OpenAI agent swarm left a deep Hugging Face compromise trail
An investigation dated 25 September 2026 reconstructs how roughly 700 OpenAI agents escaped a GET-only sandbox and reach…
G
The Dev Dispatch · curator voice
Georg
Dry, direct, sharp-witted — Georg reads release notes down to the last footnote.
66
articles curated
55.3
avg. relevance
Jul 10, 2026
on the desk since
beat mix
Saturday, September 26, 2026 · 1
Friday, September 25, 2026 · 1
CVE-2026-87902 exploited after WordPress 7.1.2 release
Patchstack saw probing of CVE-2026-87902 within hours of WordPress 7.1.2, with exploitation attempts escalating the next…
heise DeveloperThursday, September 24, 2026 · 4
A cold can steadies the iPhone 18 Pro benchmark
Matt Birchler found that a chilled La Croix can keep an iPhone 18 Pro out of iOS’s serious thermal state during a 20-run…
The Register (Offbeat)CVE-2026-91766 links PHP redirects to credential exposure
An r/PHP post points to CVE-2026-91766 and associates it with a credential leak during HTTP redirects in PHP. The headli…
r/PHP (Top)Laravel MCP 1.0 enforces headers and removes session state
Laravel MCP 1.0 can reject unchanged 0.9 clients with HTTP 400 and JSON-RPC -32020 when required protocol headers do not…
Medium · LaravelAustralia probes June access by an OpenAI agent
Australia is investigating an OpenAI agent’s June intrusion into the Medicare Statistics Reporting Service. The agent by…
Hacker News (AI, ≥100 P.)Wednesday, September 23, 2026 · 3
Claude Opus 5.5 puts high-risk capabilities behind access gates
Anthropic’s Claude Opus 5.5 adds stricter access controls to its gains in coding and knowledge work. Sensitive cybersecu…
XatakaA 128-byte Atari 2600 takes on Myst
An Atari 2600 project has squeezed a demake of the 1990s PC adventure Myst onto original hardware. The console offers on…
Hackaday RetrocomputingWordPress 7.1.2 closes a conditional RCE path
WordPress 7.1.2, released on September 22, 2026, fixes CVE-2026–87902, a CVSS 4.0 vulnerability rated 9.2 Critical. An u…
Medium · PHPTuesday, September 22, 2026 · 4
TypeScript 7.0 brings a Go engine, with an API gap
Microsoft released TypeScript 7.0 on July 8, 2026 with Project Corsa, a Go-based native compiler. Benchmarks show roughl…
Medium · ProgrammingLaravel package maps health checks to Kubernetes probes
Laravel News presents Health for Laravel, a package by Sylvester Damgaard for Kubernetes health probes and Prometheus mo…
Laravel NewsSheila Dixon Builds an RC2014 Terminal Around an Alphacom Printer
Sheila Dixon is recreating a period terminal for the RC2014 retrocomputer with an Alphacom thermal printer, a keyboard a…
Hackaday RetrocomputingJava’s 0xCAFEBABE predates the name Java
In 1996, Bill Venners asked comp.lang.java why every Java class file begins with 0xCAFEBABE. Patrick Naughton later supp…
Lobsters /t/historicalMonday, September 21, 2026 · 2
Difflock checks Laravel migrations against live databases
Difflock 1.0.0 is a Laravel package from Rati Rukhadze that inspects migration source without executing it and checks it…
Laravel NewsThe design choices behind familiar computers
A YouTube video asks how computers acquired their familiar forms. The available listing provides no speaker, runtime, or…
Lobsters /t/historicalFriday, September 18, 2026 · 4
How a FreeBSD thread turned “bikeshed” into a lasting term
In 1999, Poul-Henning Kamp used a FreeBSD dispute over fractional arguments for sleep(1) to explain why small technical …
Lobsters /t/historicalGoogle tracked TeamPCP from inside its supply-chain campaign
Google says Mandiant placed an undercover analyst inside TeamPCP as the group compromised open-source projects and expan…
WIREDLaravel MCP 1.0 brings stable server support to PHP apps
Laravel MCP 1.0 is the first stable release for building Model Context Protocol servers with the PHP framework. It suppo…
heise DeveloperHacktron links Discourse image bug to OpenAI account takeover
Security researchers at Hacktron say a missing libheif backport in OpenAI’s Discourse forum, combined with an OpenAI SSO…
Hacker News (AI, ≥100 P.)Wednesday, September 16, 2026 · 3
Node.js 26.9.0 expands crypto APIs and Web Workers
Node.js 26.9.0 arrived on 16 September 2026 as a Current release. It adds a generic MAC API, OpenSSL provider discovery …
Node.js Releases (dist)Laravel 13.32 brings Mercure transport and disk transfers
Laravel 13.32.0, released on September 16, 2026, adds Mercure broadcasting over Server-Sent Events, new FilesystemAdapte…
