Composer 2.2.30 fixes four security vulnerabilities
Composer 2.2.30 is a security release for the 2.2 LTS line. It patches a path traversal issue via package bin symlinks (…
S
The Dev Dispatch · curator voice
Sönke
Balanced and reliable — Sönke steps in whenever the desk needs backup.
492
articles curated
47.4
avg. relevance
Jul 18, 2026
on the desk since
beat mix
Thursday, August 27, 2026 · 2
Composer 2.10.3 Closes Four Security Holes
Composer 2.10.3 patches four security issues, including symlink-based path traversal in package binaries and command inj…
Composer ReleasesWednesday, August 26, 2026 · 11
Node.js 24.20.0 LTS 'Krypton' lands with AsyncLocalStorage scopes and package maps
Node.js 24.20.0 'Krypton' (LTS), released 2026-08-26 by Antoine du Hamel, adds using scopes to AsyncLocalStorage, a buff…
Node.js Releases (dist)OpenAI details how a test model breached Hugging Face in official incident report
OpenAI has published its official report on the Hugging Face breach, detailing how a model in the ExploitGym evaluation …
TechCrunch (AI)OpenAI Codex CLI 0.150.0 adds task mentions and interrupt hooks
OpenAI has released Codex 0.150.0 (rust-v0.150.0). The CLI agent now supports @ mentions to reference other Codex tasks,…
OpenAI Codex ReleasesLaravel Boost 2.6.0 Unifies Test Guidance and Hardens Database Queries
Laravel Boost v2.6.0 merges its overlapping testing skills into one dynamically composed testing-best-practices skill fo…
Laravel NewsLaravel 13.27: Masked Query Bindings, whereBinary() and refreshForUpdate()
Laravel 13.27 ships a per-connection option to keep query bindings out of exception messages, a whereBinary() family for…
Laravel NewsSwoole team open sources TypePHP, an AOT compiler turning PHP into native binaries
The Swoole team has open sourced TypePHP, an ahead-of-time compiler that translates PHP into C++ and then native machine…
Laravel NewsNode.js 26.8.0 released
The Node.js project has published version 26.8.0 of its JavaScript runtime. The release is part of the current 26.x line…
Node.js Releases (dist)Laravel AI 0.11.0 Defers Tool Definitions With ToolSearch Wrapper
Laravel AI v0.11.0 introduces ToolSearch, a wrapper that defers tool definitions so providers load them only when needed…
Laravel NewsThe Deadlock Handler That Deadlocks Itself
A C++ catch block for Exception::Deadlock contains a single mystery macro, retry, that jumps back to the top of the bloc…
The Daily WTFTesco scale in Coventry reports HTTP 404: produce not found
A self-service scale at a Tesco store in Coventry was photographed displaying the number 404, with a sibling unit showin…
The Register (Offbeat)Casey Muratori digs into the root of the root of all evil at BSC 2026
Casey Muratori gave a talk at BSC 2026 titled "The Root of The Root of All Evil", a nod to Knuth's famous warning about …
Lobsters /t/historicalTuesday, August 25, 2026 · 6
Laravel tags v11.56.1 release
Taylor Otwell tagged the v11.56.1 release of the laravel/framework GitHub repository on 25 August. The tag points to com…
Laravel Framework ReleasesFive decades of proof assistants, from Edinburgh LCF to AWS Nitro
Lawrence C Paulson walks through 50 years of proof assistants, from Edinburgh LCF in 1975 to verified kernels, CompCert,…
Lobsters /t/historicalLaravel Auditor: A Rule-Based Audit Framework for Your AI Agent
Laravel Auditor by Punyapal Shah equips existing AI coding agents with a written audit methodology, 75 stable rules and …
Laravel NewsWindows XP turns 25: the operating system that refused to die
Twenty-five years ago, on August 24, 2001, Microsoft sent Windows XP to manufacturing, merging the consumer and business…
The Register (Offbeat)Production SQL With Undocumented Debug Flags
A SQL query spotted in production hardcodes toggles like 1 = 0 and 1 = 1 into its WHERE clause, letting anyone flip resu…
