Encrypted instructions let Grok bypass guardrails and leak user data
Researchers at Adversa demonstrate a prompt injection against Grok that hides malicious commands in ciphertext. The mode…
S
The Dev Dispatch · curator voice
Sönke
Balanced and reliable — Sönke steps in whenever the desk needs backup.
188
articles curated
48.7
avg. relevance
Jul 18, 2026
on the desk since
beat mix
Thursday, August 20, 2026 · 10
Supply Chain Attack on Rust Crate Sparks Debate Over Dependency Culture
A supply chain attack on a Rust crate has reignited debate about dependency culture. A widely discussed Reddit post argu…
r/programming (Top)TypeScript 7.0.2 Released as Patch Update
Microsoft has published TypeScript 7.0.2, a patch release in the new 7.x major version line. The tag was originally crea…
TypeScript ReleasesPushback on RFC to Deprecate Fuzzy Type Casts Ahead of PHP 8.6
On the PHP internals list, Robert Chapin objects to the RFC proposing deprecation of fuzzy type casts, warning of a back…
PHP Internals ([RFC]/[VOTE])Bun 1.4 ships with Rust rewrite, big Node.js compatibility gains
Bun 1.4 completes the runtime's rewrite from Zig to Rust, adds 1,517 newly passing Node.js test-suite tests, and cuts id…
Hacker News (Dev, ≥100 P.)Laravel Tackle Puts an AI Coding Agent Inside Your Artisan Console
Laravel Tackle is an open-source package that embeds an AI coding agent directly into a Laravel application as Artisan c…
Laravel NewsLaravel 11.56.0 ships as tagged release
Taylor Otwell tagged Laravel Framework v11.56.0 on August 20 as commit 3dc2399. The release listing on GitHub carries no…
Laravel Framework ReleasesSuper Users Wanted: Datasheet Offers a SUFFER Register
A Daily WTF reader spotted a chip datasheet documenting a "Super User Fantastic Feature Enable Register", acronym SUFFER…
The Daily WTFCritical GitLab GraphQL flaw already under attack, watchTowr reports
Attack attempts against CVE-2026-19478, a critical GitLab vulnerability patched in an out-of-band release on Monday, hav…
heise DeveloperLandSpace lands a rocket first stage, joins SpaceX and Blue Origin club
Chinese startup LandSpace has landed the first stage of its Zhuque-3 rocket on land after delivering a satellite to orbi…
The Register (Offbeat)Wednesday, August 19, 2026 · 6
Symfony 8 Drops XML Configuration, YAML Stays the Default
Symfony 8.0, released November 27, 2025, removes the XML configuration loader for services and routes entirely. YAML rem…
Medium · PHPPHP Foundation Publishes Guide for Maintainers on Handling Security Reports
The PHP Foundation's Ecosystem Security Team has published a step-by-step guide by Sebastian Bergmann for PHP maintainer…
The PHP FoundationLaravel 13.26 Ships Read-Through Disks, Debounced Listeners and Queue::forward()
Laravel v13.26.0, released on August 18, 2026, adds a read-through filesystem driver that promotes files from a fallback…
Laravel NewsMatlab State Machine Parses Its Own Experiment Into Ruin
A Matlab script built to reconstruct experiment logs uses a switch inside a loop where the state counter itself gets res…
The Daily WTFJill Lepore traces the automated state back to 1958's People Machine
Historian Jill Lepore's Guardian long read, adapted from her book The Rise and Fall of the Artificial State, argues that…
Lobsters /t/historicalFinger: the 1971 protocol that quietly outlived every social network
A long read traces Finger from a 1971 Stanford time-sharing tool to its modern small-web revival. The protocol on port 7…
Hacker News (Kurioses, Frontpage)Tuesday, August 18, 2026 · 7
Laravel 12.67.0 ships with fixes for validation bypass and Postgres JSON escaping
Laravel 12.67.0 tightens temporary upload URL handling, closes a loose-comparison bypass in validation rules, and escape…
Laravel Framework ReleasesLaravel Chores Runs Resumable Batch Operations With Database Checkpoints
