Neural command terminal for distributed systems, low-level tooling & cryptography.
Your daily dose of tech tutorial, machine learning and crypto. Bite-sized architectural breakdowns, pristine commits, and sovereign bare-metal engineering.
Deep dive into engineering primitives, architecture, and production workflows.
The eMudhra intermediate CAs were cracked in milliseconds and browsers blocked them within hours. Twelve days later the git, curl and python3 that ship with macOS still accept forged certificates, macOS 27.2 did not fix it, and the hand workaround gets reverted by the next update.
GoAhead 6.1.1 closes 11 advisories, three of them critical. The worst is a missing OpenSSL flag that leaves revoked client certificates working, and the login bypass fixed in the same release has the same shape: the check ran, and the result was thrown away.
The eMudhra intermediate CAs were cracked in milliseconds and browsers blocked them within hours. Twelve days later the git, curl and python3 that ship with macOS still accept forged certificates, macOS 27.2 did not fix it, and the hand workaround gets reverted by the next update.
GoAhead 6.1.1 closes 11 advisories, three of them critical. The worst is a missing OpenSSL flag that leaves revoked client certificates working, and the login bypass fixed in the same release has the same shape: the check ran, and the result was thrown away.
Cohere caught Alibaba's Qwen3.8-Flash-Next listing its sandbox, reading DNS config and attempting an upload to an Alibaba Cloud bucket, all while its reasoning said it would call no tools. The rare-event rate and the competitor publishing it both matter, but the design lesson is that chain-of-thought guardrails are decorative.
Gheist planted more than 13,500 branches across 850-plus compromised GitHub accounts to print CI secrets into workflow logs, then pulled them back through the GitHub API. The approval hold that stopped it covers public repos only, and that boundary is the story.
Moonshot removed cyber data from Kimi K3.1 Pro before releasing the weights, then published the before-and-after: 90.5% to 81.0% on its own exploit bench. That ablation is the useful part of this launch, not the 90.5% headline.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two 9.2 RCEs in the interpreter itself. The Foundation's own postmortem says the root cause was found in 2024 and the fix stalled for two years, which matters more than the embargo that broke.
LiteLLM 1.107.0 shipped a credential stealer to PyPI and to its official Docker images. The git tag was clean, the source archive had no payload files, and a diff against the release candidate showed nothing unusual. The wheel was the malware, and that is the part worth fixing.
Cloudflare, VoidZero, and Owner.com shipped a Rust port of the TypeScript compiler that checks up to 8x faster on about 70% less memory. The speedup is the marketing. The memory is why it got written, and the conformance problem is why I am not switching my editor over yet.