks and my unpinned <code>"ruff"</code> dev dependency.</p><p>From Brent Westbrook's announcement post:</p><blockquote><p>Ruff now enables...

Canvas UI は HTML-in-Canvas API を活用し、液体シミュレーションやシェーダーといったクリエイティブな UI を構築するためのコンポーネントライブラリです。

Hermes Agent と Slack を連携して要件を整理し、Linear のチケット作成から Coding Worker による実装・検証・Draft PR 作成までを自動化するワークフローを紹介します。

mrmustard 0.7.4 on PyPI was a credential stealer that ran on import, exfiltrating SSH keys, AWS, and Kubernetes credentials. Here is the analysis, IOCs, and how to respond.

はじめに CyberAgent group Infrastructure Unit（CIU）の川原で ...

<blockquote cite="https://twitter.com/bcherny/status/2080713091688583312"><p>More than any of these eval scores, what is most exciting to me is something else: Opus 5 is our least prompt injectable model yet. It is a bit buried in the system card, but across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully.</p></blockquote><p class="cite">— <a href="https://twitter.com/bcherny/status/2080713091688583312">Boris Cherny</a...

A test of the `modern-web-guidance` skill against a real React app, to see whether it actually catches stale frontend patterns and surfaces current best practices.

<p><strong><a href="https://www.anthropic.com/news/claude-opus-5">Introducing Claude Opus 5</a></strong></p>I've been offline <a href="https://en.wikipedia.org/wiki/Elkhorn_Slough">kayaking with sea otters</a> for much of today so I haven't had a chance to put Anthropic's new model Claude Opus 5 through its paces yet. The buzz is positive, and Anthropic's description of it as a "thoughtful and proactive model that comes close to the frontier intel...

Compare the top LLM security tools for AI applications, including Aikido, Snyk, Semgrep, Endor Labs, and Wiz, across code, supply chain, and runtime.Category: DevSec Tools & Comparisons

The can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or . Vercel WAF@vercel/blobEvery blob is already served through , so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served.Vercel's CDNRules evaluate at the edge, matching on IP, country, path, and :moreThe

By doing in-depth testing, we found nearly 70% of BGP paths experience ORIGIN attribute rewrites by transit providers seeking traffic advantages. We examine the global impact of this practice and argue for deprecating ORIGIN in route selection.

Certainly it isn't the *only* way, but you've got a lot of angular control with conic-gradient() and it's fun to work with.

A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Exploring Acunetix alternatives? Its DAST covers rule-based checks but can't reason about business logic or produce audit-grade pentests. Five options that go further.Category: DevSec Tools & Comparisons

Workflow steps on Pro and Enterprise plans can now run for up to 30 minutes (1800 seconds), up from 800 seconds, using (in beta).extended function durationsTo opt in, set to in your project's Environment Variables, then redeploy. Requires and a supported Node.js or Python runtime.VERCEL_ENABLE_WORKFLOW_EXTENDED_MAX_DURATION1Fluid computeExtended durations are not available on Hobby plans, which remain limited to 5 minutes (300 seconds).See in the documentation.function duration limits by planRea

HighlightsIn ESLint v10.8.0, the following rules have been updated to avoid incorrect or unexpected behavior in some edge cases:class-methods-use-thisprefer-object-spreadprefer-templatepreserve-caught-errorno-unreachable-loopFeatures2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)Bug Fixes6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (P

Webpack 5.109

from Anthropic is now available on AI Gateway.Claude Opus 5Opus 5 improves on previous Opus models for long-horizon agentic coding, handling multi-file features, larger refactors, and end-to-end feature work, and completing full tasks rather than leaving stubs or placeholders.Opus 5 is effective at low and medium effort, which produce quality at a fraction of the tokens and latency of higher settings. Vision is stronger on charts, documents, diagrams, and UI replication, and Opus 5 makes effecti

はじめに CIU（CyberAgent group Infrastructure Unit）で Ia ...

<p><strong><a href="https://martinalderson.com/posts/huggingface-openai-exploit/">The first known runaway AI agent - or a very bad marketing stunt?</a></strong></p>Martin Alderson's commentary on the <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidental cyberattack against Hugging Face</a> includes a couple of details I hadn't considered.</p><p>First, Hugging Face offers a truly rich target if you're try...

