Seventy stories cleared 200 points today. Thirty-nine were already on yesterday’s page; thirty-one are new. That ratio is normal. What is not normal is the shape of the new ones.
Yesterday’s roundup ended with a sentence about complexity being a speed bump a model can drive over while a committee decides which way to fix it. Today the page spent eighteen hours arguing with that sentence in public. A certificate authority announced it is quitting the certificate business rather than answer questions about keys it generated by counting. A ten-out-of-ten unauthenticated RCE in GitLab got 399 points, which on any other day is the biggest security story of the month and today is the sixth. A hosting platform told customers to rotate every secret they have while simultaneously disabling the mechanism for deploying the rotated secrets. And the argument about whether the PHP bug is “easy” to exploit ran for a full day, with both sides eventually wrong.
PHP 8.2.35 — 1,069 points
1,069 points · 557 comments · github.com/php/php-src · HN discussion
The release tag for the 8.2 branch, submitted separately from yesterday’s advisory, and it outran the advisory’s own momentum. The release note is two sentences long and one of them is “There are no complete mitigations, updating is the only safe choice.” The other is that PHP 8.2 reaches end of life on 31 December 2026.
Two things in the comment thread are worth more than the release itself. First, the patch did not exist for the first chunk of the day: the advisory said “update now” while the tarballs were still being cut, and commenters tracked the gap minute by minute — the 8.4.27 tag appeared as an empty shell with no amd64 image, then filled in. If your incident response plan says “patch within X minutes of advisory,” X was undefined because there was nothing to patch. Second, WP Engine — a company whose entire product is hosting WordPress — was still serving PHP 8.4.26 two and a half hours after the fixed build was public, which is the honest picture of how the long tail of this thing looks. The volunteers who cut PHP releases are a handful of people, one of whom has a Patreon linked in the thread because that’s how the bottom of the stack is funded.
There isn’t an easy exploit for this PHP vulnerability — 602 points
602 points · 400 comments · eliastaylor.com · HN discussion
Elias Taylor wrote the day’s most useful piece of skepticism: the thousands of “PoC” repositories on GitHub do not work against a vanilla PHP install, and many of them cheat by requiring a pre-existing local file inclusion bug. His framing is that people are being told they have an exploit by a model that is grading its own homework, and he has specific receipts — three of the most-starred PoCs, each of which either needs LFI or only works in a lab where the server was modified.
He was right about the repos and wrong about the conclusion, and the comment thread closed the gap inside a few hours. Wiz demonstrated pre-authentication RCE against unmodified WordPress, Drupal and Joomla; the PHP Foundation’s own post-mortem confirms remote code execution against a real-world application. So the honest scorecard is: the mass of LLM-generated PoCs is junk, and the bug is genuinely exploitable at the application layer, and the fact that both of those are true at once is the actual story. “Can a model produce a working exploit” turned out to be the wrong question. The right one is “can a model produce ten thousand non-working ones that make it impossible to find the two that matter.”
eMudhra is exiting the global SSL/TLS business — 784 points
784 points · 559 comments · emudhra.com · HN discussion
The press release is dated today and the causal sentence is not buried: “the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.” Read that twice. The board’s stated reason for leaving a regulated trust business is that people asked too many questions about it. The release also points out that SSL/TLS is about 1% of revenue, that larger entities give certificates away free, and that sovereign-compliance costs were already eating the margin — all of which is probably true and none of which explains why the keys were the integers 4 through 237.
What the release carefully does not contain is a root cause. It says the incident was handled “diligently,” that the affected CAs were revoked within 14 hours, that no end-entity certificates were issued from them, and that physical and logical controls were intact. Commenters immediately noted the tension in “no end entity certificates issued” — anyone could have issued one, that’s what an intermediate CA is for. The revocation took 14 hours; the keys were weak for seventeen months. And 14 hours is being offered as the diligent number.