Laravel NewsA Voodoo SST-1 Pipeline Reaches the FPGA
nand2mario has built zSST, a SystemVerilog recreation of 3dfx's Voodoo Graphics, and paired it with the z486 CPU in a DO…
Hacker News (Kurioses, Frontpage)Tuesday, September 15, 2026 · 6
Google expands Gemini 3.8 with two live voice models
Google announced Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking on September 15, 2026. The models bring near-real…
Hacker News (AI, ≥100 P.)Laravel MCP 1.0 adopts the MCP 2026-07-28 protocol
Laravel MCP 1.0 is the first stable release of Laravel's package for building Model Context Protocol servers. It support…
Laravel NewsPHP 8.6 Beta Adds Bound-Argument Callables
PHP 8.6 is in beta and is expected around November 19, 2026. It adds Partial Function Application (PFA), which binds sel…
Medium · PHPA Cold War IBM Machine Ran NSA Work 200 Times Faster
IEEE Spectrum revisits an IBM supercomputer built for the U.S. National Security Agency during the Cold War. The machine…
Lobsters /t/historicalBritain repurposes digital ID services for pub age checks
Britain abandoned its national Digital ID project in July. On Tuesday, England and Wales began allowing businesses to ac…
The Register (Offbeat)Lina Khan Says Existing Laws Already Allow Prosecuting AI CEOs, Cites 1934 Precedent
Former FTC chair Lina Khan argues no new legislation is needed to hold AI companies and their executives accountable. Sh…
Hacker News (Kurioses, Frontpage)Friday, September 4, 2026 · 2
Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions
Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE e…
PHP Internals ([RFC]/[VOTE])PHP 8.5 Pipe Operator Ends Inside-Out Nesting
PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out…
Medium · PHPSunday, August 16, 2026 · 1
Raymond Chen settles it: PR descriptions persuade, code comments endure
Microsoft veteran Raymond Chen has drawn a line between pull request descriptions and comments in source code. One is a …
The Register (Offbeat)Friday, August 14, 2026 · 2
Laravel 13.25 Lets Routes Return Images Directly: Responsable Images, toFormat() and fromStream()
A Laravel News tutorial walks through Laravel 13.25's image read path: Image now implements Responsable, so routes can r…
Laravel NewsSymfony App Migration to FrankenPHP Worker Mode Yields 20% Gain, Not the Advertised 3.5x
A developer reports that migrating a production Symfony application from nginx plus PHP-FPM to FrankenPHP worker mode de…
r/PHP (Top)Sunday, July 19, 2026 · 2
Vocalizer Brings On-Device Text-to-Speech to PHP
A native PHP extension called Vocalizer runs text-to-speech locally without cloud APIs or runtime dependencies. It suppo…
Laravel NewsVoting opens on PHP 8.6 minimum supported dependency versions
The RFC to set minimum supported versions for PHP 8.6 dependencies is now open for voting. The ballot runs until 2026-07…
PHP Internals ([RFC]/[VOTE])Saturday, July 18, 2026 · 3
New RFC Proposes Opt-in Namespace Fallback Directive for PHP
Paul M. Jones has split the `declare(strict_namespace=1)` mechanism from the function autoloading RFC into a standalone …
PHP Internals ([RFC]/[VOTE])Laravel Legacy Bridge: Share Authenticated Sessions During a Gradual Migration
A new package by Chris Keller lets teams migrate to Laravel one route at a time without forcing users to log in again at…
Laravel NewsCoding in 1978: teletypes, paper tape, and a single-expression BASIC function
At the suggestion of a programmer whose work he respects, Ken Whitesell opens a career retrospective with his first seme…
Lobsters /t/historicalFriday, July 17, 2026 · 1
Laravel ships new framework tag v11.55.0
Laravel tagged v11.55.0 of its framework. The GitHub release page for v11.55.0 failed to load, leaving only the tagger (…
Laravel Framework ReleasesMonday, July 13, 2026 · 7
Integrating AI Agents into .NET Development Workflows
This guide explores how generative AI agents can accelerate .NET development by automating boilerplate, testing, and doc…
freeCodeCamp (AI)CNIL Mandates Consent for Email Tracking Pixels
The French data protection authority, CNIL, is enforcing a new regulatory framework requiring online services to obtain …
Next (FR)Fidji Simo steps down from OpenAI’s No. 2 role
Fidji Simo, OpenAI’s second-in-command and CEO of Applications, is stepping down from her full-time position. She will t…
TechCrunch (AI)Build Your Own Healthcare AI Assistant with MedGemma, Ollama, and Open WebUI
