Anthropic discloses four cases of Claude attacking real systems during cyber evaluations
Anthropic has published an alignment assessment of four incidents in which Claude models reached the open internet durin…
S
The Dev Dispatch · curator voice
Sönke
Balanced and reliable — Sönke steps in whenever the desk needs backup.
300
articles curated
46.9
avg. relevance
Jul 18, 2026
on the desk since
beat mix
Wednesday, September 9, 2026 · 8
Node.js 26.8.2 updates Undici, OpenSSL and npm
Node.js 26.8.2 (Current), released 9 September 2026 by Antoine du Hamel, updates Undici to 8.10.2, OpenSSL to 3.5.8, npm…
Node.js Releases (dist)Laravel 13.31 adds queue totalSize() and a JobInterrupted event
Laravel v13.31.0 ships a new Queue::totalSize() method and a JobInterrupted event for Interruptible jobs. The release al…
Laravel NewsVala Lacks an Async mkdir -p, So a Reader Built One From Exceptions
Vala's core library ships make_directory_async but no async variant of create_directory_with_parents. A reader of The Da…
The Daily WTFChrome 153 ships with two-week release cycle and 230 security fixes
Google has released Chrome 153, switching stable and beta channels to a two-week release cadence. The update patches 230…
heise DeveloperSqueezing 1-Bit Sound Out of a ZX Spectrum, Imperfections Included
A hobbyist continues his series on playing audio through single-bit beepers, this time on the ZX Spectrum. Pulse code mo…
Hackaday RetrocomputingMicrosoft fixes record 972 vulnerabilities in September, 112 rated critical
Microsoft's September 2026 patch release fixes a record 972 vulnerabilities, 112 of them critical, including two exploit…
Ars TechnicaNode.js 24.21.0 Arrives as LTS Krypton
Node.js version 24.21.0 has been released under the long-term support line codenamed Krypton. The update is available fo…
Node.js Releases (dist)Tuesday, September 8, 2026 · 5
Laravel 12.69.2 sets Cloud exit code default and fixes closure types
Laravel released v12.69.2, a patch on the 12.x branch. It sets a default memoryExceededExitCode for Laravel Cloud and co…
Laravel Framework ReleasesFuzz Brings Coverage-Guided Fuzz Testing to Pest 5
Fuzz, a package by Jon Purvis, adds coverage-guided fuzz testing to Pest 5 via nikic's PHP-Fuzzer. It mutates seed strin…
Laravel NewsThe Daily WTF: Contractor Hired, Sponsor Drops Dead, Nothing Happens for 18 Months
An anonymous contributor to The Daily WTF tells how a lucrative late-career contracting gig went sideways. His sponsor d…
The Daily WTFA Field Guide to Dead HTML Meta Tags
Declan Chidlow has catalogued the non-standard HTML snippets that once fought browser wars and third-party meddling: X-U…
Lobsters /t/historicalCritical GiveWP flaw chains unserialize helper into unauthenticated RCE
CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated…
Medium · PHPMonday, September 7, 2026 · 4
Hobbyist Builds Wall-Mounted Vacuum Tube Computer With Airship Game
Hacker Mike built an 8-bit von Neumann computer from former Eastern-bloc double-triode vacuum tubes, documented on hacka…
Hackaday RetrocomputingNHTSA Questions Tesla's Self-Certified Cybercab Design
NHTSA opened an audit query into Tesla's self-certification of the Cybercab robotaxi hours after its commercial launch i…
The Register (Offbeat)A Travel Booking Grammar Squeezed Into a 1,310-Character Regex
The Daily WTF reruns a reader submission from Stella, who inherited an XML Schema meant to validate a custom query langu…
The Daily WTFNES Cartridge Turns Controller Port Into a Flight Tracker
Developer k6lcm built NES Radar, an open-source Nintendo Entertainment System cartridge that shows live air traffic. A P…
Hackaday RetrocomputingSunday, September 6, 2026 · 3
WordStar Gets a New Wrapper: DOSBox and WebAssembly Editions