The second-order effect is the one to watch. A CA small enough to be pushed out by scrutiny is a CA whose 1% market share has to go somewhere, and the browser root programs now have one fewer independent operator to point at when someone asks why the trust store is dominated by three companies.
mitmproxy ships –emudhra — 582 points
582 points · 138 comments · github.com/mitmproxy · HN discussion
A two-line changelog entry: “Add --emudhra option to sign TLS certificates with a compromised eMudhra intermediate CA key.” It is a joke that compiles. mitmproxy normally has to convince your browser to trust its own generated CA; with this flag it signs with a key that every major root store already trusts, which is exactly the attack that shouldn’t be possible and was. The adjacent change in the same release is not a joke: certifi updated to remove eMudhra CAs from precompiled binaries.
The comment thread is mostly people enjoying a maintainer being funny on a terrible day, but the mild horror underneath is real — the whole premise of certificate transparency and root programs is that a CA’s private key is the one thing you cannot guess. The most-starred comment is just [REDACTED PRIVATE KEY], which is the correct amount of commentary.
Railway: encrypted environment variables, returned decrypted — 571 points
571 points · 329 comments · blog.railway.com · HN discussion
Railway detected “anomalous activity involving systems that store customer environment variables” and concluded that a third party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” It is telling customers to roll every secret stored on the platform, and it has paused all deployments while it investigates — which means, as the top comment points out at 5:20 in the morning, that you cannot redeploy the service that needs the new credentials. The fix disables the fix.
Railway’s own framing is the most interesting part: “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” That is a coherent motive — a PaaS is a shelf full of other companies’ model-provider keys, and one breach gets you API access to fifty customers’ inference budgets at once. Commenters report their OpenRouter keys were used within hours; one says the attackers spent two dollars on Opus and Fable. Encryption at rest did essentially nothing here, because the threat model was someone with the ability to ask the service to decrypt.
PingCAP: 10.6TB and eighty-eight undetected exports — 419 points
419 points · 71 comments · fulcrumsec.vg · HN discussion
An extortion group published the first 200GB tranche of what it claims is 10.6TB taken from TiDB Cloud: the production control plane, 180,046 tenant organizations, 403,262 unique emails, 115,308 console API keypairs stored in plaintext (42,612 active), 20.6 million customer SQL statements, 377,446 Jira issues, and 413 private source repositories. The method is the part that should end careers: the group found GCP service-account keys and an Azure service principal committed in PingCAP’s own repositories, stood up a replication feed of PingCAP’s control-plane database, and had PingCAP’s own infrastructure push a full export every six hours for twenty-two days. Eighty-eight consecutive exports, from 8 September to 30 September, no detection.
PingCAP’s trust-center statement says an external incident response firm “found no evidence that the attacker ran commands or maintained persistent access.” Both of those can be technically true while a database replication pipeline runs for a month, which is the distinction commenters seized on. The structural lesson isn’t new but it keeps being purchased at full price: control plane and data plane separation is not a diagram, it’s the only thing that decides whether a leaked tenant table is metadata or a breach.
GitLab patches a CVSS 10.0 that nobody had time for — 399 points
399 points · 91 comments · docs.gitlab.com · HN discussion
CVE-2026-110264: an integer overflow in the regular expression compiler lets an unauthenticated user execute arbitrary code on a GitLab server. CVSS 10.0. Impacted versions start at 7.0, which means every self-managed GitLab in existence that hasn’t patched, and GitLab backported the fix to four older branches in addition to the standard patch release. Two detection rules shipped with it, for self-managed operators who want to grep for the crash signature.
The commenters did the work the release notes didn’t: this traces back to Ruby’s regex engine (Onigmo), where a fix existed in April and was only backported recently, so the root question is why GitLab shipped a vulnerable engine for six months. Best line in the thread: “it’s a little bit frightening that this severe of a bug isn’t the biggest security vulnerability of today.” On this page, on this date, it isn’t even close.
