DevHunt Daily
Dev tools & AI news, every day
Sunday, October 25, 2026
- 1SecurityHacker News
Brotli decoder flaw (CVE-2026-111497) impacts Node, Python, Bun and other HTTP libraries
A critical out‑of‑bounds write in Brotli versions 1.0.3‑1.2.0 allows remote code execution. The vulnerability affects Node.js, Python packages, Bun and several other runtimes that decode Brotli. Developers should upgrade to patched Brotli versions or disable Brotli decoding until updates are available.
- 2Dev toolsHacker News
Roku moves all developer repositories from GitHub to GitLab
Roku has transferred its developer documentation, sample apps, and SDK tooling repositories from GitHub to GitLab, keeping repository names unchanged. Developers need to update any bookmarked URLs, submodule references, CI pipelines, or AI indexing to the new GitLab paths. The migration aims to centralize Roku's open‑source resources in one location.
- 3Open sourceHacker News
bbtree claims to be the fastest Rust B-tree map implementation
bbtree is a no‑std, zero‑dependency B‑tree map that the author says is up to five times faster than the standard library's BTreeMap on a single thread and scales to 12× faster than crossbeam‑skiplist on 96 threads, while using less memory. Developers may consider it as a drop‑in replacement for ordered maps in performance‑critical code.
- 4AIHacker News
Cerebras details how it runs trillion‑parameter models across multiple wafers
Cerebras explains its method for fitting and executing a 3‑trillion‑parameter model on its WSE‑3T wafer‑scale chips, using layer partitioning, 4‑bit quantization and RDMA token passing. Developers interested in large‑scale AI hardware deployment can see the required wafer count and pipeline approach.
- 5AIGitHub Trending
Google Gemini CLI offers terminal AI access but is being replaced by Antigravity CLI
The open‑source Gemini CLI lets developers run Gemini models from the command line, with installation via npm, Homebrew, or other package managers. As of June 18 2026 it is superseded for unpaid and Google One users by Antigravity CLI and isn’t optimized for Gemini 4 Argon, so developers should consider switching for the latest model support.
github.com44 stars today - 6AIGitHub Trending
NVIDIA releases OpenShell 0.1 with sandboxed AI agent runtime
OpenShell 0.1 adds stable releases, new isolation primitives, and policy APIs for running autonomous AI agents safely. It enforces file, system call, and network policies via kernel sandboxing and formal verification, supporting Linux, macOS, and Windows (WSL). Developers can use Docker, Podman, or Kubernetes to deploy it.
github.com896 stars today - 7CloudGitHub Trending
Hallmark adds anti‑AI design skill for Claude Code, Cursor and OpenCode
Hallmark is a design skill that generates web pages while avoiding typical AI‑generated patterns. It supports 48 themes, custom prompts, and can redesign or audit existing pages, useful for developers using AI coding tools.
github.com455 stars today - 8AIGitHub Trending
Cindy launches as an open-source AI agent that runs locally
Cindy is a new open-source AI agent that works out of the box on a developer's machine, integrating models like Claude Code and Codex. It can automate tasks across desktop, mobile and browsers, and supports local or cloud‑based operation, which may interest developers looking for customizable AI assistance.
github.com477 stars today - 9Dev toolsGitHub Changelog
Copilot usage metrics API now includes usage from tools like OpenCode
The Copilot usage metrics API adds a new totals_by_client field that reports model requests and token usage from external tools such as OpenCode. This lets enterprise and organization owners see how non‑IDE tools consume Copilot, aiding governance and support decisions.
github.blog - 10SecurityVercel
Vercel Agent uses scoped plans to request permissions for production fixes
Vercel Agent first investigates a deployment issue with read‑only access, then presents a plan that details required actions and scopes before any changes are made. Developers can review and approve each plan, ensuring the agent only uses permissions the user already possesses.
vercel.com - 11EngineeringLobsters
Docker is weird: author highlights oddities in container runtime
The author built a simple container runtime and observed several surprising aspects of Docker, such as containers being just processes, images being simple directories, and the reliance on root privileges. The post also critiques Go’s suitability for low‑level container tasks. Developers may find the insights useful for understanding Docker’s internals.
- 12LanguagesLobsters
Wild 0.11.0 released with enhanced linker script support and Mac port progress
Wild 0.11.0 adds default Wasm linking, expanded GNU linker script features, and improved Mac support, allowing Rust linking on macOS. It also introduces performance tweaks, thread limits, and new command‑line options. Developers using Wild as a linker will benefit from broader script capabilities and better cross‑platform builds.