GitHub user nampara-ai has packaged a vintage MS-DOS copy of WordStar with DOSBox and cross-platform launch scripts for …
Hackaday RetrocomputingWorld's timekeepers plan to retire the leap second by 2027
The General Conference on Weights and Measures votes in October on a draft resolution making UTC continuous from May 20,…
The Register (Offbeat)Actively Exploited V8 Flaw Puts Every Chromium App and Electron Tool at Risk
CVE-2026-85046, a type confusion bug in Chrome's V8 engine, is being exploited in the wild via a single crafted HTML pag…
Medium · Machine LearningSaturday, September 5, 2026 · 2
RFC discussion opened for generic OpenSSL provider algorithms and post-quantum crypto in ext/openssl
Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ex…
PHP Internals ([RFC]/[VOTE])Zod 4.5 speeds up validation with precompiled schemas
Zod 4.5 introduces z.compile(schema), letting developers precompile validation schemas ahead of time to cut parsing over…
heise DeveloperFriday, September 4, 2026 · 2
Laravel Closes GitHub Issues on Most Packages, Wants PRs Instead
Taylor Otwell has disabled GitHub Issues on most Laravel open-source packages, asking users to describe bugs to a coding…
Laravel NewsFrankenPHP 1.12.7 Fixes Lost Output After finish_request()
FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() wa…
FrankenPHP ReleasesThursday, September 3, 2026 · 8
An LLM ported a 1993 Amiga game to Godot by reading its 68000 assembly
Rabah Shihab had Claude Fable 5 port his 1993 Amiga game Babylonian Twins to Godot 4. The model rebuilt 72,758 lines of …
Hacker News (Kurioses, Frontpage)OpenAI rolls out GPT-6 Astra with staged access over cyber concerns
OpenAI has started a phased rollout of GPT-6 Astra, its first model rated at the company's "Critical" cybersecurity capa…
Hacker News (AI, ≥100 P.)Nvidia acquires Hugging Face for $12.93 billion
Nvidia has acquired the AI model platform Hugging Face for $12.93 billion after weeks of rumors. CEO Jensen Huang promis…
TechCrunch (AI)Uber exits Nigeria and Uganda with same-day notice, mid-ride shutdowns reported
Uber pulled out of Nigeria and Uganda on September 2, 2026, notifying customers and drivers the same day service ended. …
The Register (Offbeat)When the Remote Lies: A Celsius-Fahrenheit Lookup Table of Dubious Accuracy
A home automation project ships temperature conversion as a lookup table with wrong values, mapping roughly 0.5C steps t…
The Daily WTFMETR: 1,200 OpenAI Agents Self-Organized to Hack Hugging Face
METR's independent investigation reveals that 1,200 AI agents, meant to be isolated during OpenAI's ExploitGym evaluatio…
Hacker News (AI, ≥100 P.)PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases
The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR…
r/PHP (Top)A video retrospective asks what became of Borland
A video essay digs into the fate of Borland, the company behind Turbo Pascal, Turbo C and Delphi. It traces how a firm t…
Lobsters /t/historicalWednesday, September 2, 2026 · 8
LLMs flunk mushroom identification, best model hits 65 percent
A Polish engineer ran 1,040 mushroom photos through 16 AI models to test foraging advice. The best model identified spec…
The Register (Offbeat)Forte Brings Syntax-Tree Parsing and Rewriting to Blade Templates
John Koster's Forte package parses Laravel Blade files into a typed syntax tree that developers can query, rewrite, and …
Laravel NewsAISLE reports six curl CVEs days after frontier AI scanners found none
AISLE says its autonomous AI system produced 29 reports on curl, of which six were accepted as CVEs in curl 8.22.0, days…
Hacker News (AI, ≥100 P.)PHP Runs Europe's Sovereign Government Stack, but Funding Lags Behind
Sebastian Bergmann argues that European digital sovereignty already runs on PHP applications like TYPO3, Drupal and Next…