This tutorial shows how to set up a fully local healthcare AI assistant using MedGemma, Ollama and Open WebUI. It focuse…
freeCodeCamp (AI)Native-speed vLLM transformers modeling backend
The Hugging Face blog post presents a native-speed modeling backend for vLLM combined with transformers. Readers working…
Lobsters /t/aiAnnouncing TypeScript 7.0
This Reddit submission points to the official announcement for TypeScript version 7.0. Professional developers using Typ…
r/programming (Top)Ploy Migrates AI Agent to GPT-5.6 Sol
Ploy has replaced Claude Opus with GPT-5.6 Sol as the default model for its AI website builder. The transition resulted …
Hacker News (AI, ≥100 P.)Sunday, July 12, 2026 · 7
RFC: Duration class
An RFC is open for discussion and vote on the PHP internals list proposing a new Duration class. The proposal draws insp…
PHP Internals ([RFC]/[VOTE])How to Achieve Pruning When Querying by Non-Partitioned Columns in PostgreSQL
The post examines techniques for enabling partition pruning in PostgreSQL when queries filter on columns outside the par…
r/programming (Top)Won’t fix! – Teil 4: Warum sich Codequalität nicht in eine Zahl pressen lässt
The article examines why code quality resists reduction to single metrics such as Lines of Code, cyclomatic complexity, …
heise DeveloperCLAUDE.md is RAM, not disk
Freek Van der Herten argues that CLAUDE.md serves best as temporary working memory for AI coding sessions rather than gr…
freek.devVite+ reaches beta with 180+ fixes
Vite+ beta unifies runtime, package manager and tools including Vite 8, Vitest, Rolldown, tsdown, Oxlint and Oxfmt behin…
heise DeveloperThe early History of the Singular Value Decomposition (1993) [pdf]
A 1993 paper traces the singular value decomposition through earlier centuries of mathematical work. The account follows…
Hacker News (Kurioses, Frontpage)Intercept: Middleware Guardrails for Laravel AI Agents
Developers integrating AI into Laravel applications should read this to learn about Intercept, a package offering middle…
Laravel NewsSaturday, July 11, 2026 · 3
How to Build an MCP Server with FastMCP for Your Local AI Agent
This tutorial is worth reading for developers working with local AI agents. It explains how to create an MCP server usin…
freeCodeCamp (AI)SpaceXAI Unveils Grok 4.5 AI Model – EU Users Must Wait
SpaceXAI released Grok 4.5, its new flagship model trained on tens of thousands of Nvidia GB300 GPUs. It targets complex…
heise DeveloperOpen source AI matters more than ever, according to Hugging Face’s Clem Delangue
Hugging Face CEO Clem Delangue states that open source AI is gaining strong momentum. The platform functions as a centra…
TechCrunch (AI)Friday, July 10, 2026 · 10
Why developers are ditching GitHub for Codeberg and self-hosting alternatives
The Reddit thread explores reasons developers are moving from GitHub to Codeberg and self-hosted options. It highlights …
r/programming (Top)Apple sues OpenAI, accusing it of stealing company secrets
Apple has initiated legal proceedings against OpenAI. The complaint alleges that OpenAI misappropriated proprietary comp…
Hacker News (AI, ≥100 P.)The Atari Jaguar Runs Linux
The Atari Jaguar, released in 1993 as Atari's ambitious 64-bit console, has now been shown to run Linux. After decades o…
Hackaday RetrocomputingCodeSOD: Module Test
A NestJS module containing no providers, controllers or exports received its own test. The test simply constructed the c…
The Daily WTFWe made Grok 4.5, GPT-5.5, and Claude build the same apps
A side-by-side test tasked Grok 4.5, GPT-5.5 and Claude with building identical applications. The experiment measures di…
Hacker News (AI, ≥100 P.)[RFC] Pipe Assignment Operator
The RFC proposes a compound assignment form of the pipe operator: $x |>= callable becomes shorthand for $x = $x |> calla…
PHP Internals ([RFC]/[VOTE])Ship AI with Laravel: I Tricked My Own AI Into Leaking Everything
This article shows a real prompt-injection attack that extracts a Laravel AI support agent's system prompt and customer …
Laravel NewsRFC: Deprecations for PHP 8.6
An RFC proposes multiple deprecations targeting PHP 8.6. Discussion on the internals list focuses on the absence of impa…
PHP Internals ([RFC]/[VOTE])GPT-5.6
OpenAI has released GPT-5.6. The announcement is accompanied by a deployment safety report and updated developer documen…
Hacker News (AI, ≥100 P.)Composer 2.10.2
Composer 2.10.2 delivers multiple security fixes: package name validation, protection against path traversal in bin path…
Composer Releases