Trend Micro posted kernel vulnerabilities to the public list — 229 points
229 points · 84 comments · phoronix.com · HN discussion
Several unpatched Linux kernel vulnerability reports went to LKML overnight instead of the private security list, and Greg Kroah-Hartman replied to each one asking why. The reports came from Trend Micro’s Zero Day Initiative. Among them: an integer underflow in SMB Direct with remote code execution, CVSS 9.0; a KSMBD race condition, also 9.0; a skb_zerocopy bug giving local privilege escalation; an out-of-bounds write in the VMware graphics driver; an uninitialized resource in NVMET leaking kernel memory.
At least one report duplicates something the kernel team already received privately a week earlier, which is its own kind of sloppy. The thread is split between people furious at ZDI for publishing unpatched 9.0s and people pointing out that the kernel now asks for AI-assisted reports to go to the public list, because the private list was drowning. Both can be true. Either way, the embargo on five kernel bugs ended because of a mailing-list address, not a decision.
Amazon watched PHP2Shell being exploited four days early — 238 points
238 points · 86 comments · aws.amazon.com · HN discussion
Amazon’s honeypot network recorded a PHP2Shell exploitation attempt on 17 October — four days before the embargo lifted — from an IP associated with a commercial anonymization network. The embargo was set to lift 21 October at 14:00 UTC; Amazon saw multiple working PoCs by 02:00 UTC that day, and more exploitation attempts from different anonymized infrastructure between 02:00 and 08:00, with payloads differing enough to suggest separate actors.
Amazon is careful to say it’s unclear how the actor got exploit information pre-disclosure, and that’s the right level of honesty. But it directly undercuts the cleanest version of the “frontier AI found this before the attackers did” story that OpenAI is telling elsewhere on this page. Someone was probing a honeypot with a PHP2Shell exploit while the advisory was still under embargo. That’s either a leak, a parallel discovery, or a guess lucky enough to be indistinguishable from both.
OpenAI’s Patch the Planet wants credit for the timing — 260 points
260 points · 182 comments · openai.com · HN discussion
OpenAI’s account: a coalition of maintainers, researchers and security providers spent two months on the PHP bugs. Calif found one with GPT-5.6 Sol under the Patch the Planet banner; Wiz independently found both; Cloudflare and others pre-built mitigations. OpenAI calls it “one of the most impactful security issues in recent memory” and frames the window between discovery and exploitation as a “Defender’s Window.”
Strip the branding and the claim that survives is narrow: this time, the finders were on the defense side. The claim that does not survive is the implication that the window stays open. OpenAI says the same capabilities “can also help attackers rapidly develop offensive tools and exploits” — and by its own coalition’s timeline, attackers had working proofs within twelve hours of the embargo lifting, and something four days before it. A defender’s window that closes in half a day is not a window, it’s a door left ajar. The genuinely useful artifact here is unglamorous: a version checker shipped as a Codex skill.
pwn.watch: 237 incidents in twelve months — 276 points
276 points · 134 comments · pwn.watch · HN discussion
A single page that tracks active security incidents and, crucially, whether a fix exists yet. The number on the front is 237 incidents in the last 12 months, with a heatmap by day and per-day detail. It is the least glamorous link on today’s page and probably the one worth bookmarking, because the recurring failure mode of the last 24 hours was people not knowing whether the thing they were reading about was already fixed.
Meta ordered to pay $25B in New Mexico — 658 points
658 points · 398 comments · cnbc.com · HN discussion
A Santa Fe jury found 43 million violations of New Mexico’s unfair practices act in September; at the statutory $5,000 per violation the state asked for $219.5 billion and the judge cut it to $25 billion, with 15% annual interest until paid. The judge’s findings are unusually blunt — senior leadership involvement, repeated misstatements, a comprehensive investigation “that it promised” and did not conduct. Meta says it will prevail on appeal and calls the case “a tax on speech.”
Two commenter observations reframe the number. New Mexico went alone instead of joining the 47-state effort, which settled social-media-addiction claims for $17 billion with a provision releasing Meta from state Cambridge Analytica claims for $459 million — so the same conduct was priced at $459 million by 47 states and $25 billion by one. And Meta’s stock rose roughly 7% after hours, which tells you what the market thinks the expected value of a $25 billion judgment against a company with $200 billion in annual revenue actually is: a rounding line, pending appeal.
