Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
eMudhra to Exit global SSL/TLS Certificate Business
eMudhra's board has decided to voluntarily withdraw from the global SSL/TLS certificate business after a recent incident involving its CAs, which it says were revoked within 14 hours, and will focus on its core enterprise and other trust services.
2 min · 526 words
Quad9 explains why, after a French court ruling in beIN's favour forcing it to block DNS resolution for certain domains, it will stop offering its free DNS cyberprotection service to users in France from November 24, 2026, and what users can do next.
15 min · 3,417 words
Security Disclosure: Wednesday October 21st
Railway discloses that an unauthorized third party may have accessed encrypted customer environment variables, and in some cases their decrypted contents, as part of a series of attacks on platform companies; it recommends rotating secrets and explains paused builds and next steps.
1 min · 252 words
Your AI agent fixed the bug, but what else did it change?
Trail of Bits releases patching-bugs and regression-hunt, two agent plugins built through its Patch the Planet work with OpenAI that reproduce bugs, develop and test fixes, and check patches for regressions within a project's own threat model and patching guidelines.
8 min · 1,778 words
New Mexico Attorney General Raúl Torrez announces a court order requiring Facebook to pay $25 billion in civil penalties after a jury found 43,899,725 violations of the state's Unfair Practices Act in its Cambridge Analytica case.
3 min · 587 words
We just gave a million dollars to Open Source maintainers
Sentry raised its Open Source budget from $750,000 to $1,000,000 this year. The post explains why, its Open Source Pledge, and how the money was split among maintainers and foundations, with the full list of recipients.
3 min · 771 words
Climate: The 1.5°C goal of the Paris Agreement is no longer viable
UNRIC summarises UNEP's Emissions Gap Report 2026, which finds overshooting 1.5°C is now inevitable, sets out the emissions cuts needed to stay below 2°C and return to 1.5°C by 2100, and lists the UN Secretary-General's levers for action.
3 min · 674 words
New open-source method shows the same AI request emits 8.5 times more CO₂ in Texas than in Sweden
Berget AI releases an open-source, MIT-licensed method for calculating the carbon emissions of each individual AI request, developed with Stockholm Environment Institute, WattTime and Klimatkollen, showing grid location can change per-request emissions by a factor of 8.5.
5 min · 1,168 words
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
OpenAI describes leading a coalition with PHP maintainers, Calif, Wiz, Cloudflare and others to fix critical PHP vulnerabilities found with AI, commits $1B in subsidized Daybreak access for frontline defenders, and proposes a five-stage framework for coordinating responses to critical bugs in widely used software.
8 min · 1,812 words
Anthropic opens a waitlist research preview of Claude Duet, a new app where Claude works as a proactive agent, starting with US Pro and Max subscribers; the post covers how it directs attention, its safety and discretion design, tester use cases and how it works.
7 min · 1,569 words
Today's PHP Security Release, and How We're Strengthening PHP Security
The PHP Foundation explains the two critical RCE vulnerabilities fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, how they were found with researchers and AI security tools and fixed, how PHP security handling has changed over two years, and what dependent organizations need to fund.
8 min · 1,860 words
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team announces DuckDB 2.0.0 LTS, its biggest feature release so far: a polished Quack protocol for DuckDB as a server, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, an extensible PEG-based SQL parser, plus breaking changes and migration notes.
12 min · 2,753 words
Introducing tsrs: a Port of TypeScript to Rust
Cloudflare and VoidZero, with Max Schwenk of Owner.com and in collaboration with the TypeScript team, announce tsrs, a faithful Rust port of the TypeScript compiler incubated in the Oxc toolchain. Early benchmarks show it up to 8x faster with about 70% less memory than TypeScript 7.0; the post explains why Rust and Wasm matter and how the port will stay in sync.
5 min · 1,102 words
Protecting Firefox users following the compromise of eMudhra intermediate certificates
Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1.
1 min · 272 words
Cursor releases the Agent SDK, the framework it uses to build its own managed agents such as Bugbot, Security Reviewer and Rollouts. Teams define agents in code, with Markdown prompts, TypeScript tools, connections and evals, respond to events like pull requests, and deploy to Cursor's infrastructure with `agent-sdk deploy` or run them as a Node process on their own.
3 min · 759 words
Do minor curl vulnerabilities in the open
curl maintainer Daniel Stenberg announces that from October 26, 2026 the project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. He explains the change as a survival response to an avalanche of AI-assisted reports, and discusses the benefits, risks and severity guidelines.
4 min · 961 words
Announcing the GPU notification group and Linker Working Area
The Rust compiler team announces a GPU-target notification group for vendor experts helping diagnose GPU backend issues, plus a Linker working area to integrate alternative linkers such as Wild and to field linker questions, with Zulip streams and signup via rust-lang/team.
1 min · 295 words
Open-Sourcing Phonon: A Suite of Frontier On-Device TTS Models
Gradium open-sources Phonon, a family of 31m and 40m parameter on-device text-to-speech models, including a multilingual model for English, French, German, Spanish and Portuguese. The post covers benchmarks on naturalness, word error rate and latency (7 ms to first audio on a laptop CPU), hardware targets, custom voices, how the models work and how to get started.
13 min · 2,946 words
Blocking Identity Resolution Infrastructure
WebKit's John Wilander, Charlie Wolfe and Matthew Finkel explain identity resolution, the post-cookie tracking method where invisible third parties collect your email at login or signup and turn it into a persistent cross-site tracking ID and identity graph, and how Safari and WebKit in the 27 releases block network access to that infrastructure at the domain level.
4 min · 873 words
Introducing Clairic, a new System One class of extraction models
Cloudflare previews Clairic, a System One-style extraction model on Workers AI that extracts, computes, estimates and forecasts values from unstructured text and images with higher accuracy, lower latency and lower cost than general LLMs, with worked examples, how requests work, and plans to release open weights.
18 min · 4,046 words