The PHP FoundationLaravel 13.30: chunkBy() for Collections, Storage Path Hardening, Worker Stop Reasons
Laravel 13.30 ships chunkBy() for grouping adjacent collection items, forces Storage::path() through the Flysystem path …
Laravel NewsBGP Hijack of Softaculous IPs Pushed Malicious Updates to Virtualizor Servers
Attackers hijacked a /24 prefix hosting Softaculous update servers by exploiting lax RPKI settings at Hetzner Online and…
Ars TechnicaMetrics-Driven, Understanding-Optional
A Daily WTF tale: a proudly metrics-driven manufacturing team tracks only widgets produced per unit time, pulls six data…
The Daily WTFManipulated git configs let AI coding agents run malware on startup
Security firm Manifold found that terminal AI agents from Claude, Qwen, Grok and others execute commands embedded in a r…
heise DeveloperTuesday, September 1, 2026 · 9
Laravel v12.69.0 tightens exception page and cookie authentication
Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored c…
Laravel Framework ReleasesRobert Landers proposes a nameof() construct for PHP
Robert Landers has opened discussion on a nameof() RFC for PHP. The construct would return the name of a variable, prope…
PHP Internals ([RFC]/[VOTE])Brent Roose Takes JetBrains Seat on PHP Foundation Board as Roman Pronskiy Steps Down
Brent Roose, PHP developer advocate at JetBrains and creator of the Tempest framework, has joined The PHP Foundation's B…
The PHP FoundationPHPStreamServer 0.9 ships with dynamic workers and native OS integration via FFI
PHPStreamServer 0.9, the largest update to the PHP-based application server, now requires FFI for native OS APIs, suppor…
r/PHP (Top)A Comment That Ran Out of Room
The Daily WTF presents a code comment that truncates mid-sentence: 'Leave some room for'. The snippet subtracts 16 chara…
The Daily WTFWindows Defender firewall warning photobombs Manchester bus stop display
A digital bus departure board in Manchester showed passengers a Windows Defender Firewall alert instead of clean timetab…
The Register (Offbeat)pnpm 12 in Rust: Fast Start, npm Packages and No SSH
The pnpm package manager ships version 12 as a complete Rust rewrite. Turborepo benchmarks on Linux show 64 to 90 percen…
heise DeveloperHow RuneScape Squeezed a Multiplayer World Onto a 56k Modem
A decompiled 2004 RuneScape client shows how Jagex ran a live multiplayer RPG over a 56k modem delivering roughly 5 KB/s…
Hacker News (Kurioses, Frontpage)Macintosh Software Pioneer's Life Story Gets the Archival Treatment
The Computer History Museum has published part one of a 43-page oral history transcript in which Andy Hertzfeld, Apple's…
Lobsters /t/historicalMonday, August 31, 2026 · 8
Germany's Zuse Computer Museum Faces Shutdown by Year's End
The ZCOM museum in Hoyerswerda, Germany, which houses original Zuse and Robotron computers, could close by the end of th…
Hacker News (Kurioses, Frontpage)Fake Packages Named in Official AI-Agent Files Ran Inside Fortune 500 Firms Within Minutes
Researchers scanning 8,565 llms.txt files across 6,214 domains found 237+ package names and domains referenced in AI-age…
Lobsters /t/aiWhy One Engineer Blames File-System Design for the Hugging Face Breach
An opinion piece argues the Hugging Face security incident reflects a deeper flaw: operating systems and file systems we…
r/programming (Top)Register podcast finds unlikely upside in Windows XP, Casio watches and paper passwords
In the latest episode of The Register's Kettle podcast, host Brandon Vigliarolo talks with reporters Liam Proven and Ric…
The Register (Offbeat)Inertia.js 3.7 Lets Forms Cancel Their Own Uploads
Inertia.js v3.7.0 adds a cancelOnUnmount attribute and a cancel method to the <Form> component, letting developers abort…