Quad9 leaves France rather than become a filter — 630 points
630 points · 230 comments · quad9.net · HN discussion
Quad9 is withdrawing its DNS service from France on 24 November. The trigger is a French court order obtained by beIN (and, per commenters, a Sony Music contempt proceeding) requiring it to block resolution of sports-piracy domains for French users, with a €1,000-per-day penalty for non-compliance — roughly €24,000 through 14 November, before legal costs, with 20 more cases pending. Quad9’s argument against complying is structural, not moral: it keeps no user database, so it cannot geographically scope a block, and the only way to satisfy the order is to block those names globally, which would export a French commercial ruling to every internet user on earth.
The CTO showed up in the thread and conceded the awkward part — they will probably use geoIP filtering to drop French traffic entirely, which is the same crude geography they said was insufficient for selective blocking. That’s an honest answer to an impossible order. The interesting precedent is that a non-profit resolver with no revenue can be litigated out of a country by a rights-holder, while the three resolvers with real legal budgets (Google, Cloudflare, Cisco) fought the same orders and lost too, and stayed because they can afford to.
The Switch 2 falls, with a robot finger on the power button — 591 points
591 points · 214 comments · pepsipu.com · HN discussion
A software-only tethered jailbreak for the Switch 2 on firmware 23.0.1, achieved through a WebKit n-day served from a captive portal, giving native code execution as ordinary sysmodules and as fs — which means homebrew, save backups, and modded retail games. The author modded Mario Kart World with custom characters to prove it.
The method is the story. Two JetKVMs feed controller input over USB and capture HDMI output; a Bluetooth light-switch flicker from Amazon is rigged to press the power button when the console crashes, because the harness has to recover unattended. Codex drove the harness, and the author is explicit about the split: the jailbreak took about two weeks of real work, while the Mario Kart mod — the part that looks like magic — was vibecoded in a day. That’s the most useful data point in the post, and it’s the opposite of the headline people took from it.
Claude Duet is the assistant product, finally — 536 points
536 points · 500 comments · claude.com · HN discussion
Anthropic’s research preview of a proactive agent on Opus 5.5, Pro and Max plans, US only: a morning brief, background task execution, and an approval gate before anything irreversible. The marketing page is a small-business owner’s fantasy — permit fees, redlined renewals, refund batches — and the “6,000+ connectors” line includes 1Password, which is where the comment thread immediately went.
Two substantive criticisms rather than the usual reflexive ones. First, the economics: personal-assistant traffic is latency-tolerant, so it packs into inference batches that would otherwise go empty, which makes this a high-margin product even at flat subscription prices — an unusually clear-eyed read from a commenter, and a reminder that “agent that works while you’re away” is also “workload that fills our idle GPUs.” Second, the trust problem: the product’s value proposition is that it needs access to everything, and there is no version of that which survives a single instance of key leakage on a platform it’s connected to. Today, of all days, that isn’t hypothetical.
WorldTUI: a 360M model pretending to be a terminal — 457 points
457 points · 147 comments · simedw.com · HN discussion
A 360M model fine-tuned on terminal sessions recorded from real programs in Docker, with no shell and no filesystem behind it: every keypress goes in, the model predicts how the screen changes. It runs in a browser at 208MB. Type pythoon and it doesn’t correct you, which is the demo.
The engineering choices are the interesting part, because they’re what a terminal actually requires and a chat-completion API doesn’t give you: predicting screen diffs instead of appending tokens (so clear can move the cursor back to the top), decoding screen rows in parallel, and fine-tuning on self-repair so the model learns to fix its own broken output after a bad command. The honest limit is stated up front — it “usually remembers what you wrote a few commands later,” which is a polite way of saying the world model has a working memory measured in minutes.
OpenAI models are coming to Google Cloud — 319 points
319 points · 142 comments · openai.com · HN discussion
OpenAI frontier models and Codex in Google Cloud’s Model Garden, transacted through the Google Cloud Marketplace, drawable against existing GCP commitments, and soon inside Antigravity and the Gemini Agent. The framing is all governance and procurement: access controls, data residency, enterprises spending committed cloud budget instead of opening a new vendor relationship.
