AI·
Humans caught 13.6% of dangerous commands. Claude Code's classifier caught 89%.
Anthropic makes auto mode the default in Claude Code on August 14. Its own study says the permission prompt was catching almost nothing.
Topic
Developer tools
Not every story is about the model layer. Rust ships a release every six weeks; Adobe is rebuilding Photoshop around Firefly; Figma’s strategic grip on prototyping just cracked. We follow the tools developers and designers actually spend their day in — language features shipping without fanfare, IDE consolidation that reshapes who controls distribution, and the quieter platform moves that decide which stack you’ll be stuck with in 2027.
80 articles in this topic
Security·
Metabase's password-reset endpoint handed out admin, and Framework had to email every customer
A CVSS 10.0 SQL injection in Metabase was exploited from August 3. Framework told every customer their data was taken. Tally lost emails and password hashes.
AI·
Uber spent its entire 2026 AI budget in four months, and the rest of the industry is now metering tokens
Uber's year of AI budget lasted until April. A 15-company survey shows per-developer spend running from $200 to $3,000 a month, and finance has noticed.
Web·
Agents that start with access to nothing: Cloudflare open-sourced the agent platform it runs internally
Cloudflare open-sourced Cloudflare OS under Apache 2.0 and shipped Kitesurf, WebMCP, and Wallets the same week. Here's which pieces are GA and which are private beta.
Open Source·
Rust's new rules require disclosing LLM use. A Linux maintainer gives AI patches three seconds.
Five Rust teams ratified an LLM policy that bans AI-written docs and mandates disclosure. Linux leaves it to each maintainer. Both are rationing review time.
Open Source·
65.9% of the web platform tests now pass in Servo, but the Rust engine can't select text
Servo 0.4.0 landed a record 558 commits and fixed layout on real sites. Its own dashboard reads 65.9%, CSS Grid sits at 37.8%, and text selection isn't shipped yet.
Web·
TypeScript compiled to native: Vercel's scriptc ships a 178KB binary with no JS engine
Vercel Labs open-sourced scriptc, a TypeScript-to-native compiler with no JS engine in the binary. Its README claims 2.4ms startup. Hacker News is not convinced.
Android·
Android may stop letting a phone debug itself, and Shizuku would break with it
A comment on a Google issue tracker floated binding ADB to the Wi-Fi interface only. That one change would kill loopback debugging, Shizuku, and every debloater built on it.
Open Source·
Codeberg banned LLM-generated projects, and Debian is voting on the same question
Codeberg's terms now bar projects that mostly consist of AI-written code. Debian's open resolution puts three answers on one ballot. Provenance is the crux.
Security·
A Hanwha camera's login page leaked a GitHub token with admin on hundreds of repos
A security researcher found a Hanwha Vision camera shipping a live GitHub admin token in its login page, granting access to hundreds of the vendor's repositories.
Web·
Jack Dorsey launched Buzz to replace Slack and GitHub. Its AI agents are full members
Jack Dorsey's Block launched Buzz, an open-source workspace that fuses team chat, AI agents, and Git hosting on Nostr, aiming squarely at Slack and GitHub.
AI·
GitHub ran four frontier models through Copilot's harness. None won every task.
GitHub benchmarked Copilot's agent harness against Claude Code and Codex CLI on five tests. The token savings are real, and the best model depends on the task.
Open Source·
HackerRank open-sourced its resume screener. The same resume scored 66 to 99.
HackerRank put its AI hiring agent on GitHub under MIT. One developer ran a single resume through it 100 times and watched the score swing from 66 to 99.
Web·
Cloudflare opened OAuth to every developer on its platform
Cloudflare now lets any developer build a real OAuth login against its API, ending a partner-only gate. Here's what that fixes and the catch.
Web·
Vercel's AI SDK 7 makes agents a first-class building block for TypeScript developers
AI SDK 7 ships agent classes, provider-agnostic reasoning control, durable workflows, and a Node 22 + ESM-only baseline. Here's what changed and the migration cost.
Open Source·
Deno 2.9 nearly doubled its cold start and learned to read Bun's lockfiles
Deno 2.9 ships a 1.98x faster cold start, a native desktop-app builder, and direct reading of npm, pnpm, yarn, and Bun lockfiles. Here's where Deno sits now.
