PHP 8.2.35

https://opengraph.githubassets.com/2602a9a4a520163a27b3e1eb61fab07ee249811792054547aaa01eb213dcce20/php/php-src
The PHP development team has released PHP 8.2.35 to fix two critical security vulnerabilities, urging all users to update immediately as it's the last release before end of life on December 31, 2026.

Today's PHP security release, and how we're strengthening security

https://thephp.foundation/assets/icons/php_foundation.svg
The PHP project has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that allow unauthenticated attackers to execute code on servers running PHP.

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/images/hugo-paper-mevn-cli-forged-commit-preinstall-dropper-banner.jpg
A credential stealer and remote code execution backdoor were found in the LiteLLM 1.107.0 release on PyPI, which was later removed; versions 1.106.2 and rc releases are clean.

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/images/blog/thumbs/duckdb-release-2-0-0.svg
The DuckDB team has released version 2.0.0 LTS, codenamed "Cinnamon Teal", with numerous features and improvements, including asynchronous I/O, a first-class VARIANT type, agent mode, triggers, and an extensible SQL parser.

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b88ee6261d/content/images/size/w600/2026/10/passkeys-trap.png
A security researcher reported that eight eMudhra intermediate certificates were compromised due to weak private keys, which can be easily factored. The affected certificates are still trusted by many non-browser software and devices until July 2039.

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://images.ctfassets.net/kftzwdyauwt9/2PwBCyZF0Z5WLRtsbOpDdQ/338e19fbc39e5b9a63b1db664c006e74/Art_Card__5_.png?w=3840&q=90&fm=webp
A coalition of maintainers, researchers, and security providers addressed critical vulnerabilities in PHP using AI capabilities. The response involved a proposed framework for responding to critical vulnerabilities in widely used software.

Rust off Rails: The opinionated web stack for the AI era

https://rustoffrails.org/static/video/railboard-launch-1280.png?v=8f00fb62
Off Rails is a set of Markdown files guiding coding agents to build full-stack Rust web apps with precise specs and conventions. The agent writes code, while humans write intent and specifications, ensuring consistency and enforcing rules.

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://ichef.bbci.co.uk/news/480/cpsprodpb/d743/live/068cb000-191f-11f1-aabf-478e3f053ea7.jpg.webp
Scientists have discovered two extinct species, a possum and a glider, in West Papua after 6,000 years of thought to be extinct. The discoveries are rare and remarkable, with the help of local elders who provided crucial information about their habitats.

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://dims.apnews.com/dims4/default/ca8658c/2147483647/strip/true/crop/3658x2505+0+0/resize/599x410!/quality/90/?url=https%3A%2F%2Fassets.apnews.com%2F3b%2F64%2F9ef89769eeba8d9f367e9e5cc800%2Fff2566596d18409f9c347cb06245d1d2
Oregon has purchased Abiqua Falls, a 92-foot waterfall, for $2.1 million to protect and preserve it for future generations. The falls will be managed by the Oregon Parks and Recreation Department or another state agency after completing due diligence on environmental and archaeological information.

What I learned from six months of being stupid on purpose

https://wvez.org/assets/blog/learning-to-be-stupid/blank-canvas.jpg
The author shares their journey of learning workflow automation with n8n, initially feeling overwhelmed and doubting their abilities due to lack of experience. They overcame this by starting small, seeking mistakes to learn from and avoiding external advice that didn't apply to them.

Using thousands of AI agents to uncover new leads in biological data

https://images.ctfassets.net/kftzwdyauwt9/5nGzHT5se0oEzcJbDGqwyz/5aafc7c71c35b11d713436e853f0b4b0/low-resource-programming-languages-cover.png?w=3840&q=90&fm=webp
Researchers from OpenAI, PerturbAI, and Scripps Research used thousands of AI agents to analyze data from millions of mouse brain cells in 32 minutes. The agents connected gene disruptions with scientific literature findings, uncovering unexpected biological connections that can help scientists understand disease and identify new treatments.

New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic

https://www.oist.jp/themes/custom/server_theme/dist/images/logo.svg
‘Plasticorals’, coral rubble fused with plastic, are long-lasting reminders of human activity and highlight a potential threat to critical marine environments.

OpenAI models are coming to Google Cloud

https://images.ctfassets.net/kftzwdyauwt9/7zjGwFPBZMvK6zwFSMVWRm/6721ac33e5b1aaf88a9b705a3d10c90a/OAI_Oracle_Partnership_1x1_Art_Card.png?w=3840&q=90&fm=webp
OpenAI and Google Cloud are partnering to bring OpenAI's frontier models into Google Cloud's Model Garden, giving customers native access to these models for complex agentic workflows. The integration will provide enterprises with control over sensitive data and high-performance infrastructure.

Drupal is now light-years ahead of its reputation

https://dri.es/files/cache/drupalcon-rotterdam-2026/driesnote-1280w.png
The author's DrupalCon Rotterdam keynote focused on closing the gap between Drupal's reputation and its capabilities, showcasing improvements in multilingual sites, JavaScript front-ends, headless Canvas, and AI.

Your MCU Likely Escaped the eMudhra Intermediate CA Compromise

https://danielmangum.com/images/twitter-card.png
A software engineer should update IoT devices with MCU capabilities that use public key infrastructure, as an eMudhra CA compromise allows for MITM attacks on unpatched devices. Most MCU-based systems are not impacted due to resource constraints and the need for a specific trust chain.

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/logos/alter-logo-dark.svg
Combinator's agent-based system controls user actions, enforces policies and keeps credentials private. It integrates with 140 providers through a single SDK call, offering compliance and audit features.