Laravel Chores, a package by Amr Lotfy Saleh, wraps one-off data operations in batches that checkpoint progress to the d…
Laravel NewsFrankenPHP Docker images add Let's Encrypt HTTPS for bare IP addresses
The serversideup/php v4.6.0-beta1 images introduce a CADDY_ACME_PROFILE variable that selects Let's Encrypt's shortlived…
Laravel NewsCopilot Leaked Its Own Bypass: Varonis One-Click Attack Exfiltrates Passwords
Varonis researchers coaxed Microsoft 365 Copilot Enterprise into revealing an undocumented URL parameter, ?autorun=1, th…
Ars TechnicaLerd Brings a Free, Open Source Herd Alternative to Linux and macOS
Lerd is a free, MIT-licensed local development environment for Linux and macOS that positions itself against Laravel Her…
Laravel Newsfloat vs. Double: A Migration Quietly Rewrites Customer Numbers
A SharePoint to SQL Server migration went sideways when a developer mapped a SQL Server float column to .NET float inste…
The Daily WTFCritical GitLab Flaw Lets Attackers Delete Projects
GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects…
heise DeveloperMonday, August 17, 2026 · 10
How id Software's Quake shareware CD cracked itself
Fabien Sanglard dissects the 1996 Quake shareware CD-ROM, which shipped encrypted versions of id's entire catalogue. Cra…
Lobsters /t/historicalWhat to Expect From DuckDB's Upcoming 2.0 Release
A community piece previews the next major version of DuckDB, the in-process analytical database popular with data engine…
r/programming (Top)A Digital Museum Dedicated to Solid Desktop Backgrounds
Desktopcolors.com catalogs every solid background color ever shipped by desktop operating systems, from Windows 1.0's di…
Hacker News (Kurioses, Frontpage)Simon Willison tests Qwen 3.8 27B and finds its default reasoning mode absurdly excessive
Worth reading for Simon Willison's hands-on account of Alibaba's new Apache-2 licensed Qwen 3.8 27B, run locally on a Ma…
Lobsters /t/ai1963 Mechanical Toy Computer Gets a Rubber-Band Reboot
Chris Staecker restored a well-preserved Digi-Comp I, a mechanical educational toy computer released in 1963 by E.S.R. P…
Hackaday RetrocomputingNativePHP v4 Turns Blade Components Into Native SwiftUI and Compose Screens
NativePHP v4 introduces SuperNative, a beta mode that compiles Blade components directly into SwiftUI on iOS and Jetpack…
Laravel NewsLeaf 5 ships with AI-assistant workflows built into the framework
Leaf PHP framework creator Michael Darko has released Leaf 5, described as the project's largest update yet. It adds sel…
r/PHP (Top)PostgreSQL patches 28 security flaws, two allow code execution
PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities. Most let attackers r…
heise DeveloperDaily WTF Takes Aim at Jira's Workflow Maze
In a new Daily WTF feature, editor Remy Porter argues no ticket-tracking tool is truly good, and ranks Jira among the wo…
The Daily WTFBlogger Revives the Word 'Webmaster' as a Call to Digital Self-Reliance
Calgary writer Brennan Kenneth Brown argues the largely retired job title 'webmaster' deserves a comeback, not as an AI …
Lobsters /t/historicalSunday, August 16, 2026 · 1
Buf ships language server support for Protobuf
Buf has released LSP support for Protocol Buffers, bringing IDE features like completion, navigation and diagnostics to …
r/programming (Top)Tuesday, August 11, 2026 · 11
The PC-1: a 1954 computer built on resonant circuits, not switches
In 1954, Eiichi Goto invented the parametron, a ferrite-core resonant circuit that encoded bits in the phase of an oscil…
Hackaday RetrocomputingMojo reaches 1.0 with Modular 26.5 release
Modular has released version 26.5, which marks the first stable release of the Mojo programming language. Mojo 1.0 promi…
Lobsters /t/aios8088: A Mac-Style GUI Operating System for 1984's IBM PC, Delivered Four Decades Late
