Dafallah Ibrahim - The Daily Build

CPython is dropping its experimental copy-and-patch JIT — it never beat the interpreter by much, and it made you build with LLVM.

Open models don't emit tool calls; they emit text that gets regexed into JSON. Constrained decoding makes bad arguments impossible.

Context engineering is all over HN today. Its cheapest lesson: order prompts static-first and let prefix caching pay your LLM bill.

A new CVE shows how HTTP responses can end up executed by a shell. Here's how to find every remote-string-to-shell path in your code.

Cron fires again before the last run finished. flock adds a kernel-backed mutex in one line: no Redis, no lock tables, no stale locks.

eMudhra is exiting public TLS certs. Your certs depend on a company staying alive — here's how to audit and de-risk them today.

LiteLLM 1.107.0 on PyPI shipped a credential stealer. If your proxy ran it, every provider key is burned. Here's the playbook.

Plex bugs are being exploited in the wild to drop cryptominers. Here's how to audit your server and lock down remote access today.

A sysadmin says Namecheap seized all their domains. Deletion isn't needed — one EPP status flag takes any domain offline.

DeepSeek's V4.1-Flash just landed with open weights and 700+ HN points. Before you touch your router, run this 30-minute smoke test.

Anthropic's Claude Code team just published how they review code. The takeaway: every diff gets a machine pass before humans look.

Citizen Lab's AdFection report shows ad tech repurposed for zero-click spyware — and the identifier leakage we build into URLs is the fuel.