EA is shutting down BioWare

https://platform.theverge.com/wp-content/uploads/sites/2/2025/01/JAY_BLURPLE.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400
BioWare, the legendary RPG studio behind Mass Effect and Dragon Age, is shutting down due to poor performance. EA has chosen not to continue development on the next Mass Effect game and laid off around 400 staffers, including 50 at BioWare.

9 Mothers (YC P26) Is Hiring in Austin, TX

https://storage.googleapis.com/ployai/dd1475f0-2410-4ca9-b24e-7883c3bddc93/user/570ba5d4-mounted-edda-stylized.png
The team ships hardware on software tempo, focusing on real deployment, short iteration loops, and hands-on ownership of specs. They prioritize user needs, iterating based on data and affordability, not just roadmaps.

C++ futures part 1: The mental model

https://devblogs.microsoft.com/oldnewthing/wp-content/uploads/sites/38/2019/02/ShowCover.jpg
The C++ standard library provides a set of classes for asynchronous programming, including std::promise and std::future, which are built around a single "source" class that produces values or exceptions. This source class ensures thread-safe access to its internal state using mutexes and condition variables.

Trials and Tribulations of Native Lua Compilation

The author discusses clx, a native Lua compiler that transforms Lua code into C++ for direct execution without a Lua VM. It aims to provide a native experience with performance benefits and integration capabilities.

Show HN: ULDA – Client-side encryption with a simple JavaScript API

Make room for your ideas. A collaborative room planner with client-side encryption, powered by ULDA.

Way to Play Super Mario 64: On Apple Vision Pro

https://www.pagetable.com/docs/diorama64/around.jpg
Super Mario 64 is recreated as a living diorama on Apple Vision Pro, allowing players to walk around and interact with the game world in real space. Nintendo responded to similar technology by issuing DMCA takedowns and a lawsuit against Yuzu for its Super Mario 64 port.

Muse exposes users' personal and business secrets when they share conversations

https://cdn.arstechnica.net/wp-content/uploads/2026/10/ai-robot-hand-caution-640x360.jpg
Meta's Muse AI agent shares sensitive info via web links, prompting a suspension of the feature while it reviews and considers changes. Researchers found 6,800 shared conversation links that exposed confidential information due to a design flaw in the link construction process.

The bridge to agent-scale Git infrastructure

https://github.blog/wp-content/uploads/2026/01/generic-mona-github.png?resize=1600%2C850
GitHub migrated Git repositories to Azure to handle exponential growth, reducing latency by moving replicas and changing quorum serialization to per-reference writes. This allows scaling reads and writes independently, improving throughput and enabling further expansion.

Show HN: Sumi.css – CSS Framework

https://private-user-images.githubusercontent.com/34764/679781694-2e2e6956-1132-4617-8143-e0fb2b0d4ed2.webp?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3OTI1OTY4OTYsIm5iZiI6MTc5MjU5NjU5NiwicGF0aCI6Ii8zNDc2NC82Nzk3ODE2OTQtMmUyZTY5NTYtMTEzMi00NjE3LTgxNDMtZTBmYjJiMGQ0ZWQyLndlYnA_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYxMDIxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MTAyMVQxNTI5NTZaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT02YzUyZGVkYjM4NGE2MGQ2NGVjNjBjNGE3YTA2NDdhOWUyMWQ5YjY4Y2NjY2I2NGNhYzIxNmM0Njc0NmUxYWQ3JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZ3ZWJwIn0.kn1g_HwkHPgQll-pbbUn8htXW17XWjqb71dRcSsw0JQ
Sumi is a minimalist CSS framework that styles plain HTML with no classes, resulting in a finished look. It supports light and dark modes automatically following the visitor's system setting.

The Decoherence Trap

https://maevyn.codes/decoherence/coherence-hero-start.dark.svg
Decoherence in AI systems can lead to exponential growth of complexity, making it difficult for humans to maintain coherence and control. This phenomenon is not new, but its widespread use of AI has accelerated it.

Whatever Happened to Fire Escapes

https://images.squarespace-cdn.com/content/55ac34e4e4b0170ef54be632/1792512195575-HPY2NPI661FM9R2RY5FN/PREN_E115_Fire-Escapes-B+%281%29.jpg?content-type=image%2Fjpeg
Fire escapes were initially installed in tall buildings to provide an alternative escape route during fires, but their effectiveness and safety have been debated over time. The economics of real estate often prioritize cost savings over safety features.

PHP2Shell: AI uncovers critical RCE in PHP

https://www.datocms-assets.com/75231/1792534907-img_7274.png?fm=webp
Wiz Research discovered multiple critical vulnerabilities in PHP, a popular scripting language powering 70% of the web, allowing attackers to take control of servers and steal sensitive data. The vulnerabilities were found using AI models and can be exploited remotely without authentication.

The phenomena that brighten dawn and dusk (2016)

The Earth's shadow and the Belt of Venus create distinct color bands during sunrise and sunset due to atmospheric light scattering. Light travels longer paths at dawn/dusk, scattering shorter wavelengths and allowing longer ones to dominate, resulting in vivid colors.

The Lucrative World of Literary Scams

https://images.squarespace-cdn.com/content/6317a497832bf15c3b30f236/dd12691f-0533-44d2-8732-137cf187c1c8/Oct2026_Book+Scams_banner.png?format=2500w&content-type=image%2Fpng
A scammer impersonated a Seattle-based life-drawing community organizer to discuss an author's book, but the meeting was revealed to be fake. The scammers were likely targeting authors for their money, using tactics such as offering fake publishing deals and social media management services.