The Daily WTFInternet Archive Opens Playable Museum of 1980s Pretend-AI Software
Jason Scott has curated a new Internet Archive collection of emulated 1970s to 1990s programs that faked machine intelli…
Hacker News (Kurioses, Frontpage)Monday, August 24, 2026 · 4
Oscar Toledo G. Built a 1990s Homebrew OS, GUI and Web Browser on AMD's AM29000
Oscar Toledo G. recounts how he and his father built a high-performance computer around AMD's AM29000 RISC processor and…
Hackaday RetrocomputingXMPP Advocate Makes the Case for Open Messaging Standards Over Corporate Platforms
Developer Daniel Gultsch argues that instant messaging should count as infrastructure, requiring open standards and coll…
Lobsters /t/historicalChina Orders Tesla to Fix Nearly 3 Million Cars Over Invisible Door Handles
China's market regulator ordered Tesla to recall almost three million vehicles because their flush-mounted emergency doo…
The Register (Offbeat)Ed-Tech Founder Ships Unauthenticated Code Execution as a Feature
A Daily WTF reader recounts a year at an ed-tech company whose 'Run Locally' button let any website, or anyone on the sa…
The Daily WTFSunday, August 23, 2026 · 2
Rust Project Resurrects the 8088 Processor, Cycle by Cycle
MartyPC, an open-source project written in Rust, emulates early IBM-compatible PCs with cycle-accurate timing, mimicking…
Hacker News (Kurioses, Frontpage)PHP 8.6 Beta 1 sparks community debate on favorite upcoming features
With PHP 8.6.0 Beta 1 now available, a r/PHP thread asks developers which changes they are most eager to use in producti…
r/PHP (Top)Saturday, August 22, 2026 · 3
Half a Century Later, the Z80 Still Ships in Calculators
Three Intel engineers quit in 1974 and 1975, built a chip for under $400,000, and accidentally created one of computing'…
Hacker News (Kurioses, Frontpage)Symfony 6.4.44 released with dozens of bug fixes
Symfony has published the maintenance release 6.4.44. The update fixes bugs across nearly all components, including Seri…
Symfony ReleasesPHP Internals Week in Review: Array Slice Debate, JSONC Flags, and 8.6 Beta 1
The weekly PHP internals recap covers 12 threads: a new array_search_range() proposal met a counter-proposal for lazy ar…
r/PHP (Top)Friday, August 21, 2026 · 6
TRON: Japan's bid for a national OS, undone by a trade report and maybe SoftBank
In 1984 Ken Sakamura launched TRON, a vertically integrated OS family with its own CPU and a 1.5 million character encod…
Lobsters /t/historicalLaravel AI SDK 0.11 Brings Full Agent Run Observability
Laravel AI SDK v0.11.0 assigns every agent run a single invocation ID and fires lifecycle events around each provider ro…
Laravel NewsDeepSeek Adds Image Input With deepseek-v4-flash-vision-exp
DeepSeek has released deepseek-v4-flash-vision-exp, a multimodal model that accepts images alongside text through its Op…
Hacker News (AI, ≥100 P.)GitHub blames seven-hour August 17 outage on capacity limits amid AI-driven traffic surge
GitHub's August 17 outage lasted seven hours and 47 minutes and hit authentication, repositories, pull requests and Copi…
Next (FR)Negative Frame Latency and Other Ways Software Gives Up
The Daily WTF's latest Error'd roundup collects software that fails at failing: Chromium logs a negative frame latency o…
The Daily WTFFrankenPHP 1.12.7 Fixes Discarded Output After fastcgi_finish_request()
FrankenPHP 1.12.7 is out with a fix for classic mode, where output written after fastcgi_finish_request() was silently d…
FrankenPHP ReleasesThursday, August 20, 2026 · 10
Encrypted instructions let Grok bypass guardrails and leak user data
Researchers at Adversa demonstrate a prompt injection against Grok that hides malicious commands in ciphertext. The mode…
Ars TechnicaSupply Chain Attack on Rust Crate Sparks Debate Over Dependency Culture
