Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Node.js — Wednesday, October 21, 2026 Security Releases
The Node.js project ships security releases for the 26.x, 24.x and 22.x lines, updating c-ares, OpenSSL and the CA certificate store (removing the compromised eMudhra intermediate CA), with details of fixed issues and download links.
3 min · 646 words
What the PHP2Shell rumors got wrong, from inside the PHP security team
Alexandre Daubois, writing from inside the PHP security team, explains how the PHP2Shell leak got the severity right but most details wrong: CVE-2026-109618 is an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
6 min · 1,331 words
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
SafeDep analyzes the compromised LiteLLM 1.107.0 release on PyPI, whose wheels planted a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start, how the implant got into the build, which versions are clean, and indicators of compromise.
7 min · 1,556 words
Today's PHP Security Release, and How We're Strengthening PHP Security
The PHP Foundation explains the two critical RCE vulnerabilities fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, how they were found with researchers and AI security tools and fixed, how PHP security handling has changed over two years, and what dependent organizations need to fund.
8 min · 1,860 words
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team announces DuckDB 2.0.0 LTS, its biggest feature release so far: a polished Quack protocol for DuckDB as a server, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, an extensible PEG-based SQL parser, plus breaking changes and migration notes.
12 min · 2,753 words
Do minor curl vulnerabilities in the open
curl maintainer Daniel Stenberg announces that from October 26, 2026 the project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. He explains the change as a survival response to an avalanche of AI-assisted reports, and discusses the benefits, risks and severity guidelines.
4 min · 961 words
Do we really need bigger AI weather forecasting models to improve resolution?
Emma Scharfmann shows that instead of building a bigger AI weather model you can train a small downscaler on top of an existing global one: trained in about an hour, it sharpens AIFS-ENS temperature forecasts over France from ~28 km to 5.5 km and cuts station-measured error by 14% RMSE and 21% CRPS over the first two days.
17 min · 3,914 words
Overgrown, when plants invade your abandoned tabs
Charlie Gerard describes Overgrown, a playful Chrome extension in which plants slowly grow over browser tabs the longer they go unread, blocking clicks until you slash the vines away with a machete, chainsaw or flamethrower, and explains how its background worker, popup and overlay code fit together.
2 min · 493 words
Pragtical v3.14.0, the Lua-based text editor's latest release, adds application menus and a toolbar, flexible placement of command prompts and project search, floating views, workspace session management, a refreshed Plugin Manager and lower idle CPU usage, plus a long list of fixes since v3.13.1.
6 min · 1,318 words
The Quake Fan who built the map editor everybody uses
func_arena interviews Kristian Duske, creator of the TrenchBroom Quake level editor, about starting it in 2010 as a Mac user, rewrites from Objective-C to C++, the move from wxWidgets to Qt, a stubborn CSG algorithm, and how he maintains a widely used open-source project alongside a full-time job - despite never making another map.
10 min · 2,295 words
Announcing the GPU notification group and Linker Working Area
The Rust compiler team announces a GPU-target notification group for vendor experts helping diagnose GPU backend issues, plus a Linker working area to integrate alternative linkers such as Wild and to field linker questions, with Zulip streams and signup via rust-lang/team.
1 min · 295 words
Open-Sourcing Phonon: A Suite of Frontier On-Device TTS Models
Gradium open-sources Phonon, a family of 31m and 40m parameter on-device text-to-speech models, including a multilingual model for English, French, German, Spanish and Portuguese. The post covers benchmarks on naturalness, word error rate and latency (7 ms to first audio on a laptop CPU), hardware targets, custom voices, how the models work and how to get started.
13 min · 2,946 words
OpenBSD 8.0, the project's 61st release, shipped on October 20, 2026. Highlights include a 512G amd64 kernel virtual address space, arm64 hibernate support, RISC-V vector, AIA and Sstc support, sparc64 moving to LLVM and loongson retired, drm(4) updated to Linux 6.18.53 with Intel Arc A-Series support, MP guests in vmm, and refreshed packages and third-party components.
27 min · 6,144 words
Qwen3-4B with the AI writing tics trained out
Erik Markus Kannike fine-tunes Qwen3-4B-Instruct on a MacBook Air to drop assistant writing habits like em dashes, 'not X, but Y' and lists of three, cutting a slop score from 121 to 12.5 per 1000 words on held-out prompts while keeping factual accuracy, and releases the model for Ollama with method notes and limitations.
7 min · 1,637 words
2026 is an exciting year for the Rust compiler (and me)
Rust compiler contributor Matyáš Racek surveys long-running rustc efforts paying off in 2026, including the next-generation trait solver, Polonius, the parallel frontend nearing stabilization, LLVM and micro-optimization speedups, move elimination, polymorphization, Cargo cache and build-dir changes, and reflections on the Rust All Hands.
11 min · 2,539 words
Making dns_erlang Fast: Binary Tricks for the BEAM
Nelson Vides of DNSimple explains how binary pattern matching, append-friendly accumulators, staying in the match context, chunked matching and SWAR cut CPU per query in their Erlang name server erldns by 12%, what didn't work, and lessons for any BEAM application.
17 min · 3,980 words
Dynamic Packages for Free Pascal and Lazarus
The getlazarus.org maintainer announces the first release of full dynamic package support for the Free Pascal Compiler and Lazarus IDE, letting components and plugins be built as shared libraries and installed without rebuilding the IDE, and covers restrictions, runtime changes, IDE improvements and how to help.
5 min · 1,157 words
Finding a home amidst the wreckage
Eskild Hustvedt describes growing apathetic as free software projects and Linux distros embrace LLMs, and how he found a new home in Chimera Linux, which takes a stand against LLM-generated contributions, along with other distros, BSDs and non-LLM forks that do the same.
3 min · 677 words
The Best Way to Play Super Mario 64: on Apple Vision Pro
Michael Steil presents diorama64, an open-source project that turns Super Mario 64 levels into living dioramas on Apple Vision Pro that sit on a real table while you play with a controller, and contrasts Nintendo's takedowns with Microsoft's embrace of similar fan projects.
1 min · 298 words
Why I'm no longer updating this repository
Paul Battley explains why he is archiving all his Ruby gems: Ruby was once designed for programmer joy and for humans, but with Rails controlled by a figure he opposes and Ruby itself now developed and repositioned around LLM agents, he no longer wants to contribute to a commons being strip-mined to feed AI.
2 min · 436 words