1. Railway Security(Compromise) Disclosure (blog.railway.com)

Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention

Railway has identified unusual activity in its systems that manage customer environment variables, indicating a potential security compromise. Immediate action is advised to address the situation and protect sensitive information.

2. PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619 (thephp.foundation)

Describing the story behind how critical security vulnerabilities were found and fixed.

Learn about the critical security vulnerabilities CVE-2026-109618 and CVE-2026-109619, including how they were discovered and the measures taken to address them. This overview provides insight into the ongoing efforts to enhance PHP security.

3. No More Icons in Every Menu by Default (blog.jim-nielsen.com)

Have you heard the good news? I bemoaned the approach of putting an icon in every menu item by default which shipped with macOS Tahoe — but now it’s gone in…

Apple has removed the default setting that added icons to every menu item in macOS Tahoe, addressing user complaints about the cluttered interface. This change aims to streamline the user experience and simplify navigation.

5. Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.

A malicious version of LiteLLM 1.107.0 has been distributed on PyPI, which includes a credential stealer and a backdoor that activates with every Python startup. The article details how this compromised package was introduced, what sensitive information it targets, and how to identify if your system has been affected.

6. Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds (scotthelme.co.uk)

One of eMudhra's certificate authority private keys is the number 4.

Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their

A security researcher has uncovered that some of eMudhra’s certificate authority private keys are alarmingly simple numbers, including just “4” and “56.” This vulnerability raises serious concerns about the integrity of digital certificates and the potential for widespread exploitation.

7. Claude Duet (claude.com)

Claude Duet is a personal AI agent you message. It handles your inbox, calendar and follow-ups and messages you when something needs you. Join the waitlist.

Claude Duet is an AI assistant that manages your email, calendar, and reminders, alerting you when your attention is needed. You can sign up for the waitlist to be among the first to try it out.

8. Why Windows 11 still ships with Windows 95's memory manager hidden inside it (www.windowslatest.com)

Windows 11 still carries Windows 95’s heap manager, recompiled for old apps. Raymond Chen explains EmulateHeap, and how to find it yourself.

Windows 11 includes a hidden version of Windows 95’s memory manager to support legacy applications. Learn about EmulateHeap and how it functions within the modern operating system.

9. Google's Rust Style Guide (google.github.io)

Style guides for Google-originated open-source projects

Google has released a style guide for Rust, aimed at standardizing coding practices for its open-source projects. This guide is essential for developers looking to maintain consistency and quality in their Rust code contributions.

10. Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case (www.cnbc.com)

Meta to pay $25 billion in penalties related to Cambridge Analytica scandal in New Mexico.

Meta faces a hefty $25 billion penalty in connection with the Cambridge Analytica scandal, marking a significant legal outcome in New Mexico. This development highlights ongoing accountability issues surrounding data privacy and corporate misconduct.

12. DuckDB 2.0.0 LTS "Cinnamon Teal" (duckdb.org)

The DuckDB team is happy to announce that today we're releasing DuckDB version 2.0.0 LTS, codenamed “Cinnamon Teal” (Spatula cyanoptera). This is our biggest feature release so far, and it ships a polished version of the Quack protocol, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, an extensible SQL parser and much more, built from close to 20,000 commits since DuckDB 1.5.

DuckDB version 2.0.0 LTS introduces significant enhancements including the polished Quack protocol, asynchronous I/O, and a new VARIANT type, along with features like agent mode and triggers. With nearly 20,000 commits since the last version, this release marks a major milestone for the database project.

15. Tiny possum and glider thought extinct for 6000 years found in remote West Papua (www.bbc.com)

The discovery of two lost species is 'exceptional' and rare, scientists say

Researchers have identified two species of possum and glider previously believed to be extinct for 6,000 years in a remote area of West Papua. This remarkable find highlights the importance of biodiversity and conservation efforts in unexplored regions.

16. EA is shutting down BioWare (www.theverge.com)

The company is also laying off around 400 staffers.

EA’s decision to close BioWare comes with significant layoffs, impacting around 400 employees. This move raises questions about the future of the beloved game studio and its franchises.

20. Updated PHP version released to GitHub (github.com)

Tag for php-8.2.35

PHP version 8.2.35 has been released on GitHub, bringing updates and improvements to the language. Developers can check the latest changes and enhancements in this new tag.

21. Claude Duet (claude.com)

Claude Duet is a new app where Claude works as a proactive agent. The research preview opens by waitlist today for Pro and Max subscribers in the US.

Claude Duet is an innovative app featuring a proactive agent designed to enhance user experience. Currently, it’s available for Pro and Max subscribers in the US through a waitlist system.

22. Launch HN: Alter (YC S25) – Access control for multi-user agents (alterauth.com)

PAM for AI agents, enforced at runtime: vaulted credentials, per-action policy, approval before risky calls complete, and an audit trail for every call through Alter.

Alter is developing a solution for managing access control in multi-user agents, addressing common issues faced by teams using shared API keys for systems like CRMs. Their approach aims to enhance security and user management in collaborative environments, especially for tools integrated with platforms like Slack.

25. Canary Tokens (canarytokens.org)

Canarytokens is a free tool that helps you discover you’ve been breached by having attackers announce themselves.
The tokens allow you to implant traps around your network and notifies you as soon as they are triggered.

Canarytokens is a free security tool that lets you set traps within your network to detect breaches. It alerts you immediately when these traps are triggered, helping you identify potential attackers.

26. Drupal is now light-years ahead of its reputation (dri.es)

DrupalCon Rotterdam 2026 DriesNote presentation.

The recent DriesNote presentation at DrupalCon Rotterdam 2026 highlights significant advancements in Drupal’s capabilities, suggesting a shift in perception about the platform’s performance and potential. Attendees can expect insights on how these developments position Drupal as a leading choice for web development.

29. The bridge to agent-scale Git infrastructure (github.blog)

We moved a copy of 99.99999% of GitHub's repositories to Azure. Here's how per-reference quorums will bring over the rest.

Learn how a massive migration of GitHub’s repositories to Azure is being handled, and discover the innovative per-reference quorums that will facilitate the completion of this transition.

Article Details

Browse by Date

Type to search HN and engineering blog articles
Press Escape to close  |  ↑↓ to navigate  |  Enter to open