» curated · synthesized
Skip the noise.
Read the signal.
Curated tech news and synthesis for developers and technology professionals.
» Latest posts
123 postsOperation CameraSwarm: 14,000+ Dahua Cameras Compromised
Hunt.io traced Operation CameraSwarm to an exposed dev directory, revealing three exploit paths behind 14,000+ compromised Dahua cameras.
GeoServer jsonArrayContains SQLi Confirmed Regression of CVE-2023-25158
GeoServer's GHSA-mqjf-5f49-2fjh SQL injection is a confirmed regression of CVE-2023-25158, enabling unauthenticated RCE. Patch and mitigation details inside.
Linux 7.2 Released with Cache-Aware Scheduler and USB4STREAM
Linux 7.2 ships cache-aware task scheduling, a fairer GPU scheduler, USB4STREAM support, and Btrfs performance gains.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comKino: A Rust-powered Ractor web server for Ruby 4.0
Kino brings Ractor-based parallelism to Ruby 4.0 with a Rust core, beating Puma clusters on speed and using up to 7x less memory.
Draft Spec Proposes Unified Server-Side HTTP API for JS Runtimes
A draft spec proposes a unified server-side HTTP API using ServerContext to reconcile Node, Deno, Bun, and edge runtime differences.
Python library verifies OpenAI's signed AI agent traffic (RFC 9421)
regent-httpsig is an open-source Python library that verifies and signs OpenAI-style AI agent HTTP traffic per RFC 9421 and Web Bot Auth drafts.
Spectre Flaw Leaks JWT Tokens on Cloudflare Workers via Remote Timers
A new Spectre attack bypasses Cloudflare Workers' DyPrIs defense, leaking JWT tokens via microarchitectural timers; Cloudflare responded with MPK-based isolation.
Linux Kernel Bridge STP Timer Use-After-Free Vulnerability
Linux bridge STP timers vulnerable to use-after-free via dellink teardown gap, enabling potential kernel control-flow hijack. Patched upstream.
New API integer overflow turns $0.10 balance into $16.9 trillion
CVE-2026-71479 lets one request overflow New API's billing math, turning a $0.10 balance into $16.9T. CVSS 9.1, fixed in v1.0.0-rc.18.
Agent Control Plane: The LLM Proposes, It Never Authorizes
Agent Control Plane keeps AI agent authorization outside the model, blocking prompt injection with signed policy and human sign-off for risky actions.