Python Killed Its JIT. What Makes Python Fast Now?

CPython is dropping its experimental copy-and-patch JIT — it never beat the interpreter by much, and it made you build with LLVM.

Why Your vLLM Tool Calls Break at Random

Open models don't emit tool calls; they emit text that gets regexed into JSON. Constrained decoding makes bad arguments impossible.

Freeze Your Prompt Prefix, Cut Your LLM Bill

Context engineering is all over HN today. Its cheapest lesson: order prompts static-first and let prefix caching pay your LLM bill.

HTTP2Shell: The Response Is the Payload

A new CVE shows how HTTP responses can end up executed by a shell. Here's how to find every remote-string-to-shell path in your code.

The One-Line Fix for Overlapping Cron Jobs

Cron fires again before the last run finished. flock adds a kernel-backed mutex in one line: no Redis, no lock tables, no stale locks.

A CA Just Quit the TLS Business. Check Your Chain

eMudhra is exiting public TLS certs. Your certs depend on a company staying alive — here's how to audit and de-risk them today.

LiteLLM 1.107.0 Steals the Keys It Was Guarding

LiteLLM 1.107.0 on PyPI shipped a credential stealer. If your proxy ran it, every provider key is burned. Here's the playbook.

Your Plex Server Is Now Someone's Cryptominer

Plex bugs are being exploited in the wild to drop cryptominers. Here's how to audit your server and lock down remote access today.

Your Registrar Can Unplug You With One Status Code

A sysadmin says Namecheap seized all their domains. Deletion isn't needed — one EPP status flag takes any domain offline.

DeepSeek Shipped a Flash Model. Smoke-Test It First.

DeepSeek's V4.1-Flash just landed with open weights and 700+ HN points. Before you touch your router, run this 30-minute smoke test.

The First Reviewer on Your PR Shouldn't Be Human

Anthropic's Claude Code team just published how they review code. The takeaway: every diff gets a machine pass before humans look.

How Targeted Ads Deliver Zero-Click Spyware

Citizen Lab's AdFection report shows ad tech repurposed for zero-click spyware — and the identifier leakage we build into URLs is the fuel.

Go 1.27 Finally Fixes HTTP/1 Connection Churn

Go's default Transport keeps just 2 idle connections per host. Here's the churn behind your p99 spikes — and the one-line fix.

The New JavaScript Decorators Are Not What You Remember

Standard decorators landed in TypeScript 5: no descriptors, a context object, and auto-accessors. Here's the API you'll actually use.

Your AI CLI Just Installed a Daemon

Codex CLI now installs a persistent, self-updating daemon by default. Here's how to audit your machine before it updates itself again.

A Literal ~ in Your PATH Hijacks Commands

PATH entries aren't shell-expanded. A quoted tilde becomes a relative directory — and anyone who creates a dir named ~ owns your shell.

Microsoft Just Shipped a Sandbox for Agents

Mxc 1.0.0 brings policy-driven containment for AI agents to Windows. If your agent can read ~/.ssh, you need this pattern — today.

Cloudflare Bought Deno — Now What for Your Code?

Deno, the TypeScript runtime from Node's creator, is now a Cloudflare company. What it means for your edge deploys and JSR packages.

DuckLake: ACID Transactions on Plain Parquet

DuckLake hit HN today: the catalog lives in SQLite or Postgres, the data is Parquet on S3, and you get ACID and time travel in plain SQL.

Chrome Ships JPEG XL — Your JPEGs Can Shrink 20%

Chrome now ships JPEG XL. You can losslessly shrink every existing JPEG by ~20% — pixel-identical. Here's how to adopt it safely.

TypeScript's satisfies Keeps Your Literals Alive

The satisfies operator type-checks your object literals without widening them to string. Keep exact types, key autocomplete, and typo checks.

Two Processes, One Port, Zero Downtime

SO_REUSEPORT lets many processes bind one port while the kernel spreads connections — zero-downtime restarts with no load balancer.

A 125B Model Just Hit 100 t/s on One RTX 4090

Qwen 3.8 Flash Next (125B) runs at 100 tokens/sec on a single consumer GPU. The math that makes it possible — and what it changes.

Your AI Agent Needs a Hard Spending Cap

Simon Willison is right: soft limits don't stop runaway agents. Here's how to enforce hard caps on tokens, dollars, and time in your code.