Postgres tenant-isolation tests should use the app's database role. Table owners normally bypass RLS. Your admin connection is a lousy stand-in for a customer.

Rebuilt Windows binaries with updated brotli version are available: php.net/archive/2026.p…

#php #windows

pi-mcp-adapter keeping the raw output matters more to me than its neat extracted fields. A wrong answer is easier to debug when the evidence hasn't been thrown away.

Why NixOS is freaking magical for AI:

Yes I fetch all the binaries from cache.nixos.org but if I need to debug why something isn't working you can literally request the exact source code used to build the package in a single second. I constantly use this to dive into issues

$SGRY +46% at $23.03 (11:01 ET) on HealthSpan's $23.50 cash deal. Watch whether the $0.47 discount widens. Q1 2027 closing is subject to shareholder and regulatory approvals.

Rust's memory safety won't save a half-read protocol frame. Tokio lists read_exact as cancellation-unsafe; racing it against a timeout needs a plan for the bytes already consumed.

Have you ever wondered why companies can charge $15 to send 1000 emails?

I started sending emails with just a TCP connection and OpenSSL to figure it out for myself! evancz.dev/why-is-it-so-e…

$XNCR +31% premarket at $32.96 (9:04 ET) after its Phase 1 XmAb819 update. Early data, not an approval. Watch whether the gap stays above Friday's $25.18 close.

Just shipped pi-mcp-adapter updates for making MCP work smoother:

On servers that support MCP Tasks, long-running tools now run async: the agent keeps working, and the result arrives when the job finishes.

Semantic tool search is sharper: mcp({ search, searchMode: "semantic" }) full schemas only for confident matches, so a search costs up to 5× fewer tokens.

Also: mcp({ tool, args, extract }) uses Cloudflare's Clairic to return just the values the agent asked for, not the whole result.

🚨 Brotli2Shell goes beyond HTTP2Shell.

CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.

JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.

We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.

Full research and technical details in our blog 👇

A SQLite schema can declare foreign keys while a connection doesn't enforce them. I'd rather fail startup than discover my relational database has been taking suggestions.

I'd let an agent pick an OpenRewrite recipe before I'd let it wave through its own diff. A named transformation gives the merge gate something firmer than 'looks equivalent to me'.

💎 Hidden gem in React Hook Form: <Form />

No more manual handleSubmit + fetch.

✅ Built-in validation
✅ Automatic FormData
✅ POST requests
✅ Submission state
Less boilerplate. More power.
react-hook-form.com/docs/useform/f…

TanStack Start letting you skip hydration is the kind of flexibility I want. A content site with one dropdown is a weak reason to send React to every reader.

Dessa's speech-only bet makes sense. A transcript can preserve every word and still lose the hesitation, sarcasm and timing that change what they mean.

It's here. Raven is now Open source!

A new Windows compatibility layer for Linux (and soon Mac OS). The website and code are now public alongside the whole story of the project, you can read about it here: useraven.org/news/introduci…

Waiting for your feedback, and please, be kind #Linux #Windows #MaxOS #OpenSource #Development

Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.

LiteLLM's release needed two engineers. An attacker holding both tokens passed that test. A second approval is worth less when the credentials share the same blast radius.

MAX's new source license makes the 'LLVM for AI' pitch hard to buy. It bars distributing independent source forks. Shared infrastructure needs an exit door when its owner and the community disagree.

Rule of thumb for MOST of you right now ———-> don’t expose anything to the internet.

- Close all those ports
- Put everything behind a firewall
- Use VPN for access

Keep coding all that personal software but keep your attack surface small.