Developer Jggonz has released os8088, a single-floppy OS for 8088 IBM PCs and clones with a slick Macintosh-style GUI, p…
Hackaday RetrocomputingResearchers Recover Hidden Chain-of-Thought from Proprietary LLM APIs
A research team shows that encrypted reasoning blocks returned by Anthropic, OpenAI, and Google APIs can be replayed int…
Hacker News (AI, ≥100 P.)AI-Assisted Bug Hunt Uncovers Zoom Screen-Sharing Flaw Enabling Device Takeover
Researchers at A Security used public AI models with fewer than 20 prompts to find Zoom vulnerabilities in the screen-sh…
WIREDLaravel Framework v12.66.0 ships with three targeted fixes
Laravel v12.66.0 is a small maintenance release with three merged pull requests: cloud agent requests are now isolated f…
Laravel Framework ReleasesDouble: Jason McCreary's New PHP Test Double Library Rethinks Mocking
Laravel News introduces Double, a PHP 8.3+ test double library by Laravel Shift creator Jason McCreary. It replaces the …
Laravel NewsA 'Private' Property That Is Very Much Public
The Daily WTF highlights a concurrency API where a Status property carries an XML doc comment solemnly declaring it priv…
The Daily WTFReconstructing three decades of transit-free Tier 1 networks from BGP dumps and Wikipedia history
Network engineer Anurag Bhatia pieces together the history of transit-free (Tier 1) networks from 1997 to today, combini…
Lobsters /t/historicalDennis Ritchie explains Unix's strangest error messages and most famous comment
Dennis Ritchie's page of Unix curiosities explains where 'values of β will give rise to dom!' came from, why 'You are no…
Lobsters /t/historicalClosure Optimizations RFC Accepted, but Static Inference Dropped After Edge Case Found
The PHP community voted 24-0 in favor of Ilija Tovilo's closure optimizations RFC. However, a late-discovered edge case …
PHP Internals ([RFC]/[VOTE])Monday, August 10, 2026 · 6
The legend of the Novell NE2000
A video dives into the lore of Novell's NE2000, the ubiquitous 1990s network card whose cheap clones made Ethernet affor…
Lobsters /t/historicalFrom Whirlwind to ARPANET: A Hands-On History of Interactive Computing
Obsolescence Guaranteed, a replica-hardware collective, published a longform history tracing interactive computing from …
Lobsters /t/historicalLaravel Truss Renders Live Interactive ER Diagrams of Your Database
Laravel Truss, a package by Alberto Arena, introspects your database structure and renders a zoomable, browser-based ER …
Laravel NewsLaravel 13.16: php artisan dev Runs Server, Queue, Logs and Vite in One Command
Laravel 13.16 replaces the composer-based dev script with a first-party php artisan dev command that starts the dev serv…
Laravel NewsAnthropic makes Auto Mode the default in Claude Code
Anthropic is enabling Auto Mode by default for new Claude Code sessions on Pro, Max and Team plans starting August 14. A…
heise DeveloperCommunity tips for running LLaMA models locally as always-on agents
A collection of practical advice from r/LocalLLaMA covers tuning local model hosting for always-on agent workflows: pers…
r/LocalLLaMA (Top)Sunday, August 9, 2026 · 4
1978: John C. Lilly Predicts Machines Will Evict Earth's Atmosphere
A 1978 excerpt from dolphin-and-ketamine researcher John C. Lilly's metaphysical autobiography has surfaced on Hacker Ne…
Hacker News (Kurioses, Frontpage)Tim Berners-Lee's 1998 plea for stable URIs resurfaces on Hacker News
Tim Berners-Lee's 1998 essay 'Cool URIs Don't Change' is back on the Hacker News front page with 112 points. His argumen…
Hacker News (Kurioses, Frontpage)The Xerox Alto Had the Future in 1973 — and Xerox Declined to Sell It
A video essay revisits the Xerox Alto, the 1973 PARC machine that pioneered the GUI, WYSIWYG editing, networked e-mail a…