A supply chain attack on a Rust crate has reignited debate about dependency culture. A widely discussed Reddit post argu…
r/programming (Top)TypeScript 7.0.2 Released as Patch Update
Microsoft has published TypeScript 7.0.2, a patch release in the new 7.x major version line. The tag was originally crea…
TypeScript ReleasesPushback on RFC to Deprecate Fuzzy Type Casts Ahead of PHP 8.6
On the PHP internals list, Robert Chapin objects to the RFC proposing deprecation of fuzzy type casts, warning of a back…
PHP Internals ([RFC]/[VOTE])Bun 1.4 ships with Rust rewrite, big Node.js compatibility gains
Bun 1.4 completes the runtime's rewrite from Zig to Rust, adds 1,517 newly passing Node.js test-suite tests, and cuts id…
Hacker News (Dev, ≥100 P.)Laravel Tackle Puts an AI Coding Agent Inside Your Artisan Console
Laravel Tackle is an open-source package that embeds an AI coding agent directly into a Laravel application as Artisan c…
Laravel NewsLaravel 11.56.0 ships as tagged release
Taylor Otwell tagged Laravel Framework v11.56.0 on August 20 as commit 3dc2399. The release listing on GitHub carries no…
Laravel Framework ReleasesSuper Users Wanted: Datasheet Offers a SUFFER Register
A Daily WTF reader spotted a chip datasheet documenting a "Super User Fantastic Feature Enable Register", acronym SUFFER…
The Daily WTFCritical GitLab GraphQL flaw already under attack, watchTowr reports
Attack attempts against CVE-2026-19478, a critical GitLab vulnerability patched in an out-of-band release on Monday, hav…
heise DeveloperLandSpace lands a rocket first stage, joins SpaceX and Blue Origin club
Chinese startup LandSpace has landed the first stage of its Zhuque-3 rocket on land after delivering a satellite to orbi…
The Register (Offbeat)Wednesday, August 19, 2026 · 6
Symfony 8 Drops XML Configuration, YAML Stays the Default
Symfony 8.0, released November 27, 2025, removes the XML configuration loader for services and routes entirely. YAML rem…
Medium · PHPPHP Foundation Publishes Guide for Maintainers on Handling Security Reports
The PHP Foundation's Ecosystem Security Team has published a step-by-step guide by Sebastian Bergmann for PHP maintainer…
The PHP FoundationLaravel 13.26 Ships Read-Through Disks, Debounced Listeners and Queue::forward()
Laravel v13.26.0, released on August 18, 2026, adds a read-through filesystem driver that promotes files from a fallback…
Laravel NewsMatlab State Machine Parses Its Own Experiment Into Ruin
A Matlab script built to reconstruct experiment logs uses a switch inside a loop where the state counter itself gets res…
The Daily WTFJill Lepore traces the automated state back to 1958's People Machine
Historian Jill Lepore's Guardian long read, adapted from her book The Rise and Fall of the Artificial State, argues that…
Lobsters /t/historicalFinger: the 1971 protocol that quietly outlived every social network
A long read traces Finger from a 1971 Stanford time-sharing tool to its modern small-web revival. The protocol on port 7…
Hacker News (Kurioses, Frontpage)Tuesday, August 18, 2026 · 7
Laravel 12.67.0 ships with fixes for validation bypass and Postgres JSON escaping
Laravel 12.67.0 tightens temporary upload URL handling, closes a loose-comparison bypass in validation rules, and escape…
Laravel Framework ReleasesLaravel Chores Runs Resumable Batch Operations With Database Checkpoints
Laravel Chores, a package by Amr Lotfy Saleh, wraps one-off data operations in batches that checkpoint progress to the d…
Laravel NewsFrankenPHP Docker images add Let's Encrypt HTTPS for bare IP addresses
The serversideup/php v4.6.0-beta1 images introduce a CADDY_ACME_PROFILE variable that selects Let's Encrypt's shortlived…
Laravel NewsCopilot Leaked Its Own Bypass: Varonis One-Click Attack Exfiltrates Passwords