Web·
This month on Hacker News: Half-Life 2 in a browser and 18 years of comments, searchable
June 2026's standout Hacker News projects: Half-Life 2 streamed into a browser tab, a searchable 18-year HN archive, a Pareto-frontier mini-PC tracker, and more.
Open Source·
Intel quietly switched off the open-source evangelism program it ran for two decades
Intel archived its Open Ecosystem Community and Evangelism hub and dozens of open-source projects as cost cuts reshape what one of Linux's biggest backers funds.
AI·
Anthropic bought Stainless, the SDK factory OpenAI and Meta also ran on
Anthropic acquired Stainless for a reported $300M and is winding down the hosted SDK generator that OpenAI, Meta, Google, and Cloudflare relied on.
Web·
Vercel Ship 2026 bet the keynote on agents, but the quiet shipped wins matter more today
Vercel's Ship 2026 keynote was all agents. The eve framework and enterprise stack stole the stage, but Flags, Claude Design, and signed Blob URLs are what ship today.
Web·
AI front-end code has a tell. Devs are fighting the purple-gradient slop with design tokens
AI-built interfaces all look the same: purple gradients, Inter, three icon cards in a row. Here's why the output converges, what it costs, and how developers break the pattern.
Open Source·
Cloudflare bought VoidZero, the team behind Vite. The tools stay MIT and vendor-neutral.
Cloudflare acquired VoidZero, Evan You's company behind Vite, Vitest, Rolldown and Oxc. The tools stay MIT-licensed, and there's a $1M ecosystem fund.
Web·
Linear keeps its database in the browser. That's why the app feels instant
A widely shared breakdown explains why Linear feels instant: a local-first sync engine, optimistic UI, and an in-browser object cache. Here's the architecture, in plain terms.
Gaming·
Beyond the engine: six open-source tools that shape how games get made
Godot, Unity and Unreal get the headlines, but six open-source tools quietly do the art, levels, and dialogue work that real games ship on.
Startup·
Gergely Orosz hands TechPays to Levels.fyi, and the European salary data stays free
Levels.fyi has acquired TechPays, Gergely Orosz's European tech-salary project. Here's what's changing, what isn't, and what it means for engineers.
Security·
VS Code's webview sandbox leaks GitHub tokens that read and write every private repo
A disclosed VS Code zero-day lets one click on a malicious github.dev notebook steal a GitHub OAuth token with full read-write access to every private repo.
Open Source·
Microsoft is shipping Linux's core commands on Windows, built in Rust
Microsoft's Coreutils for Windows brings native ls, cp, and grep to Windows, built on the Rust uutils project. Here's what it is and why the Rust rewrite matters.
Security·
GitHub banned the researcher dropping Windows zero-days. The code was already mirrored everywhere.
GitHub wiped Nightmare-Eclipse's account on May 23 after weeks of unpatched Windows exploits. The ban reopened the oldest fight in security: who decides what research gets hosted?
Open Source·
SQLite won't accept AI-written code, but QEMU just opened the door to it
Two of the most cautious C projects split on AI contributions in the same week. The real fight is over copyright provenance and who cleans up the slop.
AI·
Hacker News is obsessed with durable Postgres workflows and a game about clicking yes
Six dev-tooling and AI posts that climbed Hacker News in late May 2026: durable execution on plain Postgres, LLM code smells, a permission-fatigue game, Rust 1.96, and more.
AI·
Uber blew its entire 2026 AI coding budget in four months. Its COO can't prove it paid off.
Uber exhausted its full-year Claude Code budget by April. Adoption hit 84%, heavy users burn $2,000 a month, and COO Andrew Macdonald can't connect the spend to shipped features.
Open Source·
MySQL just fixed a 20-year-old bug where cascade deletes silently skipped triggers
MySQL bug #11472 was filed in 2005: triggers never fired on foreign key cascade actions, silently breaking audit logs. MySQL 9.7 finally closes it via WL#17024.
Open Source·
Microsoft just open-sourced 86-DOS. Tim Paterson's 45-year-old listings are now on GitHub under MIT.