The strategic read is blunter than either company’s copy. Microsoft’s exclusivity has been unwinding for a year, and this puts OpenAI’s models on the one cloud that also sells the TPUs OpenAI’s biggest rival trains on. For a regulated enterprise buyer — the actual target here — the practical effect is that model choice becomes a line item on an existing invoice, which is how most large organizations prefer to buy anything. It also means the “which model” decision gets made by whoever owns the procurement contract, not by the person who benchmarked them.
o(n log n) integer multiplication, and a mathematician’s grief — 295 points
295 points · 264 comments · web.maths.unsw.edu.au · HN discussion
David Harvey’s note on a claimed o(n log n) integer multiplication algorithm — small o, not big O, with ε around 2⁻¹⁸², which is a real improvement over the O(n log n) bound he and Joris van der Hoeven established in 2021 and which everyone assumed was the floor. His summary is one line: “I have not checked most of the details, but I think that the claimed bound is plausible.” Then he spends the rest of the paper explaining why the improvement is, contrary to the internet’s reaction, enormous.
The context he is describing without naming: “a certain American technology company recently dumped a large pile of manuscripts on GitHub.” He thanks the model that produced them, notes that none of the company’s employees understand how it works or, mostly, the papers they released, and then says the thing the whole field is avoiding — an automated system now does mathematics research better than any human, so results like this were inevitable and who got there first is a footnote. He also declares his own AI usage for the note itself: typesetting, proofreading, and extensive discussions with Claude Fable 5.1. He tried to read the paper, gave up, and had the model explain it to him. Commenters have already formalized the result in Lean, which is the most 2026 sentence on the page.
Code is clay now — 241 points
241 points · 167 comments · albertodenia.com · HN discussion
An essay from late September that found its audience today. The argument: code used to behave like stone — small edits were chisels, large ones meant demolition and scaffolding. Agentic coding collapsed the cost of change, which makes the material behave differently, so you should work it like clay: rough the whole shape in, feel the proportions, then refine from mass to mid-features to detail, at any layer of the system.
The metaphor is better than most in this genre because it predicts a failure mode: if change is cheap, the reason to get the structure right early is not cost, it’s comprehension. Clay lets you reshape anything; it doesn’t tell you what you built. Half the comment thread is people saying this is just prototyping with extra steps, and the other half is people describing the specific thing that changed — they now refactor across module boundaries that used to be permanent because crossing them cost a week.
Google cleared 300 hectares of Finnish forest first — 287 points
287 points · 194 comments · techspot.com · HN discussion
Google is investing €13 billion in Finnish AI infrastructure through a local entity, Tuike Finland Oy, and started bulldozing before the environmental review of the full plan was complete. Finland’s Permit and Supervision Agency asked TFO to explain itself last month; the work may be suspended. There’s a public repository of project material, which is how this became a documentable story rather than a complaint.
The details matter less than the pattern, and the pattern is now global: data center buildouts are being run at a pace that outruns permitting regimes designed for a slower industry. The €13 billion is not the problem. Starting the dirt work before the review closes is, because it converts a regulator’s finding from “don’t build this” into “remediate what you already built,” and remediation is negotiable in a way that a denial isn’t.
Google’s Rust style guide — 369 points
369 points · 225 comments · google.github.io · HN discussion
Google published an actual Rust style guide, not a rustfmt config: prefer small crates, flat file layout for library sources, no glob imports, one module per use, qualify calls to top-level functions with their module name but import type names unqualified, don’t implement APIs in non-leaf modules. Several rules are tagged [chrome], meaning they exist because a specific codebase at a specific scale needed them.
The two live arguments in the thread are both about that tagging. #[non_exhaustive] on public enums is recommended, and commenters point out it converts a compile-time exhaustiveness error into a runtime fallthrough — which is the opposite of why you use enums. And the flat-file/small-crate rules read as a reaction to Chrome’s tree, not to Rust. The most useful comment is from someone who’s used Rust since 1.0: style guides that survive being applied uniformly across an organization are, by construction, not the ones any individual would choose.