Perhaps you’ve seen something that should sail out of cache get dragged back to the origin by a stray Set-Cookie or Cache-Control, headers that can be difficult to change on the origin itself. Cache Response Rules is the fix, applied at the right time.

Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan. Category: News

A new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code.The post The case for a cooldown: Why Dependabot now waits before issuing version updates appeared first on The GitHub Blog.

Here's an example. You can list multiple comma-separated box-shadows, but if you apply a *new* box-shadow, it overrides anything set before. Not true here.

Run CKEditor AI from your own code, mark AI-generated edits in track changes, and use stable multi-root AI support in CKEditor 5 v48.3.0.

Connect your Supabase project to Grafana Cloud in one click. A pre-built dashboard, alerting, and metrics: available on every plan, including free.

<blockquote cite="https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/"><p>The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was <a href="https://github.com/pypi/warehouse/pull/19727">put in place</a> to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has ...

はじめに こんにちは。LegalOn Technologiesのデータチームで Head of Data をしている若菜です。前回の記事「全社横断のデータガバナンスを実現するためにデータワーキンググループを設立・運営した」では、データマネジメントとガバナンスを統括する専門部会「データワーキンググループ（DWG）」の体制を紹介しました。あわせて、その基盤となる情報資産ガイドラインについても紹介しました。 前回の記事では、問い合わせの一次受けとしてCustom GPTやコーディングエージェントを活用している話に触れました。今回はその発展形として、DWGが日常的に運用している2つのClaude / …

チーム全員でコードを育てアジリティを高めるAI時代のカミナシの開発スタイル おはようございます。夏休みの息子を連れて大阪の箕面の実家ですごしている daipresents です。実家には食べ物と飲み物が無限にあります。 先日、レバテックさまからのお誘いをいただきまして「Claude Code時代の「職能越境」を支える、環境構築とワークフロー設計」というイベントに参加しました。テーマは「職能越境」で、AIの登場により働き方が変わり、職能を超えた動きが出てきた事例を紹介する内容でした。 僕はカミナシの一部事例を紹介させていただいたのですが、資料を公開しても何が話されたか伝わりにくいと思ったので、こ…

Orchestration Guildメンバーの迫川です。普段はAgent platformの開発をしています。この記事は、社内ワークショップOrchestration Development Wor...

StepSecurity now shows which GitHub Actions secrets are actually used, which workflows use them, and which can be replaced with OIDC.

There are two scenarios I keep seeing with AI in production, and they are the same scenarios in different disguises. The first: a team has seen a demo, the demo was dazzling, and now probabilistic output is headed somewhere that needs exactly one right answer - a total, a status, a legal something. Everyone's excited. The second: a team has a genuinely perfect AI use-case - a summary, a suggestion, a first-pass guess - and they've blocked it, because "we can't have it giving different answers ea

In this release, we're shipping one of our most requested tools to date, Java, alongside a

All teams want their website to feel like the products they admire. Motion that's smooth, responsive, and never overbearing. The kind of motion that conveys a feeling without a user reading a word of copy.Wanting and doing are two different things. Animation is tough for humans and agents alike to get right, and in the face of a deadlines it's often the first thing that gets cut.Animation can even be risky. Get it wrong, and the whole site feels cheaper, or performance can tank.Read the full art

Vercel now supports WebSocket connections for Python applications. WebSockets enable bidirectional communication between client- and server-side code, powering real-time features like interactive AI streaming, real-time chat, and multiplayer live collaboration. Both ASGI and WSGI applications are supported, including frameworks like FastAPI, Django, and Flask.Explore the and examples, or to get started.FastAPI AI ChatFlask AI Chatread the WebSockets documentationRead more

now shows a live evaluation view on each flag's detail page. You can see evaluations per minute charted over time, with each flag version marked in the chart so you can tie evaluation shifts to specific configuration changes.Vercel FlagsYou can group and filter evaluations by variant, reason, environment, SDK key, client, and reporting project. Custom clients can set the new property on the client initializer to show up as their own group. This makes it straightforward to confirm rollout percent

You can now connect to any running Sandbox from the Vercel dashboard. Run commands, browse the filesystem, upload and download files, and inspect open ports without leaving the browser.From the same view, you can also manage the sandbox lifecycle: take snapshots, and stop or resume persistent sandboxes. Open the on any sandbox to try it out.Connect tabLearn more about Vercel Sandboxes in the .documentationRead more

version history can now be inspected from the Vercel CLI with the new command.Vercel Flagsvercel flags versionsRun to print the full revision history for a flag, with each revision's author, message, timestamp, and changed environments. Filter to a specific environment with , paginate with and , or add for scripting.vercel flags versions <flag>--environment--limit--cursor--jsonTo compare a revision against the one before it, run . The diff is semantic, surfacing field-level changes to targ...

