Keyv npm Supply Chain Attack: Shai-Hulud Hits 2B Installs
Keyv and 868 npm packages compromised by Shai-Hulud worm malware today — over 2B monthly installs at risk. Steals credentials, spreads via npm ...
LLM Slop CVEs: 54 Fake Vulnerabilities Hit NVD — Act Now
JFrog found 54 AI-generated fake CVEs — 6 targeting SQLite with CVSS 9.8 — that ...
FFmpeg 9.0 “Lei”: Vulkan Expands, ONNX Hits GPU
FFmpeg 9.0 Lei shipped today with expanded Vulkan GPU acceleration, ONNX Runtime GPU execution in ...
Open Source Devtools: Why AI Makes the Choice Clear
David Crawshaw published something this week that 573 Hacker News points found worth arguing about: ...
Swiftlet: Run an 80B LLM in 4.3 GB of RAM on Mac
Swiftlet runs an 80B Qwen model in 4.3 GB of RAM by streaming expert weights ...
LLMs Reward Expertise, Not Beginners: What the Data Shows
HN front page today: LLMs reward domain expertise over raw effort. Senior engineers capture 5x more AI productivity gains. Your skills still matter ...
Node.js 26.6.0: Crypto Backend Split and Streams Overhaul
Node.js 26.6.0 restructures crypto into three backends and adds ring-buffer streams. Here is what changed, ...
Andy Pavlo Joins ClickHouse Labs: Database Research Shifts
Andy Pavlo left CMU tenure to found ClickHouse Labs as VP of Database Research. Here ...
7-Zip CVE-2026-58052: The MotW Bypass Nobody Patched
7-Zip 26.02 has an actively exploited Mark-of-the-Web bypass (CVE-2026-58052) with no official patch. Here is ...
PostgreSQL 18.4: 11 Security CVEs Fixed — Patch It Without Downtime
PostgreSQL 18.4 patches 11 CVEs — including a CVSS 8.8 RCE in the refint module ...