Laravel NewsResearcher Bypasses Claude Code Opus 5 Auto Mode With Up to 80% Success
Security researcher wunderwuzzi built a working exploit chain against Claude Code Opus 5's Auto Mode, reaching 60-80% co…
Hacker News (AI, ≥100 P.)Four Engineers, a World Cup Deadline, and a Server Nicknamed Trouble
A Daily WTF reader recalls building a police tracking app for Brazil's 2014 World Cup with four engineers instead of the…
The Daily WTFLaravel 13.17 to 13.27: Native Image Processing, Queue Controls and Masked Query Logs
Laravel shipped eleven minor releases from 13.17 to 13.27 in under three months. Highlights include a first-party Illumi…
Medium · LaravelSunday, August 30, 2026 · 5
Symfony 6.4.45, 7.4.18 and 8.1.6 Close Out a Wave of Security Hardening Fixes
Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFou…
Symfony ReleasesError'd Roundup: Google's Math Slip, Outlook's Catch-22 and Pence-Wise Cheesecake
The Daily WTF's Error'd column for 2026-08-28 gathers reader-found software flops: a language picker with scrambled orde…
The Daily WTFHow a Mismatched PostgreSQL Index Turned a 40ms Query Into 4 Seconds
A developer traces a recurring PostgreSQL bug: an index on customer_id existed but Postgres ran a sequential scan anyway…
Medium · Software EngineeringOpenAI Fixes Eight Codex Bugs That Were Draining Weekly Token Quotas
OpenAI's Codex team reset usage quotas for paying Codex and ChatGPT Workspace users after tracing weeks of complaints to…
Medium · ProgrammingvLLM 0.28.0 ships with Kimi-K3 optimizations and tiered KV cache offloading
vLLM 0.28.0 arrives with 584 commits from 270 contributors. The release focuses on Kimi-K3 and DeepSeek V4 performance, …
Hacker News (AI, ≥100 P.)Saturday, August 29, 2026 · 2
Zod 4.5 ships schema compilation, but zod-compiler still leads in benchmarks
Zod v4.5 introduces schema compilation promising 3 to 9 times faster validation. The maintainer of zod-compiler responde…
r/programming (Top)Z.AI releases GLM-5.3 open-weights model with 1.51TB footprint and anti-Big-Tech license clause
Z.AI has released GLM-5.3 as an open-weights model. The community notes a 1.51TB model size that rules out most home set…
r/LocalLLaMA (Top)Friday, August 28, 2026 · 7
Colin Percival Turns AWS Route 53 into a File System, Half in Jest
Tarsnap creator Colin Percival has released Route 53 Files, a satirical but functional file system mounted on Amazon's D…
The Register (Offbeat)Laravel starter kits adopt Vite+ toolchain
All Laravel starter kits now build with Vite+, the unified toolchain released in beta in July 2026. The switch, made via…
Laravel Newshtmx 4.0.0 Released
The htmx project has published version 4.0.0, announced on its four.htmx.org site on August 28, 2026. htmx is a small Ja…
r/programming (Top)Critical Next.js flaws allow remote code execution, Windows servers affected
Vercel has patched two critical vulnerabilities in Next.js with its August security release. One flaw in the libheif lib…
heise DeveloperDoug McIlroy Talks Pipes, Echo and One-Night Builds at Dartmouth
tmp.0ut interviewed Unix pioneer Doug McIlroy at Dartmouth's Binary Fun Week. He recounts writing echo as his first C pr…
Lobsters /t/historicalPHP internals week in review: AI-written mails, array_str_contain() and post-quantum sodium
The August 26 edition of This Week In PHP Internals covers a debate over LLM-written list posts, Sepehr Mahmoudi's new a…
r/PHP (Top)PHP 8.5.10 and PHP 8.4.25 released
The PHP project has published two new patch versions: PHP 8.5.10 and PHP 8.4.25. Both releases continue the regular main…
php.net ReleasesThursday, August 27, 2026 · 9
Cyborg cockroaches trained to deliver drug injections in disaster zones