You can now add to your agent as an extension.GitHub toolseveAdd the package, drop one file in , and your agent gets every tool with Vercel Connect auth, presets, and approval rules built in.agent/extensions/ :Install@github-tools/eve-extension :Then register it from a file inagent/extensions/Get started by creating a and reading the .GitHub connectordocumentationRead morePass a connector and the extension mints short-lived, scoped GitHub tokens at runtime. Connector-backed auth: Vercel Connect,

from Ant Group is now available on AI Gateway.Ling 3.0 FlashThe model is free to use for the next three weeks, through August 3rd.Ling 3.0 Flash is a Mixture-of-Experts model with 124B total parameters and about 5.1B active per token. It has a 256K token context window and runs in thinking and non-thinking modes.Ling 3.0 Flash is built for token-efficient agentic inference at production scale, doing more work within tighter token, latency, and cost budgets across multi-step agent runs. The model

The Vercel MCP server can now deploy code directly to a new or existing project. When your AI assistant finishes building something, it can ship it to Vercel and hand back a shareable URL without leaving the chat.Point the tool at your files and Vercel creates the project, detects the framework, installs dependencies, and builds. You get a URL you can open and share while the build finishes in the background.deploy_to_vercelTo get started, connect the to Claude, Cursor, or any , and ask it to de

WCAG Evaluation Methodology (WCAG-EM) 2.0 is published as a W3C Group Note. WCAG-EM describes a methodology with a step-by-step process to evaluate how well digital products conform to Web Content Accessibility Guidelines (WCAG) 2. WCAG-EM 1 was specifically for testing websites and web pages. WCAG-EM 2 also applies to apps and other digital products. For an introduction to WCAG-EM, see WCAG-EM Overview.

<blockquote cite="https://twitter.com/tqbf/status/2080045032162173329"><p>I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.</p></blockquote><p class="cite">— <a href="https://twitter.com/tqbf/status/2080045032162173329">Thomas Ptacek</a>, doesn't ...

<p>This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model's guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI's sandbox, then found exploits to break <em>in</em> to Hugging Face, all so it could cheat on the test by stealing the answers.</p><p>Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting ou...

<p><strong><a href="https://dylancastillo.co/posts/pelicanmaxxing.html">Are AI labs pelicanmaxxing?</a></strong></p>Excellent piece of work by Dylan Castillo, who took a deep-dive into the frequently pondered question of whether the AI labs have been deliberately training models to draw pelicans riding bicycles in response to my <a href="https://simonwillison.net/tags/pelican-riding-a-bicycle/">deeply unscientific benchmark</a>.</p><p>...

Eight high-severity NodeBB vulnerabilities, found by our AI Pentest in six hours. Full technical breakdown of the XSS chains, auth bypasses, and post hijacking.Category: Vulnerabilities & Threats

A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it.The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog.

Safari Technology Preview Release 248 is now available for download for macOS Golden Gate and macOS Tahoe.

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team.The post Next chapter: Restructuring GitHub’s bug bounty program appeared first on The GitHub Blog.

The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it.Category: News

<p>San Francisco tip: it only costs around $15 ($10 in quarters plus a $5 bill for the self-playing violin) to activate every single Orchestrion in <a href="https://en.wikipedia.org/wiki/Musée_Mécanique">Musée Mécanique</a>.</p><p>And because most people are bad at allocating their funds you may well be the ONLY person activating the Orchestrions, which means you get to craft the soundscape for the entire museum.</p> <p>Tags: <a href="https://simonwi...

Upgrading to fix a CVE sounds straightforward. But the patched version often breaks your app, hasn't shipped yet, or doesn't exist. Here's why, and what actually works.Category: News