TechPicks (by Tal Koren)

TechPicks 08/11/2026 - OpenSSH on musl linux (alpine, openwrt, etc.) has been letting people into password-less accounts since 2016 - sshhole.​com Libghostty 1.0 - mitchellh.​com Hacking the meta ray-ban smartglasses - p0pcycle.​com Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header - lkoskela.​fi Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 05/11/2026 - Tell HN: Gemini trains on chat history, even for subscribers (personal accounts) - news.​ycombinator.​com Bring Back Manual QA: AI Fixed What Made It Painful - thesashka.​com Introducing Adaptive Dark Mode - webkit.​org Worktrunk - a CLI for git worktree management, designed for running AI agents in parallel - github.​com Man-in-the-middle arbitrary code execution in Debian’s apt - lists.​debian.​org A Maintainer's Advice on Contributing to Open Source in 2026 - wasp.​sh So my ISP was hijacking my DNS - karthihegde.​dev Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 04/11/2026 - How I use AI (Oct 2026) - ben.​stolovitz.​com Like GPT-6 Astra, Qwen 3.8 27B can interpret model weights - simonwillison.​net Postman silently auto-installs AI plugins and attempts to share all API data - github.​com Modern CSS Might Make Your Front-End More Complex - smashingmagazine.​com The AI Layoff Experiment Is Backfiring - And Companies Are Quietly Rehiring Humans - gadgetreview.​com The Movement Physics of Super Mario Bros - Behind the Code - m.​youtube.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 03/11/2026 - WTF Ubuntu? - chalmovsky.​com We stopped installing npm packages less than a week old - brunoj.​com Astra can read and write weights to improve Qwen - rikiyat.​github.​io Anthropic confirms new Claude Code limits to prevent game cloning - tomshardware.​com The fastest double-to-string algorithm you’ve never heard of - vitaut.​net Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 02/11/2026 - Hitting Enter Isn't Understanding: Two Skills That Unclutter My Mind - thesashka.​com Pratt parsing is a black box - vinipsmaker.​github.​io No, npm, “estee” is not a typo of “testem” - smoores.​dev An outsider's perspective on Scion and Mononoke - typesanitizer.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 01/11/2026 - Mistral Large 4 (Le Chonk) is now open weight - mistral.​ai The Void SDK and Platform is open source now - blog.​cloudflare.​com Do the math: How we took over ChatGPT accounts - parameter.​ai How curl was accidentally Turing-complete for nine months - seriot.​ch Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

Weekly recap A lot of this week's reading included critical vulnerabilities needing attention. Broccoli2Shell is a reason to check your dependencies ASAP, with exploitation already reported and affected software including Node.js, Python packages and FFmpeg. The php2shell analysis, meanwhile, argues that its exploitation requirements make widespread attacks unlikely. I'd still patch, but I appreciate security coverage that helps us judge the urgency. The passkey story bothered me because the attacker registered their own passkey on the victim's account after a phishing attack. We spend a lot of time discussing how secure authentication methods are, but the process for adding one deserves just as much attention. Google's Gemini 4 Carbon also brought security into the AI discussion, with strong cyber benchmark results and access going to defenders first. I'm curious about the reported zero cheating and attack-success rates, though I'd want to see how those results translate into everyday use before getting too excited. For something less stressful, Start Doing Graph Theory is a free textbook that teaches through puzzles and proofs. I like having something like this in the feed. Keeping up with technology is important, but so does making time to learn something because it interests you, without needing it to fix a production issue on Sunday. :) Have a great weekend! Tal

TechPicks 30/10/2026 - Trojanized Claude Code Extension Plants an SSH Backdoor - opensourcemalware.​com Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions - thehackernews.​com We ran AI agent swarms in Minecraft and Mindustry - labs.​ycombinator.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 29/10/2026 - Gemini 4 Carbon - blog.​google Start Doing Graph Theory - vertex.​degree Apple's git still trusts the compromised eMudhra certificates - emudhra.​we-have-a-problem.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 28/10/2026 - OpenAI claims to have proved that the Exponential Time Hypothesis is false, invalidating many past results that relied on it being true - openai.​com A Modern CSS Guide to Responsive Web Design - stephcraft.​net Grim Test Finds That AI Has No Mercy for Humans Even When It's Causing Them to Suffer - futurism.​com AI promised less work. I've never worked more - oioannou.​com The Mythical Man-Month in the Age of AI - j11g.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 27/10/2026 - HTTP2Shell Vulnerability Affects .NET, FFmpeg, ClickHouse, and Apache Arrow - x.​com About the compromised eMudhra intermediate CAs - support.​apple.​com The passkey is worse - kcoleman.​me Why is it so expensive to send an email? - evancz.​dev From 27 minutes to 4: Cutting CI build time by 85% - alexitc.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 26/10/2026 - Hacker reverse engineers his Samsung TV and finds it takes screenshots for ads, records audio, maps networks, and more - x.​com LG Smart TVs Caught Mapping Your Network, Logging Audio With Screen Off - thecybersecguru.​com OpenAI and Anthropic cut their LLM prices by up to 80% within a few months. Why? - minimaxir.​com A 10-year-old neural network outperforms frontier LLMs for skin cancer diagnosis - lynchlab.​net The State of Context Engineering - dbreunig.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 25/10/2026 - Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more - broccoli2shell.​com Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps - aikido.​dev Why we're not seeing mass-exploitation of PHP2Shell yet - blog.​luitjes.​it Scrawl: show an agent the problem - scrawl.​kitlangton.​com Dolly - 34 scroll-driven camera moves in pure CSS - usedolly.​dev Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