Yufeng Gao and Rich Cini scanned Tim Paterson's 1981 assembler printouts. Microsoft pushed them to DOS-History/Paterson-Listings on April 28, the 45th anniversary.
Hardware·
AMD walled off Linux Vivado behind a paid tier. The free FPGA tier is now Windows only.
Vivado 2026.1 introduces a five-tier licensing model. The free BASIC tier supports Windows only; Linux requires the paid CORE tier. FPGA hobbyists are pushing back.
Security·
Google's bug tracker auto-published exploit code for an unpatched Chromium flaw. The bug is still live.
Chromium Issue 1396278 went public on May 20 because Google's tracker auto-clears restrictions on stale closed bugs. The flaw, reported in 2022, was never fixed.
Web·
Cloudflare rebuilt Browser Run on its own Containers. Concurrency went from 30 to 120.
Cloudflare moved Browser Run off shared isolation infrastructure on May 13. The agentic-coding crowd gets four times the headless-Chrome ceiling and half the latency.
Open Source·
C# is getting union types in version 15. The preview shipped in .NET 11 Preview 2.
Mads Torgersen's union proposal landed in .NET 11 Preview 2 on April 2. C# 15 targets November 2026 and replaces the OneOf library hack the .NET community has been living with.
AI·
Microsoft is canceling Claude Code for its engineers. They have until June 30 to switch to Copilot CLI.
Internal Claude Code licenses end June 30, 2026, for Microsoft's Experiences + Devices group. Engineers move to GitHub Copilot CLI instead.
Open Source·
yt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.
yt-dlp's maintainer bashonly says Bun's Rust rewrite 'has taken a turn towards being fully vibe-coded.' The supported window narrowed to four versions.
AI·
Karpathy posted four notes about Claude Code. The CLAUDE.md they spawned has 110K GitHub stars.
Forrest Chang turned Andrej Karpathy's January coding thread into a 70-line CLAUDE.md. It now has 110,000+ stars and has trended on GitHub for 28 weeks.
Security·
GitHub's internal repos were breached. The attacker came in through a poisoned VS Code extension.
GitHub detected the intrusion on May 18 after a malicious VS Code extension compromised an employee's device. The attacker claims to have exfiltrated 3,800 internal repositories.
Security·
A CISA contractor left GovCloud admin keys on public GitHub. The file was named 'Important AWS Tokens.txt'.
GitGuardian found a public CISA repo with 844 MB of secrets, including AWS GovCloud admin keys. The repo sat open for six months.
Security·
A bad command-line parser turned every claude-cli:// link into a remote shell
Joernchen of 0day.click found a deeplink RCE in Claude Code. Anthropic shipped the fix in 2.1.118 the same week.
Open Source·
Cloudflare taught wasm-bindgen to catch a Rust panic. Workers no longer poison the sandbox.
Three Cloudflare engineers shipped panic and abort recovery into wasm-bindgen on April 22. A Rust Worker that panics now reinitialises on the next request.
Web·
Atlassian laid off the engineer who built its edge. He published the blueprints.
Vasilios Syrakis spent eight years building Atlassian's Envoy control plane. After the March cuts, he posted a 40-minute walkthrough that hit 1.1M views.
AI·
Anthropic bought Stainless, the startup that builds every official SDK for OpenAI and Google.
Anthropic announced May 18 it acquired SDK generator Stainless, reportedly for over $300M. The same toolchain still powers OpenAI's, Google's, and Cloudflare's official clients.
AI·
OpenAI's Codex moved into the ChatGPT mobile app. You can approve a diff from the train now.
OpenAI shipped Codex remote control inside the ChatGPT app for iPhone, iPad, and Android on May 14. Pair via QR; the agent runs on your laptop, the review moves to your phone.
Open Source·
Bun's million-line Rust rewrite is now mainline. 99.8% of tests pass and 13,000 unsafe blocks remain.
Jarred Sumner merged the Bun-in-Rust PR on May 14, ending Zig as Bun's runtime language. Binary shrinks 3-8 MB; one analysis counted 13,000 unsafe blocks.
Open Source·
120 million plugin downloads later, Obsidian moved off GitHub. Paid plugins are now allowed.
