Pinned Tweet
The Founder-Parent Paradox:
You're building a business to provide a better future for your family, but the act of building it takes you away from your family in the present.
The ultimate balancing act.
This week is BRUTAL for devs everywhere.
Monday vs today 😭
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Sam Altman told @MatthewBerman he has "not read or even looked at a line of code in probably a year."
If he ever writes code by hand again, it'll be "like a revolutionary war reenactment" 💀
Funny line, but somebody still has to read what the agents ship.
Asked about OpenAI's moat, he said the old moats keep working.
The caveat: if people "really pushed on RSI", the tech could become the moat. He called that "a very dangerous thing to push on" and said the world needs "speed limits or whatever on how quickly we let RSI go."
It just.. keeps.. coming 🤯
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
So.. LinkedIn Recruiter wants $170 a month per seat. Treg Recruit charges about $0.20 per candidate.
At a small product studio like ours we don't hire every month. Paying for a recruiting seat that sits idle most of the year will never makes sense to me.
Pay per candidate, and run it from the agent I already use all day, get verified contact details back. That's a model I'd actually use 🙌
🤝 Paid partnership
Introducing OpenSource Recruiter for Claude
- Paste any job post → 50 ranked candidates
- Personal email + mobile, $0.20/candidate
- No $170/mo seat, no 30-InMail limit
- 0% markup, fully open source
Try it at treg.to/recruit
Repo link below 👇
A truly exhausting week in the software factory. Never seen so much exploits in one day in my whole career.
HugOps to all fellow devs out there!
Ruby 4.0.8 is out with an Onigmo regex overflow fix that looks like the root cause here.
github.com/ruby/ruby/release…
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
It’ll get worse before it gets better. 😬
But we’ll get through this!
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
In 2016 Jensen Huang delivered a DGX-1 to OpenAI. One petaflop, 128 GB, and it "took two people to carry upstairs."
At GTC Berlin he held the same headline specs in one hand. 👇
Anthropic’s answer to Grok Bot and others is here 👀
I should try that for zentty.org 😁