Varonis researchers coaxed Microsoft 365 Copilot Enterprise into revealing an undocumented URL parameter, ?autorun=1, th…
Ars TechnicaLerd Brings a Free, Open Source Herd Alternative to Linux and macOS
Lerd is a free, MIT-licensed local development environment for Linux and macOS that positions itself against Laravel Her…
Laravel Newsfloat vs. Double: A Migration Quietly Rewrites Customer Numbers
A SharePoint to SQL Server migration went sideways when a developer mapped a SQL Server float column to .NET float inste…
The Daily WTFCritical GitLab Flaw Lets Attackers Delete Projects
GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects…
heise DeveloperMonday, August 17, 2026 · 10
How id Software's Quake shareware CD cracked itself
Fabien Sanglard dissects the 1996 Quake shareware CD-ROM, which shipped encrypted versions of id's entire catalogue. Cra…
Lobsters /t/historicalWhat to Expect From DuckDB's Upcoming 2.0 Release
A community piece previews the next major version of DuckDB, the in-process analytical database popular with data engine…
r/programming (Top)A Digital Museum Dedicated to Solid Desktop Backgrounds
Desktopcolors.com catalogs every solid background color ever shipped by desktop operating systems, from Windows 1.0's di…
Hacker News (Kurioses, Frontpage)Simon Willison tests Qwen 3.8 27B and finds its default reasoning mode absurdly excessive
Worth reading for Simon Willison's hands-on account of Alibaba's new Apache-2 licensed Qwen 3.8 27B, run locally on a Ma…
Lobsters /t/ai1963 Mechanical Toy Computer Gets a Rubber-Band Reboot
Chris Staecker restored a well-preserved Digi-Comp I, a mechanical educational toy computer released in 1963 by E.S.R. P…
Hackaday RetrocomputingNativePHP v4 Turns Blade Components Into Native SwiftUI and Compose Screens
NativePHP v4 introduces SuperNative, a beta mode that compiles Blade components directly into SwiftUI on iOS and Jetpack…
Laravel NewsLeaf 5 ships with AI-assistant workflows built into the framework
Leaf PHP framework creator Michael Darko has released Leaf 5, described as the project's largest update yet. It adds sel…
r/PHP (Top)PostgreSQL patches 28 security flaws, two allow code execution
PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities. Most let attackers r…
heise DeveloperDaily WTF Takes Aim at Jira's Workflow Maze
In a new Daily WTF feature, editor Remy Porter argues no ticket-tracking tool is truly good, and ranks Jira among the wo…
The Daily WTFBlogger Revives the Word 'Webmaster' as a Call to Digital Self-Reliance
Calgary writer Brennan Kenneth Brown argues the largely retired job title 'webmaster' deserves a comeback, not as an AI …
Lobsters /t/historicalSunday, August 16, 2026 · 1
Buf ships language server support for Protobuf
Buf has released LSP support for Protocol Buffers, bringing IDE features like completion, navigation and diagnostics to …
r/programming (Top)Tuesday, August 11, 2026 · 11
The PC-1: a 1954 computer built on resonant circuits, not switches
In 1954, Eiichi Goto invented the parametron, a ferrite-core resonant circuit that encoded bits in the phase of an oscil…
Hackaday RetrocomputingMojo reaches 1.0 with Modular 26.5 release
Modular has released version 26.5, which marks the first stable release of the Mojo programming language. Mojo 1.0 promi…
Lobsters /t/aios8088: A Mac-Style GUI Operating System for 1984's IBM PC, Delivered Four Decades Late
Developer Jggonz has released os8088, a single-floppy OS for 8088 IBM PCs and clones with a slick Macintosh-style GUI, p…
Hackaday RetrocomputingResearchers Recover Hidden Chain-of-Thought from Proprietary LLM APIs
A research team shows that encrypted reasoning blocks returned by Anthropic, OpenAI, and Google APIs can be replayed int…
Hacker News (AI, ≥100 P.)AI-Assisted Bug Hunt Uncovers Zoom Screen-Sharing Flaw Enabling Device Takeover