Obsidian launched Obsidian Community on May 12. The new directory replaces the GitHub plugin queue with automated reviews, and paid plugins are in for the first time.
AI·
Airbnb says AI writes 60% of its new code. Nobody has explained what that means.
Brian Chesky dropped the 60% figure on an earnings call without defining how Airbnb measures it. Google claims 75%. The independent average is 27%.
Security·
TanStack published its npm supply-chain postmortem. The attack chained three GitHub Actions flaws.
Attackers compromised 42 TanStack packages through a pull_request_target exploit, cache poisoning, and OIDC token theft. An external researcher caught it in 20 minutes.
Web·
GitLab is cutting staff and killing its CREDIT values. The CEO calls it 'Act 2.'
CEO Bill Staples announced a restructuring he frames around agentic AI, retiring GitLab's six core values for three new operating principles. Exact layoff numbers come June 2.
Open Source·
RPCS3's maintainers will ban contributors who submit undisclosed AI pull requests
The PS3 emulator project posted on X on May 10, citing 'AI slop' that has been clogging review. The hard line: ban-on-sight if you don't disclose.
Open Source·
Jarred Sumner rewrote 960,000 lines of Bun from Zig to Rust in six days. He might throw it all away.
Bun's creator used Claude to port the JavaScript runtime from Zig to Rust, hitting 99.8% test compatibility. He says there's a 'very high chance' it gets scrapped.
Security·
380,000 vibe-coded apps are sitting on the open web. 5,000 of them are leaking real data.
RedAccess found that AI coding tools like Lovable, Base44, and Replit default to public hosting, leaving medical records, bank internals, and corporate secrets indexed by Google.
Web·
Cloudflare cut 1,100 jobs on its best earnings day. Revenue grew 34% and the stock dropped 18%.
Cloudflare laid off 20% of its workforce on May 7 while reporting record Q1 revenue of $639.8M. The stock dropped 18% after hours.
Web·
VS Code shipped 'Co-Authored-by Copilot' on every commit by default. Microsoft is reverting it.
A two-line PR flipped the AI co-author flag from off to all in April. Hand-typed commits started getting Copilot attribution. The maintainer apologized and promised a fix in 1.119.
AI·
GitHub Copilot's Claude Opus multiplier jumps to 27x on June 1. Monthly plans dodge the hike.
GitHub's new model multiplier table for Copilot Pro and Pro+ annual plans lands June 1. Opus 4.6 goes 3 to 27. Sonnet 4.6 goes 1 to 9.
Gaming·
Panic banned generative-AI art and audio from the Playdate Catalog. Code assistance still gets a pass.
The Playdate Catalog will no longer accept titles that use ChatGPT, Stable Diffusion, or Suno output for art, audio, text, or dialog. Existing titles get a label.
Open Source·
Microsoft open-sourced the earliest known DOS code, transcribed from a stack of Tim Paterson's printouts.
MIT-licensed at GitHub on April 28, the 86-DOS 1.00 kernel and PC-DOS development snapshots were OCR'd from 45-year-old assembler listings.
Open Source·
An unofficial Notepad++ port finally landed on Mac. Don Ho didn't write it.
Andrey Letov shipped a native macOS Notepad++ port as a universal binary with the original Scintilla engine and a new Cocoa UI. It's GPL, free, and unaffiliated with Don Ho.
Open Source·
Zed 1.0 ships its agentic editor. The Atom team's Rust rewrite finally has a stable label.
Zed Industries shipped 1.0 on April 29 after five years of Rust and GPU work. Free forever for humans, with $10/month hosted AI and an open Agent Client Protocol.
Open Source·
Mitchell Hashimoto is pulling Ghostty off GitHub. The reason is daily outages.
Ghostty's creator has tracked GitHub outages every workday for months. After 18 years on the platform, he's moving the project. A read-only mirror stays.
Open Source·
Warp's terminal is now open source. The cloud agent platform Oz is the actual product.
Warp released its 36k-star Rust client on GitHub under AGPLv3 on April 28. OpenAI is the founding sponsor and Oz keeps the bills paid.
Security·
Wiz found an RCE in GitHub's git-push pipeline. The patch shipped in six hours.
