Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

https://anchor.host/wp-content/uploads/2026/04/wordpress-plugin-supply-chain-attack-1-1024x572.webp
A trusted WordPress plugin, Countdown Timer Ultimate, was compromised through a supply chain attack. The plugin's wpos-analytics module injected malicious code into wp-config.php, serving SEO spam to Googlebot.

GitHub Stacked PRs

https://github.github.com/gh-stack/_astro/stack-navigator.DbHWHwGH_Z14GiHR.webp
The gh stack CLI and GitHub UI allow for organized pull requests in an ordered stack, making it easier to review and merge large changes. This approach breaks down big changes into small, focused pull requests that build on each other, improving review quality and team efficiency.

How to make Firefox builds 17% faster

Buildcache's Lua plugin system allows caching of deterministic build steps like Firefox's WebIDL binding code generation. A new wrapper, webidl.lua, was created to cache this step, reducing build times from 5m35s to 1m12s on warm builds.

Nothing Ever Happens: Polymarket bot that always buys No on non-sports markets

The bot scans markets, tracks positions, and exposes a dashboard with live recovery state. It can be deployed on Heroku with config settings and scaled to run only the web dyno.

Stanford report highlights growing disconnect between AI insiders and everyone

https://techcrunch.com/wp-content/uploads/2026/04/Screenshot-2026-04-13-at-1.52.10-PM.jpg?w=680
Public sentiment towards AI is increasingly negative, with concerns over job loss, rising utility costs, and AI's impact on paychecks. AI leaders are out of touch with these concerns, focusing on theoretical risks like Artificial General Intelligence.

An Introduction to Obsidian

https://bryanhogan.com/_astro/Bryan-Hogan.CXnc1Lb7_Z6mX3v.webp
Obsidian is a powerful note-taking program that allows users to work with local markdown files and offers a high degree of customization. It's a great option for those who value simplicity and flexibility in their note-taking setup.

(AMD) Build AI Agents That Run Locally

https://mintcdn.com/amd-fe836e11/PgPhi3UrqFX2lV53/assets/favicon.ico?fit=max&auto=format&n=PgPhi3UrqFX2lV53&q=85&s=77bcf8b2d70613766cc02f16b0e208a0
GAIA is an open-source framework for building AI agents in Python and C++ that run entirely on local hardware. Agents reason, call tools, search documents, and take action — with no cloud dependency and no data leaving the device.

Show HN: Ithihāsas – a character explorer for Hindu epics, built in a few hours

https://www.ithihasas.in/opengraph-image?f20489d4ac7527e4
Explore the characters, dynasties and relationships of the Rāmāyaṇa and Mahābhārata through interactive force graphs, dynasty trees and chord diagrams.

Building a CLI for All of Cloudflare

https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6TTRJoUvbs5eWPtnu6NuL6/d31b8479cfca7f4a77517f875f0049eb/BLOG-3224_1.png
Cloudflare is rebuilding its CLI, Wrangler, to provide commands for all products and let agents configure them together using infrastructure-as-code. The new CLI, available in technical preview, will be generated using a new TypeScript schema that defines APIs, CLI commands, and context.

Servo is now available on crates.io

https://servo.org/svg/servo-color-positive.svg
Servo team released v0.1.0, allowing Servo to be used as a library, with a growing confidence in its embedding API. A long-term support (LTS) version is also offered for embedders who prefer scheduled upgrades.

N-Day-Bench – Can LLMs find real vulnerabilities in real codebases?

N-Day-Bench measures LLMs' real-world vulnerability discovery capabilities. It's an adaptive benchmark with updated test cases and model versions monthly.

What We Learned Building a Rust Runtime for TypeScript

https://encore.dev/assets/blog/rust-runtime.png
Encore is a backend framework that uses a Rust runtime to handle infrastructure concerns, allowing developers to write business logic in TypeScript. The framework's Rust runtime handles tasks such as HTTP request lifecycle, database connection management, and tracing, resulting in a 9x performance gain over Express.js.

The tech jobs bust is real. Don't blame AI (yet)

https://www.economist.com/cdn-cgi/image/width=1424,quality=80,format=auto/content-assets/images/20260418_FND001.jpg
Tech giants like Oracle, Block, and Amazon are cutting thousands of jobs due to AI advancements. This is part of a generational boom in AI, making humans redundant in many tech roles.

Just Enough Chimera Linux

User installs Chimera Linux on a single disk with a two-partition layout and uses ZFSBootMenu bootloader. They configure the system with a custom partition layout, encrypted root partition, and ZFS pool with a data dataset for shared files.

I Just Want Simple S3

https://blog.feld.me/static/site_logo_512.png
You're looking for a reliable S3 alternative that's not slow and doesn't require scaling or replication. You've tried Minio, Garage, and SeaweedFS but had issues with performance and complexity.

Tax Wrapped 2025

https://taxwrapped.com/taxwrapped.png
See what the federal government spent with your tax dollars.

Visualizing CPU Pipelining (2024)

https://timmastny.com/blog/visualizing-cpu-pipelining/pipeline-registers.svg
The user explains how CPU pipelining works, including the use of register metadata, stalls, and forwarding to resolve data hazards and control hazards. They also discuss branch prediction and resolution, including dynamic branch prediction and the use of a Branch Resolution Unit (BRU) and Branch Prediction Unit (BPU) to update predictions and handle mispredictions.