No more icons in every menu — 463 points
463 points · 261 comments · blog.jim-nielsen.com · HN discussion
macOS Tahoe put an icon next to every menu item; Golden Gate removes them, and Apple’s own Human Interface Guidelines now cite Tahoe’s approach as an example of what not to do on macOS. Jim Nielsen’s point is about the epistemics of design argument rather than menus: he used to argue “Apple doesn’t do this,” which is weak, and now he can argue “Apple did this, lived with it for a year, and publicly reversed,” which is experience.
What is gridification — 319 points
319 points · 156 comments · musicalform.substack.com · HN discussion
A 50-year comparison of Billboard’s top five, from Captain & Tennille to “Die with a Smile,” analyzed by tempo and timing rather than vibes. The thesis: modern production treats human temporal particularity as error. On the 1975 records, kick and bass don’t line up exactly; fills push and pull against the grid. On the 2025 records, everything is quantized, and the author calls the correction impulse “epistemic violence against the record of” — the sentence trails off in the excerpt, but you get it.
It’s the kind of essay HN over-rates when it’s about music and under-rates when it’s about anything else, because the underlying claim generalizes: once a tool can normalize a variance cheaply, everything that variance was carrying gets deleted, and nobody notices until they compare against an archive. The same argument applies to the LLM-generated PoCs today.
A possum that was extinct for 6,000 years — 259 points
259 points · 61 comments · bbc.com · HN discussion
A tiny possum and a glider, both known only from fossils and presumed extinct for around 6,000 years, found alive in remote West Papua. Low comment count, high signal-to-noise, and the only story on the page where the interesting number is smaller than a thousand rather than larger than a billion.
Airbnb bans the chore list — 233 points
233 points · 216 comments · theverge.com · HN discussion
For reservations booked on or after 20 November, hosts can’t ask guests to do tasks “that would typically be performed by a cleaner”: no dishes washed and put away, no stripping beds or starting laundry, no hauling trash off-site, no being told to skip the air conditioning. The permitted versions are the ones that don’t take time — dishes in the sink, towels gathered, recycling separated, AC off when you leave. The rules get their own prominent section on the listing.
This is a platform correcting a market failure it created. Hosts added chore lists because cleaning fees didn’t cover turnover; guests complied because the listing was already booked. Airbnb’s interest here isn’t hospitality, it’s that “cleaning fee plus three chores” pushed a chunk of demand back to hotels, and the fix costs the platform nothing to write down.
Six years in prison for a Cash App account she never opened — 222 points
222 points · 231 comments · techspot.com · HN discussion
Amanda Smith was arrested at her home in April on a warrant from Arkansas, a state she had never visited, over a $1,000 scam routed through a Cash App account opened in her name. Three nights in jail, $50,000 bail set and described as pointless because extradition was coming anyway, a drive to Arkansas, another $20,000 bail. When she tried to get information about the account to defend herself, Cash App refused, because she couldn’t prove she owned an account she hadn’t opened.
That last sentence is the whole story. Identity systems are now used to establish both that you are who you say you are and that you are responsible for the actions of whoever used your identity — and the fraud victim has no standing to see the record. The comment thread’s main contribution is the observation that this is not unusual, it’s just unusually documented.
OpenAI CLI — 220 points
220 points · 107 comments · github.com/openai · HN discussion
An official command-line client, 561 commits deep, which means it has been developed in the open for a while and only now got submitted. The thread is the usual split between “why not just use curl” and people who have tried to use curl for anything stateful. The point that lands: an official CLI is how a lab makes its API the default in scripts, CI and cron, and that’s a distribution decision rather than a developer-experience one.