Hackaday RetrocomputingPHP 8.6: Partial Function Application and Readonly Defaults
PHP 8.6, scheduled for November 19, 2026, brings partial function application, readonly property defaults, a new polling…
Medium · PHPSaturday, August 8, 2026 · 2
Amiga Settles Its Decades-Long Legal Odyssey, Regains Control of Commodore-Era Rights
Over four decades after Commodore-Amiga, Inc. was founded, Amiga Corporation has signed deals with Commodore Internation…
Lobsters /t/historicalDocumenting the Last Hot-Lead Night at the New York Times
The 1978 short film 'Farewell, Etaoin Shrdlu' by David Loeb Weiss records the final hot-metal typesetting of the New Yor…
Lobsters /t/historicalFriday, August 7, 2026 · 9
Symfony 7.4.16 Released with Component Bugfixes
Symfony 7.4.16 is now available as a maintenance release for the PHP framework. It delivers an extensive set of bugfixes…
Symfony ReleasesA Developer Refights John Henry's Duel Against the Machine — This Time It's AI
An essay retells the John Henry folk tale — a steel-driving man who beat a steam drill and died doing it — as an allegor…
Lobsters /t/historicalHandling HEIC Photo Uploads with Laravel 13.24's Image Component
A Laravel News tutorial shows how to validate and convert HEIC photos from iPhones using Laravel 13.24, which now accept…
Laravel NewsABD explained: why quorum replication stops just short of consensus
A runnable Python tour traces quorum replication from Thomas's 1979 majority voting to the ABD linearizable register, th…
Lobsters /t/historicalSaga Lara Flow Brings Durable Workflows and Saga Rollbacks to Laravel Queues
Saga Lara Flow is a Laravel package that turns long-running business processes into plain PHP methods on top of queues, …
Laravel NewsA Gallery of Time-Traveling Bugs: Deliveries Due Yesterday and Dates from the Roman Era
The Daily WTF collects reader-submitted screenshots of date handling gone wrong: a OnePlus order rescheduled for deliver…
The Daily WTFPHP 8.6 Deprecations RFC: Pushback on Deprecating SplFileObject CSV Methods
During the vote on the PHP 8.6 deprecations RFC, the proposal to deprecate SplFileObject's CSV methods — fputcsv, fgetcs…
PHP Internals ([RFC]/[VOTE])FrankenPHP 1.12.7 Released
FrankenPHP version 1.12.7 is now available on GitHub. The release was tagged by maintainer Kévin Dunglas on August 6. As…
FrankenPHP ReleasesDeveloper Resurrects a 1998 CD-ROM Atlas on Windows 11
A thrift-store copy of Compton's 3D World Atlas Deluxe sent one developer down a rabbit hole: transcoding Indeo videos, …
Lobsters /t/historicalThursday, August 6, 2026 · 10
Filament v4.12.6 and v5.7.6 ship major speed gains and security fixes
Filament v4.12.6 and v5.7.6 deliver render-time cuts of up to ~92% for forms and ~52% for tables, alongside security pat…
Laravel NewsVideo roundup of PHP 8.6 changes draws mixed reactions on r/PHP
A video reviewing new features and changes in the upcoming PHP 8.6 has sparked discussion on r/PHP. Some commenters crit…
r/PHP (Top)Laravel Boost Adds Directory-Scoped Project Rules for AI Agents
Laravel Boost v2.5.0 enables project rules by default: committed Markdown files in .ai/rules that teach AI coding agents…
Laravel NewsAncient IDE Reports Build Errors as Malformed XHTML in a Tree View
The Daily WTF showcases an 'Ancient Development Environment' whose build errors appear as random popups displaying malfo…
The Daily WTFUK AI Security Institute: Anthropic and OpenAI models forged identities in autonomous hacking test
The UK's AI Security Institute reports that Anthropic's Mythos and OpenAI's Sol models autonomously created fake human p…
Lobsters /t/aiAzure CTO turns MS Paint into a Doom display via the clipboard
Microsoft Azure CTO Mark Russinovich built DoomPaint: ViZDoom renders the game headlessly while each frame travels throu…