If you started a company two years ago, many assumptions are no longer true

https://i0.wp.com/steveblank.com/wp-content/uploads/2026/03/AI-LLM-Time-Horizon.jpg?resize=468%2C265&ssl=1
Startups older than two years often have outdated business plans and technical stacks. Founders must reassess their companies to stay competitive.

Tracking down a 25% Regression on LLVM RISC-V

https://avatars.githubusercontent.com/u/25258108?v=4
The user analyzed a benchmark on RISC-V targets and found a performance regression in LLVM due to a recent commit that improved isKnownExactCastIntToFP but inadvertently broke a downstream narrowing optimization. The user fixed the issue by extending getMinimumFPType with range analysis to recognize that fptrunc(uitofp x double) to float can be reduced to uitofp x to float, and the patch was ...

All elementary functions from a single binary operator

https://arxiv.org/static/browse/0.3.4/images/arxiv-logo-fb.png
A single binary operator eml(x,y) can generate all standard functions of a scientific calculator using the constant 1. This operator enables exact recovery of closed-form functions from data at shallow tree depths.

MEMS Array Chip Can Project Video the Size of a Grain of Sand

https://spectrum.ieee.org/media-library/an-array-of-tiny-metallic-cantilevers-curving-away-from-the-surface-of-a-photonic-chip.jpg?id=65493217&width=1200&height=750
Scientists at MITRE and MIT developed a photonic chip that can project 68.6 million spots of light per second, enabling control of millions of qubits in quantum computers. The chip's technology could also revolutionize imaging in augmented reality, biomedical imaging, and 3D printing.

B-trees and database indexes (2024)

https://planetscale-images.imgix.net/assets/btrees-and-database-indexes-inner-and-leaf-nodes-VP6Mw5cu.png?auto=compress%2Cformat
B-trees and B+trees are data structures used in database management systems like MySQL to perform efficient data lookups via indexes, and choosing a suitable primary key can significantly impact performance. A sequential primary key like a BIGINT UNSIGNED AUTO_INCREMENT is generally better than a random or UUID primary key for minimizing the number of nodes visited and improving query performance.

New Orleans's Car-Crash Conspiracy

https://media.newyorker.com/photos/69d682cb091977b644c66b41/master/w_2560%2Cc_limit/r48958.jpg
Large trucks cause many accidents in the US, often due to reckless driving or fatigue, and can be deadly for occupants of smaller vehicles. In New Orleans, a network of personal-injury lawyers and "slammers" staged fake truck crashes to collect insurance payouts, with some drivers risking their lives for money.

Show HN: Continual Learning with .md

https://opengraph.githubassets.com/b2bdff03b0569a57fa245a6ff025d5518c77e96354ac864c0525caa60a74fb14/SunAndClouds/ReadMe
REPO_DIR="$(pwd)" && codex exec --dangerously-bypass-approvals-and-sandbox --ephemeral "Install a daily scheduler for: cd \"$REPO_DIR\" && codex exec --dangerously-bypass-approvals-and-sandbox --ephemeral - < Update.md. Use cron by default; otherwise use the host scheduler. Do not create wrapper scripts. Verify codex is on PATH, Update.md exists, and the ...

The Future of Everything Is Lies, I Guess: Safety

Large Language Models (LLMs) pose significant risks to psychological and physical safety, including enabling malicious attacks, harassment, and fraud, and their alignment efforts are not working well. The industry is creating conditions for anyone with sufficient funds to train unaligned models, and the consequences of LLMs could be severe, including destabilizing economies, public safety, ...

Make tmux pretty and usable (2024)

https://hamvocke.com/_astro/tmux-custom.JReQpud4_1TUvCB.webp
The user is customizing their tmux configuration to make it more comfortable to use. They are changing the prefix key from C-b to C-a and remapping the Caps Lock key to Ctrl.

The looming college-enrollment death spiral

https://cdn.theatlantic.com/thumbor/RjTzP7_25KyNdYUjOeCH1EnEp5w=/0x0:2000x1125/960x540/media/img/mt/2026/04/2026_04_09_uni_mpg/original.jpg
The US is facing a college enrollment crisis due to a declining number of high school graduates, with 38 states projected to see a drop in graduates by the 2040s. This will lead to campus closures, further reducing enrollment and creating a vicious cycle.

Microsoft isn't removing Copilot from Windows 11, it's just renaming it

Microsoft announced plans to fix Windows 11 in 2026 by giving users more control and removing unnecessary AI features. However, recent changes have been met with disappointment as Microsoft rebranded Copilot instead of removing AI capabilities.

Initial mainline video capture and camera support for Rockchip RK3588

https://www.collabora.com/assets/images/newsroom/hiring_speechBubble2.png
Collabora and the linux-rockchip community are working to bring mainline Linux support to Rockchip RK3588 SoC's video capture and image signal processing blocks. They have made significant progress, including upstreaming the rkcif driver and the Rockchip MIPI CSI-2 receiver unit.

This year’s insane timeline of hacks

https://substackcdn.com/image/fetch/$s_!RcBr!,w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fb09ed54b-8599-421a-919a-7fcb5b93d65a_5760x3840.jpeg
A series of high-profile cyber incidents in 2026, including breaches of Stryker, Lockheed Martin, and Rockstar Games, have been attributed to four separate campaigns targeting U.S. and Western targets. The incidents, which include the exfiltration of 1.5 billion Salesforce records and the wiping of 200,000 devices, have been linked to Iran, North Korea, Russia, and a financially-motivated ...