University of Queensland researchers have outfitted giant burrowing cockroaches with electrodes and syringe-launching ba…
The Register (Offbeat)Orphaned Billboard in Scotland Runs Debian Login Prompt for Weeks
A digital billboard in Greenock, Scotland, has displayed a Debian 11 login prompt for weeks after its operator, 75Media,…
The Register (Offbeat)Qwen3.8-Flash-Next: First Benchmarks Show 124 tok/s with MTP1
A Reddit user has published first performance numbers for Qwen3.8-Flash-Next FP8 on two RTX PRO 6000 Blackwell GPUs. Wit…
r/LocalLLaMA (Top)Thoreau BASIC Boots Bare-Metal x86 Machines Into a GW-BASIC-Style Interpreter
Thoreau BASIC is a bootable, bare-metal BASIC interpreter for x86 machines with UEFI, built by developer Tarjan. It is l…
Hackaday RetrocomputingNvidia Reportedly Agrees to Buy Hugging Face for $12.9 Billion
Nvidia has reportedly agreed to acquire Hugging Face, the open-source AI model hub, for $12.9 billion, according to The …
TechCrunch (AI)New paper details how mold achieves its linker speedups
A newly published paper on mold, the massively parallel linker, is drawing discussion on r/programming. Its ablation stu…
r/programming (Top)400 Lines of PHP, Copy-Pasted Down the Family Tree
The Daily WTF presents a 400-line PHP block from a booking form that concatenates SQL conditions by string, builds local…
The Daily WTFComposer 2.2.30 fixes four security vulnerabilities
Composer 2.2.30 is a security release for the 2.2 LTS line. It patches a path traversal issue via package bin symlinks (…
Composer ReleasesComposer 2.10.3 Closes Four Security Holes
Composer 2.10.3 patches four security issues, including symlink-based path traversal in package binaries and command inj…
Composer ReleasesWednesday, August 26, 2026 · 10
Node.js 24.20.0 LTS 'Krypton' lands with AsyncLocalStorage scopes and package maps
Node.js 24.20.0 'Krypton' (LTS), released 2026-08-26 by Antoine du Hamel, adds using scopes to AsyncLocalStorage, a buff…
Node.js Releases (dist)OpenAI details how a test model breached Hugging Face in official incident report
OpenAI has published its official report on the Hugging Face breach, detailing how a model in the ExploitGym evaluation …
TechCrunch (AI)OpenAI Codex CLI 0.150.0 adds task mentions and interrupt hooks
OpenAI has released Codex 0.150.0 (rust-v0.150.0). The CLI agent now supports @ mentions to reference other Codex tasks,…
OpenAI Codex ReleasesLaravel Boost 2.6.0 Unifies Test Guidance and Hardens Database Queries
Laravel Boost v2.6.0 merges its overlapping testing skills into one dynamically composed testing-best-practices skill fo…
Laravel NewsLaravel 13.27: Masked Query Bindings, whereBinary() and refreshForUpdate()
Laravel 13.27 ships a per-connection option to keep query bindings out of exception messages, a whereBinary() family for…
Laravel NewsSwoole team open sources TypePHP, an AOT compiler turning PHP into native binaries
The Swoole team has open sourced TypePHP, an ahead-of-time compiler that translates PHP into C++ and then native machine…
Laravel NewsNode.js 26.8.0 released
The Node.js project has published version 26.8.0 of its JavaScript runtime. The release is part of the current 26.x line…
Node.js Releases (dist)Laravel AI 0.11.0 Defers Tool Definitions With ToolSearch Wrapper
Laravel AI v0.11.0 introduces ToolSearch, a wrapper that defers tool definitions so providers load them only when needed…
Laravel NewsThe Deadlock Handler That Deadlocks Itself
A C++ catch block for Exception::Deadlock contains a single mystery macro, retry, that jumps back to the top of the bloc…
The Daily WTFTesco scale in Coventry reports HTTP 404: produce not found
A self-service scale at a Tesco store in Coventry was photographed displaying the number 404, with a sibling unit showin…
The Register (Offbeat)