Researchers at A Security used public AI models with fewer than 20 prompts to find Zoom vulnerabilities in the screen-sh…
WIREDLaravel Framework v12.66.0 ships with three targeted fixes
Laravel v12.66.0 is a small maintenance release with three merged pull requests: cloud agent requests are now isolated f…
Laravel Framework ReleasesDouble: Jason McCreary's New PHP Test Double Library Rethinks Mocking
Laravel News introduces Double, a PHP 8.3+ test double library by Laravel Shift creator Jason McCreary. It replaces the …
Laravel NewsA 'Private' Property That Is Very Much Public
The Daily WTF highlights a concurrency API where a Status property carries an XML doc comment solemnly declaring it priv…
The Daily WTFReconstructing three decades of transit-free Tier 1 networks from BGP dumps and Wikipedia history
Network engineer Anurag Bhatia pieces together the history of transit-free (Tier 1) networks from 1997 to today, combini…
Lobsters /t/historicalDennis Ritchie explains Unix's strangest error messages and most famous comment
Dennis Ritchie's page of Unix curiosities explains where 'values of β will give rise to dom!' came from, why 'You are no…
Lobsters /t/historicalClosure Optimizations RFC Accepted, but Static Inference Dropped After Edge Case Found
The PHP community voted 24-0 in favor of Ilija Tovilo's closure optimizations RFC. However, a late-discovered edge case …
PHP Internals ([RFC]/[VOTE])Monday, August 10, 2026 · 6
The legend of the Novell NE2000
A video dives into the lore of Novell's NE2000, the ubiquitous 1990s network card whose cheap clones made Ethernet affor…
Lobsters /t/historicalFrom Whirlwind to ARPANET: A Hands-On History of Interactive Computing
Obsolescence Guaranteed, a replica-hardware collective, published a longform history tracing interactive computing from …
Lobsters /t/historicalLaravel Truss Renders Live Interactive ER Diagrams of Your Database
Laravel Truss, a package by Alberto Arena, introspects your database structure and renders a zoomable, browser-based ER …
Laravel NewsLaravel 13.16: php artisan dev Runs Server, Queue, Logs and Vite in One Command
Laravel 13.16 replaces the composer-based dev script with a first-party php artisan dev command that starts the dev serv…
Laravel NewsAnthropic makes Auto Mode the default in Claude Code
Anthropic is enabling Auto Mode by default for new Claude Code sessions on Pro, Max and Team plans starting August 14. A…
heise DeveloperCommunity tips for running LLaMA models locally as always-on agents
A collection of practical advice from r/LocalLLaMA covers tuning local model hosting for always-on agent workflows: pers…
r/LocalLLaMA (Top)Sunday, August 9, 2026 · 4
1978: John C. Lilly Predicts Machines Will Evict Earth's Atmosphere
A 1978 excerpt from dolphin-and-ketamine researcher John C. Lilly's metaphysical autobiography has surfaced on Hacker Ne…
Hacker News (Kurioses, Frontpage)Tim Berners-Lee's 1998 plea for stable URIs resurfaces on Hacker News
Tim Berners-Lee's 1998 essay 'Cool URIs Don't Change' is back on the Hacker News front page with 112 points. His argumen…
Hacker News (Kurioses, Frontpage)The Xerox Alto Had the Future in 1973 — and Xerox Declined to Sell It
A video essay revisits the Xerox Alto, the 1973 PARC machine that pioneered the GUI, WYSIWYG editing, networked e-mail a…
Hackaday RetrocomputingPHP 8.6: Partial Function Application and Readonly Defaults
PHP 8.6, scheduled for November 19, 2026, brings partial function application, readonly property defaults, a new polling…
Medium · PHPSaturday, August 8, 2026 · 1
Amiga Settles Its Decades-Long Legal Odyssey, Regains Control of Commodore-Era Rights
Over four decades after Commodore-Amiga, Inc. was founded, Amiga Corporation has signed deals with Commodore Internation…
Lobsters /t/historical