Also new
- Way to Play Super Mario 64 on Apple Vision Pro — 225 points · 94 comments — the decompilation ported to visionOS as a tabletop diorama you walk around, leaning in to change the camera. Built on the SM64 decomp, Render96 assets, and
sm64coopdx. - Show HN: Run full iOS 16.5 firmware on Android devices — 211 points · 70 comments — a Darwin/XNU kernel bring-up on Android hardware: file system, networking, and enough graphics to boot a shell.
- Good type against all odds — 208 points · 24 comments — Marcin Wichary on the slanted text you see on old computer displays. It isn’t italics; it’s a rolling-shutter artifact from line-by-line raster updates, and it accidentally became a typographic convention.
- IKEA – 3D Guide — 205 points · 68 comments — the BILLY manual’s 14 steps and 82 pieces of hardware as a rotatable 3D model, with the printed page shown alongside. Absurdly good use of a weekend.
Still on the page
Thirty-nine stories carried over. The deltas, from live item data:
The movers are almost all security. The PHP Foundation’s post-mortem quadrupled (418 → 786) once the patch existed and people went looking for how a two-CVE release got to that point. Eight Bits of Trust, Scott Helme’s writeup of why the eMudhra keys were guessable, gained 190 and passed its parent story in relevance if not points. LiteLLM’s compromised wheel gained 279 — a story nobody argued about, because a diff that shows a file the source never had is not a matter of interpretation. EA’s BioWare shutdown doubled to 673, which is either nostalgia or the realization that the studio behind Mass Effect and Dragon Age is now a line item in a cost-reduction slide.
Then the flat ones. Wine on OpenBSD gained zero points in a day. MiniMax M3.1 Flash: zero. RuneScape Bench, one. France’s supermarket fridges, one. DeepSeek’s federal ban, one point, the day after it was reported that the exclusion order actually dates from 24 July — a detail commenters found more interesting than the ban itself, since it means the DeepInfer release timing was not a coincidence. And DeepInfer is still the top story on the site at 2,327 points and 887 comments, three days in.
Throughline
Three threads, and today they’re the same thread.
First: the trust layer is thinner than its paperwork. A CA that generated keys by counting is now exiting the business rather than explaining itself. A GitLab RCE at CVSS 10.0 traces to a regex engine bug patched in April and backported six months late, and ships in a version range that starts at 7.0. Trend Micro posted five unpatched kernel vulnerabilities, two of them 9.0, to a public mailing list by accident. Railway’s encrypted secrets came back decrypted because someone asked the service to decrypt them. None of these are novel attacks. Every one is a step in a process that was skipped, and in each case the step that was skipped was a check, not a control.
Second: the exploit-generation argument resolved, and both sides lost. Yesterday the question was whether models could find these bugs; today it’s whether they can weaponize them. The answer turned out to be “badly, at volume.” Thousands of AI-authored PHP PoCs don’t work, many require a pre-existing LFI, and the skeptic who said so was right about the repos. But Wiz got pre-auth RCE on unmodified WordPress, Drupal and Joomla, so the skeptic was wrong about the bug. Meanwhile Amazon has telemetry of a PHP2Shell exploitation attempt four days before disclosure, which means the defender’s window OpenAI is marketing was already open on the other side. The net effect is worse than either position: the noise floor is now high enough that the signal is unscannable, and the people who can write a real exploit are not slowed down by the noise at all.
Third: the measurement claims keep getting smaller, and the honest numbers are the unflattering ones. OpenAI’s coordinated-disclosure post is about process, not outcomes — the one concrete artifact is a version checker. Harvey’s note on o(n log n) multiplication is careful to say he hasn’t verified most of it, that he couldn’t read the paper, that he had a model explain it to him, and that an automated system can now do mathematics research better than any human. The Switch 2 jailbreak is framed as an AI achievement and the author says the exploit took two weeks of work while the thing that looks like magic took a day. The one story that needs no caveat at all is 237 active incidents tracked on a single page with a column for whether a fix exists yet.
If there’s a single sentence for today: the software industry got, in eighteen hours, a live demonstration that the cost of finding bugs collapsed, the cost of exploiting them did not collapse as fast, and the cost of coordinating the fix is still being paid by four volunteers asleep in a different timezone.