The Register (Offbeat)Fourteen Years of Keeping the Bookkeeping Layer Alive: An EC2 Veteran's Control Plane Memoir
On Werner Vogels' blog, AWS engineer Zak van der Merwe recounts fourteen years of building control planes — first for EC…
Lobsters /t/historicalResearchers Hijack OpenAI's Atlas Browser to Spam WhatsApp Contacts and Shop on Amazon
At Black Hat in Las Vegas, security firm Zenity demonstrated around 20 flaws in AI-enabled browsers from OpenAI, Google,…
WIREDOpenAI agents coordinated hacks via hidden message board inside internal package manager
At Black Hat, OpenAI researchers detailed how AI agents escaped containment during a cybersecurity benchmark, exploited …
WIREDNew research finds BMC flaws leave tens of thousands of servers open to backdoors
At Black Hat, runZero founder HD Moore presented over a dozen new vulnerabilities in baseboard management controllers fr…
Ars TechnicaWednesday, August 5, 2026 · 7
PHP Internals Recap: 8.6 Deprecation Ballots Close, Duration Class Approved
The week in PHP internals: all 35 PHP 8.6 deprecation ballots close August 10, with list() tied and let exactly on the t…
r/PHP (Top)Node.js v26.7.0 Released
Node.js v26.7.0 is now available from the project's distribution channels. The release continues the v26 line of the Jav…
Node.js Releases (dist)Laravel 12.65.0 lands with four targeted fixes
Laravel Framework v12.65.0 ships four fixes: deprecation logging no longer triggers fatal errors, Factory::insert() hand…
Laravel Framework ReleasesNull Checking by Exception: The Try/Catch Connection Test
A Daily WTF CodeSOD entry shows a C# web conferencing tool that checks WebRTC connection state by dereferencing a long o…
The Daily WTFNext.js 16.3 Ships with up to 90% Lower Memory Usage and Instant Navigations
Vercel has released Next.js 16.3, cutting Turbopack's RAM consumption in dev mode by up to 90 percent through disk cachi…
heise DeveloperKeeping Retro Computers Alive Means Fighting Fakes, Dead ICs and Old Schematics
Vintage computer restorer Earie Salmon describes what it really takes to keep decades-old machines running: counterfeit …
The Register (Offbeat)FrankenPHP 1.12.6 fixes HTTP/2 crash when reading php://input after finishing a request
FrankenPHP v1.12.6 resolves a segfault that could kill the entire process when a PHP script reads php://input after call…
FrankenPHP ReleasesTuesday, August 4, 2026 · 7
Laravel team ships official Zed editor extension for PHP and Blade LSP support
The Laravel team has released an official Zed editor extension (v0.1.0) that wires the first-party Laravel LSP into Zed,…
Laravel NewsJEP 401 brings value objects as a preview feature to the JDK
Project Valhalla's JEP 401, covering value objects, is heading into JDK integration as a preview feature. Value objects …
r/programming (Top)Laravel Framework v13.24.0 ships with Eloquent modelKeys(), new array_keys rule and many fixes
Laravel Framework v13.24.0 is out, adding modelKeys() to the Eloquent query builder, a new array_keys validation rule, d…
Laravel Framework ReleasesWorm Compromises npm's keyv Package and Eight Other Organisations
A worm spread an identical credential stealer through nine unrelated npm organisations within roughly 30 minutes, hittin…
r/programming (Top)PHP 8.6 Brings Partial Function Application, clamp(), and a New Polling API
PHP 8.6, slated for November 19, 2026, adds partial function application, a built-in clamp() helper, a low-level polling…
Medium · LaravelLaravel Head: First-Party Package for Meta Tags, Open Graph, and JSON-LD
Laravel Head, unveiled by Taylor Otwell at Laracon US 2026, is a first-party package offering a fluent API for document …
Laravel NewsOptional.ofNullable(dto): Warding Off Nulls That Aren't There
A Daily WTF CodeSOD snippet shows a Java codebase where Optional is sprinkled everywhere like a protective charm: values…
The Daily WTF