- 13Dev toolsLobsters
Emacs adds unified folding interface with kirigami.el
The author configures Emacs 32.0.50 to use kirigami.el, which consolidates multiple folding engines (Tree‑sitter, Hideshow, Outline, Org) under a single set of keybindings. This provides consistent behavior and performance across programming and markup modes, simplifying navigation for developers.
Saturday, October 24, 2026
- 1SecurityHacker News
OpenSSL 4.1.0 released with DTLS 1.3 support and new optimizations
OpenSSL 4.1.0 adds DTLS 1.3, GREASE extensions, IKEv2 KDF, and architecture-specific optimizations. It also introduces new build targets for MSVC 2013 and drops several legacy configurations. Developers should note changes to the tsget utility and the removal of no-ecdsa/no-ecdh options.
- 2SecurityHacker News
CVE Tracker site reports 394,368 vulnerabilities with monthly and yearly projections
The CVE Tracker at 0xosprey.com shows over 394,000 recorded vulnerabilities, with 12,688 added in the current month. It provides projections for future CVE counts, useful for developers monitoring security trends.
- 3LanguagesHacker News
UUIDv7 timestamps may drift and break monotonicity guarantees
The blog explains that RFC‑9562 allows UUIDv7 implementations to modify the embedded timestamp, which can cause timestamps to diverge from actual creation time and even run ahead of the system clock. Python's uuid.uuid7() demonstrates runaway timestamps when the clock is set back, affecting ordering and uniqueness expectations.
- 4AIGitHub Trending
Ziwei-doushu releases v4.0 dataset with 674,976 charts and 8.7 million interpretations
The open‑source Ziwei‑doushu engine published a new v4.0 dataset covering 674,976 Chinese astrology charts from 1950‑2026, providing 8,774,688 interpretation segments (~204 billion characters). The release includes updated algorithms, DST handling, and corrected textual references, useful for developers building astrology tools or data‑driven applications.
github.com546 stars today - 5Dev toolsGitHub Trending
PHP source repository details build, test, and contribution process
The php/php-src repository on GitHub contains the PHP interpreter source code, licensing information, and instructions for installing prebuilt binaries or building from source on various platforms. It also outlines testing procedures, extension management, and how to contribute via pull requests.
github.com716 stars today - 6Dev toolsGitHub Trending
Node.js repository provides runtime details and release schedule
The Node.js GitHub repository outlines the open-source JavaScript runtime, its governance, release types, download locations, and security verification steps. Developers can use this information to understand versioning, obtain binaries, and verify releases for their projects.
github.com66 stars today - 7SecurityCloudflare
Cloudflare launches post-quantum GeoKey Manager for regional key protection
Cloudflare introduced a post‑quantum GeoKey Manager in closed beta, allowing decryption keys to be unwrapped only on servers in specified geographies. The service uses hybrid ML‑KEM‑768 and X25519 encryption to protect keys against harvest‑now, decrypt‑later attacks while supporting data sovereignty requirements.
blog.cloudflare.com - 8WebCloudflare
Cloudflare adds Origin Range Requests to improve large file caching
Cloudflare released a self‑service Origin Range Requests feature that automatically coordinates partial fetches, reducing latency and bandwidth waste for large objects. The change removes the need to tune range sizes and works on all plans, benefiting developers serving media, downloads, or package files.
blog.cloudflare.com - 9Dev toolsVercel
Vercel CLI adds spend management commands
The Vercel CLI now supports viewing, setting, and removing team spend budgets, including a flag to pause deployments when the budget is reached. It also provides commands to list budget alert history with filtering options. Developers can manage costs directly from the command line.
vercel.com - 10CloudOpenAI
OpenAI details multi-tenant scaling of Habitat storage with Azure Cosmos DB
OpenAI explains how its Habitat storage platform was re‑architected for multi‑tenant use on Azure Cosmos DB, achieving faster reads and supporting over 500 PB of data for more than a billion users. Developers may learn from the trade‑offs between single‑ and multi‑tenant designs and the performance optimizations applied.
openai.com - 11SecurityOpenAI
OpenAI hardens frontier model training environments and adds high‑compute red‑team testing
OpenAI detailed new security measures for training and evaluating frontier AI models, including offline-only training, layered defenses, and a high‑compute red‑team program that uses powerful models to find and fix vulnerabilities. The changes aim to prevent models from escaping sandboxes or accessing the internet during development.
openai.com - 12AISimon Willison
Moonshot releases Kimi K3.1 Pro model with pricing and performance details
Moonshot added the Kimi K3.1 Pro model to its API, offering a standard and a Highspeed version that is 2‑3× faster at double the cost. Pricing is $2 per million input tokens and $10 per million output tokens, matching GPT‑6.1 Sol and half the price of Claude Opus 5.5. Developers can access it via OpenAI‑compatible endpoints such as the llm‑exe tool.
simonwillison.net - 13AIHacker News
ThinkingCap reduces token usage of Gemma-4-26B-A4B by up to 69% with minimal accuracy loss
Bottlecap AI released ThinkingCap‑modified Gemma‑4‑26B‑A4B that cuts average thinking tokens by 38.9% (up to 69.1%) while keeping overall accuracy within 0.15 percentage points. The model runs on the same vLLM stack, offering lower inference cost for developers using the original Google model.
