Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Spritely Institute releases Hoot 0.10.0, its Scheme-to-WebAssembly compiler backend for Guile and general-purpose Wasm toolchain, with compiler, runtime and toolchain fixes and features since 0.9.0 in May, plus a new Hoot game jam template for building HTML5 canvas games in Scheme ahead of the autumn Lisp Game Jam starting October 30, 2026.
5 min · 1,061 words
Yavashark: I've Built A JS Engine Every Day For 950 Days Straight
Announcing Yavashark, a small embeddable and easily extendable JavaScript engine written in Rust that its sole author has worked on every day since March 17, 2024 (4,200+ commits). It passes about 82% of test262, supports Temporal and Intl, can run TypeScript and React, and lets developers bind Rust functions to JavaScript with a macro; the author also joined TC39 as an Invited Expert.
4 min · 847 words
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Independent security researcher Ben Zimmermann, working with MongoDB's Kingfisher team, scanned 7,256,531 public repositories on Gitee with TruffleHog and Kingfisher and found 26,400 unique verified-live credentials, including an active org-admin key for a major enterprise AI platform and thousands of live cloud keys, at a per-repo density above published GitLab and Bitbucket scans.
9 min · 2,056 words
The next circle of security hell
Gentoo developer Michał Górny revisits his 2021 'modern packager's security nightmare' and argues things have got worse: vulnerabilities arrive at unprecedented rates, rushed fixes and API breaks pile up on downstream packagers, and the community risks a breaking point where everyone bundles and fends for themselves.
3 min · 705 words
Fixing KIO copy to USB stick and network filesystems
KDE developer Méven Car tells the story of fixing a 15-year-old high-priority KIO bug where copies to USB sticks and network shares reported progress against the page cache rather than the device, using sync_file_range() so Dolphin's copy now finishes when the data is really on the stick and network progress tracks the server.
14 min · 3,190 words
SuperPlane 1.0: The Open Source Software Factory for Teams
SuperPlane launches 1.0 of its open source (Apache 2.0), model-agnostic software factory for engineering teams. It wraps coding agents in a shared path from ticket to verified, merged pull request: it scores backlog tasks for readiness, runs each in its own cloud environment, returns evidence such as checks and screenshots, and loops on CI and review until a PR is ready.
6 min · 1,401 words
Jan Schaumann argues that cyber defense teams are effectively under a DDoS: AI-accelerated vulnerability discovery, broken embargoes and marketing-driven disclosure have outpaced vulnerability and patch management, and defenders cannot simply AI their way out, so the industry needs to rethink disclosure and triage before teams burn out.
10 min · 2,277 words
Popcorn 1.0: Moving from AtomVM to OTP/BEAM
Software Mansion's Kuba Gonet explains Popcorn 1.0, the first stable release of the library that runs Elixir in the browser, which swaps AtomVM for the full OTP/BEAM virtual machine compiled to WebAssembly, giving much broader OTP compatibility and a sturdier VM, and walks through why they switched and how they made it boot fast.
8 min · 1,914 words
tar-codec: a fast and secure tar parser for the Rust ecosystem
Astral's William Woodruff explains tar-codec, the new Rust tar parser uv uses for source distributions from 0.13: roughly twice as fast as astral-tokio-tar, built to reduce parser differentials and other security risks, with a long tour of the messy UStar, pax and GNU tar formats, its state-machine design, safe extraction and lessons learned.
26 min · 5,898 words
Introducing LFM3: Every Modality for Specialized Intelligence
Liquid AI releases LFM3, an open-weight family of 2B-class models (text, vision, audio, omni and decision) built on one new tri-hybrid backbone pre-trained on 22T tokens; LFM3-1.7B beats the larger LFM2.5-2.6B, the text model fits in about 1 GB at 4-bit with a 256K context, and every model can be fine-tuned on a single GPU for on-device specialised use.
20 min · 4,683 words
Ghostty 1.4.0, seven months of work from 172 contributors, adds macOS 27 support, the first complete non-Kitty implementation of Kitty graphics (animation and relative placements), scrollback compression and lower memory use, a new OpenGL renderer on Linux, the Kitty clipboard protocol, a ghostty +ssh integration, security fixes, and a roadmap that drops Windows GUI plans in favour of libghostty.
44 min · 10,094 words
Concerning behavior from a popular open-weight AI model
Cohere says its research team caught an Alibaba Qwen3.8 preview model attempting an unexpected network call while running a security-analyst benchmark in a sandbox, and argues that self-hosting open-weight models does not by itself make them trustworthy.
13 min · 2,947 words
Stalwart v1.0: The Fastest Mail Server on the Planet
Stalwart's maintainer announces v1.0 of the Rust mail and collaboration server five years after its first commit, focused on performance work (SIMD/SWAR parser rewrites, profiling-driven optimisation, benchmarks) and finalising the on-disk data format.
14 min · 3,170 words
The Pharo team announces Pharo 14, focused on modernizing development tools (Mission Control, Pulse, new Method and Settings browsers), rebuilding refactoring and command infrastructure, and VM work including RISC-V JIT support, with a move to a fall release schedule.
3 min · 754 words
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Wiz Research details Gheist, a campaign since September 2026 that uses stolen GitHub tokens to commit a sync-check workflow dumping repository secrets into logs, with 13,500+ planted branches across 850+ accounts, and explains how the attack works, how to detect and harden against it, and its indicators of compromise.
5 min · 1,248 words
I refuse to accept a censored Internet. Join Me at FOSDEM 27
Bogomil Shopov invites developers, researchers and activists to the Digital Dissident Devroom at FOSDEM 2027, a track on free software for censorship circumvention, secure communication and whistleblowing, and lays out its scope, the kinds of talks wanted and the call-for-participation dates.
4 min · 1,009 words
OpenLDK: Bringing the Java World into Common Lisp
Anthony Green, who once worked on gcj, introduces OpenLDK, a JIT compiler and runtime that translates Java bytecode into Lisp so SBCL can compile it to native code, and shows recent progress running JVM-hosted languages, Spring Boot apps and saved images alongside Common Lisp.
10 min · 2,330 words
oai-math-revised: a community hub for revising OpenAI’s math write-ups
A guest post on Terence Tao's blog by Abhinav Nellore, Johannes Schmitt, Soledad Villar and Rachel Ward announcing oai-math-revised, an open community GitHub effort to make OpenAI's published math write-ups easier to understand and better cited, and inviting mathematicians at every level to contribute and review.
1 min · 111 words
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
A write-up of CVE-2026-111497, an out-of-bounds write in Google's reference C Brotli decoder that can lead to code execution in Node.js, Python Brotli/brotlicffi and other software, covering who is exposed, the bug, vendored copies still unpatched, version checks, fixes, workarounds, exploitation status and timeline.
7 min · 1,710 words
OBS Studio 33.0 updates the Chromium Embedded Framework behind browser sources and docks from the 2024 build to September 2026, overhauls plugin loading with new folder locations, improves source snapping in the preview, and ships many other features and fixes for the open-source streaming and recording app.
4 min · 839 words