CVE-2026-3854 is a CVSS 8.7 RCE in GitHub's git-push pipeline. github.com fixed it within hours. 88% of Enterprise Server installs were still vulnerable at disclosure.
AI·
Disney built an AI leaderboard. One employee called Claude 460,000 times in nine days.
Leaked internal Disney screenshots show 4,800 product and tech staff burning 3.1 billion Claude tokens and 13.3 billion Cursor tokens across nine April workdays.
Security·
Adobe's Acrobat zero-day sat on VirusTotal for 136 days. Patch is APSB26-43.
CVE-2026-34621 is an actively exploited Acrobat and Reader bug that runs attacker JavaScript inside the PDF runtime. The first sample hit VirusTotal in November and went unflagged.
AI·
GitHub Copilot kills premium requests on June 1. Token billing arrives, fallback models do not.
On June 1 every Copilot plan switches to GitHub AI Credits priced per token. Code completions stay free. Fallback models and credit rollover do not.
AI·
OpenAI just retired SWE-bench Verified. The headline coding benchmark of 2025 is officially saturated.
OpenAI says SWE-bench Verified is saturated and contaminated, and 60% of remaining problems are unsolvable. Here's what comes next, and why every coding leaderboard is suspect.
Open Source·
Ubuntu 26.04 LTS ships Wayland-only, Rust coreutils, and post-quantum SSH by default
Canonical released Ubuntu 26.04 'Resolute Raccoon' on April 23. It's the first LTS without X11, ships kernel 7.0 and GNOME 50, and sets post-quantum SSH on by default.
AI·
GitHub Copilot paused new signups and kicked Opus out of Pro. Here's what actually changed.
GitHub froze Copilot Pro/Pro+/Student signups on April 20 and moved Claude Opus 4.7 behind the $39 Pro+ tier. Agent workflows broke the old math.
Hardware·
Framework's Laptop 13 Pro is a ground-up redesign: aluminum, 20-hour battery, $1,199 DIY
Framework opened pre-orders for the Laptop 13 Pro on April 21. Panther Lake or Ryzen AI 300, LPCAMM2, a 74Wh battery, and Framework's first touch display.
Security·
protobuf.js RCE: a 52M/week npm package was one bad type name from code execution
GHSA-xq3m-2v4x-88gg hits protobuf.js ≤8.0.0 / ≤7.5.4. Attacker-controlled schemas executed arbitrary JS on decode. One-line fix patched it.
Open Source·
Inside GitHub's fake star economy: 6 million bought stars and how to spot them
A Carnegie Mellon study counted 6 million suspected fake stars across 18,617 GitHub repos. Here's what the StarScout research actually found and how to read a star count now.
Open Source·
Ruby Central admits 'real financial jeopardy' seven months after the RubyGems takeover
Ruby Central cut its executive director, CFO, and PR firm, and shifted to a volunteer working board. The April 16 letter closes the arc from September's RubyGems walkout.
AI·
Anthropic shipped Claude Design. Figma stock dropped 7% the same day.
Anthropic launched Claude Design on April 17, a prompt-to-prototype tool that exports to Canva, not Figma. Figma's stock closed down 7% on the same day.
AI·
Cursor wants $50B for an AI editor that's burning cash on individuals
Cursor is in talks to raise $2B at a $50B valuation, nearly double its September mark. Revenue is up, but it's still losing money per indie seat.
Hardware·
A $5,000 open-source radar that sees 20 km, built by one engineer in Morocco
Nawfal Motii's Aeris-10 phased-array radar beats $250,000 commercial systems at 3% of the cost. Hardware, firmware, and FPGA bitstream are all on GitHub.
Open Source·
Rust 1.95 lands with if-let guards and a macro that kills cfg-if
Rust 1.95.0 stabilized cfg_select!, if-let guards in match arms, and a pile of new Vec and atomic APIs. Here's what's actually worth upgrading for.
AI·
Adobe's Firefly AI Assistant can now drive Photoshop, Premiere, and Lightroom for you
Adobe renamed Project Moonlight to Firefly AI Assistant and opened a public beta. It runs multi-step workflows across Photoshop, Premiere, Lightroom, and more.