- 14AIGitHub Trending
Claude-Red adds 78 offensive security skill files for Claude AI
Claude-Red is a library of 78 SKILL.md files that teach Claude AI red‑team techniques, covering web, cloud, AD, and more. Developers can drop these files into Claude’s skill system to get context‑aware guidance for authorized security testing and research.
github.com226 stars today
Friday, October 23, 2026
- 1SecurityHacker News
Linux kernel vulnerability reports mistakenly posted to public mailing list
Several high‑severity Linux kernel bugs were accidentally disclosed on the public LKML instead of the private security list. Patches are in testing or queued, but the issues remain unpatched in mainline, affecting developers tracking kernel security.
- 2SecurityHacker News
Security researcher shares method to bypass eMudhra's 1FA OTP login
A post on Mastodon details a complete bypass of eMudhra's one‑factor OTP authentication, exposing the public key used to encrypt OTPs and suggesting it can be used to forge login requests. Developers handling authentication should note the vulnerability and consider stronger multi‑factor protections.
- 3SecurityLobsters
CVE-2026-107891: musl libc regcomp integer overflows may cause crashes or code execution
The regcomp function in musl libc has multiple integer overflow bugs that can lead to incorrect allocation sizes and out‑of‑bounds heap writes. Exploiting these requires feeding untrusted regular expressions, potentially causing denial‑of‑service or arbitrary code execution. A patch is available and users should upgrade to version 1.2.7 when released.
- 4SecuritySimon Willison
PHP releases patches for two remote code execution flaws in 8.x line
The PHP Foundation issued an emergency update for all PHP 8.x versions to fix two RCE vulnerabilities after a leak caused premature disclosure. Developers should upgrade immediately to avoid exploitation.
simonwillison.net - 5Coding agentsGitHub Trending
Cloudflare releases security-audit skill for automated multi-phase code audits
The security-audit skill adds a coding‑agent capability to perform structured security audits in six phases, from reconnaissance to reporting, with machine‑readable findings. Developers can install it via the Skills CLI and run audits directly on codebases, receiving validated JSON reports and markdown summaries.
github.com2,979 stars today - 6Dev toolsGitHub Trending
Graphify maps codebases into local queryable knowledge graphs
Graphify converts a project's source code, documentation, and other assets into a deterministic knowledge graph using local AST parsing. It integrates with Claude Code, Cursor, and Gemini CLI via a /graphify skill, letting developers query the graph instead of grepping files.
github.com1,408 stars today - 7Dev toolsGitHub Trending
Supabase provides an open-source Postgres platform with auth, storage, and realtime APIs
Supabase offers a hosted or self‑hosted Postgres database with built‑in authentication, auto‑generated REST and GraphQL APIs, realtime subscriptions, edge functions, file storage, and AI tooling. Developers can use it as an open‑source alternative to Firebase for web, mobile, and AI apps.
github.com693 stars today - 8AIGitHub Changelog
GitHub Copilot adds PR explorer, BYOM preview, and NuGet autofix in Visual Studio
The September 2026 update for GitHub Copilot in Visual Studio introduces a Git agent that can summarize pull requests, a preview of Bring Your Own Model that requires a new agent harness, and a fixer action for NuGet vulnerability warnings. These features aim to streamline code review, model selection, and security remediation directly within the IDE.
github.blog - 9AIOpenAI
OpenAI partners with Poland’s NASK to advance AI safety and security
OpenAI and Poland’s NASK National Research Institute signed an agreement to collaborate on AI safety, security, and technical research. The partnership aims to evaluate AI risks, identify vulnerabilities, and strengthen safeguards, supporting a more resilient digital ecosystem for developers and users.
openai.com - 10AIOpenAI
Uber rolls out ChatGPT Work to 30,000 employees
Uber is deploying ChatGPT Work, an agentic platform within ChatGPT Enterprise, to its entire workforce of over 30,000 staff. The service integrates with tools like Google Drive, Gmail and Slack, and gives users access to OpenAI’s latest models, including GPT‑6.1 Sol. Developers note that Uber’s engineering teams will continue using OpenAI Codex for coding tasks.
openai.com
Archive
- Thursday, October 22, 2026 · 13 stories
Built something developers should hear about? Launch it on DevHunt: the week’s top launches make the news here.