Weekly recap One of eMudhra's certificate authority private keys was literally the number 4. Eight keys were recoverable from public certificates in under a second, and they'd existed since April 2025. Major browsers rushed to block them, but distros, runtimes and libraries need their own fixes. One awful mistake, a very scattered cleanup. This week's most important read, with a checker and workarounds included. On a more positive note, Sphinx blocks your push until you answer a question about your AI's diff. Annoying? Probably. But if you can't explain what you're shipping, a pause seems reasonable. The Decoherence Trap takes that worry further - agents making individually sensible changes until the codebase contradicts itself everywhere. I find that much more believable than most AI doomsday scenarios. Which made PostgreSQL's beta reverts encouraging - LLM-assisted review helped uncover edge-case defects, contributing to features being pulled. More AI finding reasons to slow down, please. And for a break from all that, adding emoji to Total Draw somehow required a custom renderer, manually assembled family emoji and a flag font. Seems like a small feature but it's actually a big one, and a very interesting read. That's it for this week. Have a great weekend 🙂 If you like these recaps, consider contributing to TechPicks by supporting the project, submitting a url, or simply following on X.

TechPicks 23/10/2026 - Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data. Node 20, 23 and 25 (all EoL) get no fix. - thehackernews.​com eMudhra to exit global SSL/TLS certificate business - emudhra.​com Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry. - news.​ycombinator.​com OpenShell – A safe, private runtime for fleets of autonomous AI agents - github.​com Examining the macOS gcc binary - zoey-on-github.​github.​io Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 22/10/2026 - PHP2Shell: Critical vulnerabilities in the backbone of the web - php2shell.​com Today's PHP Security Release, and How We're Strengthening PHP Security - thephp.​foundation Make yourself replaceable - maroun-baydoun.​com The Future of CSS - joshwcomeau.​com Firefox Local Mode - firefox-source-docs.​mozilla.​org Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TL;DR for Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software: What happened - eMudhra (emSign) issued eight intermediate CA certificates in April 2025 with badly generated keys. Anyone could recover the keys from the public certificates in under a second. - With a key, an attacker can forge a certificate for any website. - A researcher reported it on Oct 17 (4 days ago), Chrome and Firefox blocked the certificates that day, Apple on Oct 19, Microsoft on Oct 20. - Mozilla, Go and Cloudflare shipped fixes. Linux distros, curl, certifi and Electron updated their CA bundles. - Browsers are likely safe - curl, Python, Go, Node, Java and git do not check revocation by default, so they stay exposed until updated. - No attacks reported. Nobody can say if the keys were used before the block. What to do - Update your OS ca-certificates package, language runtimes and CA bundles. - Rebuild container images. - Do not turn off certificate verification to clear errors. Tal

TechPicks 21/10/2026 - Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software - emudhra.​we-have-a-problem.​com Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds - scotthelme.​co.​uk Protecting Firefox Users Following the Compromise of eMudhra Intermediate Certificates - blog.​mozilla.​org Go 1.27.3 and 1.26.10 Distrust Compromised eMudhra Intermediates - groups.​google.​com Upcoming Critical PHP Security Release - php.​net Introducing tsrs: a Port of TypeScript to Rust - blog.​cloudflare.​com North Korean malware that hides inside VS Code’s own files, and how to check your install - medium.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 20/10/2026 - CERN and Mistral team up on AI for science - home.​cern MiniMax M3.1 Flash released, weights due Oct 23 - minimax.​io RuneScape Bench: MMOs for Agents - youtube.​com PostgreSQL 19 reverts will continue until morale improves - peter.​eisentraut.​org Notes on incidents - seangoedecke.​com Ontology-driven observability, an end-to-end knowledge graph at Netflix scale - netflixtechblog.​com One Hash Bloom Filters - calabro.​io Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn

TechPicks 19/10/2026 - It's still OK to enjoy programming - chriskiehl.​com Sphinx – A hook that quizzes you on your AI's code before shipping - sphinx-six-theta.​vercel.​app The Decoherence Trap: When AI slop drowns out the signal in an endless sea of noise - maevyn.​codes How tough can emoji be? - totaldraw.​com Follow TechPicks - This edition | Share channel | Slack | X | Submit a url Support TechPicks: github.com/sponsors/dewbjorn