Engineering &
Security Wire
Curated from Hacker News, Lobsters, Krebs on Security, and other top sources. Updated every 6 hours.
Guide to data tools landscape for developers
Article URL: https://sinja.io/blog/data-landscape-guide-for-developers Comments URL: https://news.ycombinator.com/item?id=48935510 Points: 18 # Comments: 2
Kimi K3 is now live
Article URL: https://www.kimi.com/en Comments URL: https://news.ycombinator.com/item?id=48935342 Points: 208 # Comments: 94
Kimi K3: Open Frontier Intelligence
882 points, 526 comments on Hacker News
README, not
Comments
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
n8n, the workflow automation platform, handed out the wrong accounts at login. On Enterprise instances configured to trust more than one external token issuer, it matched an incoming JWT to a local user on the sub claim alone and ignored iss. A valid token from issuer A carrying a sub that belongs to someone under issuer B logged you in as them. Their password never
Goes-19 weather satellite enters Safe Hold mode
Article URL: https://www.spaceweather.gov/news/goes-19-safe-hold Comments URL: https://news.ycombinator.com/item?id=48934286 Points: 70 # Comments: 36
The LLM Critics Are Right. I Use LLMs Anyway
Comments
Show HN: I've built a words game based on binary search
Article URL: https://hilogame.cc/ Comments URL: https://news.ycombinator.com/item?id=48934092 Points: 31 # Comments: 26
What gdb frontend do you prefer (linux)
I found the basic gdb ui painful and gdb -tui confusing. I love dlv for golang debugging. Before I drop back to printf debugging is there a frontend I should try?
What "Memory Compiler" Actually Means: From Bitcells to GDS Tiling
Comments
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a technical report. "While the number of C2 [command-and-control] domains is currently small, the daily
New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
ClickLock Stealer, a new macOS infostealer, answers a victim's refusal by killing their apps on a loop until they hand over the login password. It arrives as a command pasted into Terminal, asks for the password behind a fake system dialog, and when the victim cancels, installs two LaunchAgents and quietly exits. At the next login, Finder, the Dock, Spotlight, Terminal, Activity Monitor, and
Introduction to KizunaShelf: A shelf for everything you love
Article URL: https://mudkip.me/2026/07/16/Introduction-to-KizunaShelf/ Comments URL: https://news.ycombinator.com/item?id=48933581 Points: 19 # Comments: 3
Sony Deletes a Bunch More Movies from the Accounts of People Who 'Bought' Them
Article URL: https://www.techdirt.com/2026/07/15/sony-deletes-a-bunch-more-movies-from-the-accounts-of-people-who-bought-them/ Comments URL: https://news.ycombinator.com/item?id=48933419 Points: 242 # Comments: 117
The Act and the Outcome of Creation
Article URL: https://www.ssp.sh/blog/on-creation/ Comments URL: https://news.ycombinator.com/item?id=48933370 Points: 23 # Comments: 5
Let's Build PlanetScale from Scratch: Infrastructure
Article URL: https://onatm.dev/2026/07/16/homescale-part-1/ Comments URL: https://news.ycombinator.com/item?id=48933303 Points: 79 # Comments: 16
20+ Hijacked Government Websites Became an Attack Channel
More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions. The investigation revealed previously undocumented backdoor behavior, hidden infrastructure relationships, and multiple attack arms behind a campaign
How Our Rust-to-Zig Rewrite Is Going
Article URL: https://rtfeldman.com/rust-to-zig Comments URL: https://news.ycombinator.com/item?id=48933149 Points: 118 # Comments: 26
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands
Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding assistant to apply a maintainer's fix from a GitHub thread, and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task. Each one just corrupts the facts it trusts and lets it carry on with the job you
perldelta - what is new for perl v5.44.0
Comments
Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm, along with a previously unreported backdoor dubbed Stupig. Daxin ("srt64.sys"), as the kernel-mode rootkit is referred to, was first documented by Broadcom-owned Symantec in March 2022, with evidence indicating its use in targeted attacks aimed
Developing and Deploying a Platform that the Business Understands and Developers Actually Want
A lot of platform teams face a problem: they build a lot of really cool stuff, and then their developers don't use it. Be visible to management, talk to stakeholders and listen to their problems, make your value measurable with metrics like DORA, create narratives, and show the hidden pain to make it personal: these are lessons that Lucas Hornung and Christian Matthaei presented. By Ben Linders
I resurrected an 8-year-old dead CSS library and gave it an engine
Article URL: https://usevivace.dev Comments URL: https://news.ycombinator.com/item?id=48932889 Points: 4 # Comments: 0
Track your workout from the iPhone Lock Screen
Article URL: https://musklr.com/blog/2026/iphone-lock-screen-workout-tracking-live-activity/ Comments URL: https://news.ycombinator.com/item?id=48932784 Points: 29 # Comments: 26
Ente – Opening Our Books
Article URL: https://ente.com/open/ Comments URL: https://news.ycombinator.com/item?id=48932697 Points: 132 # Comments: 38
Presentation: The Rust High Performance Talk You Did Not Expect
Ruth Linehan explains how migrating high-performance caching services from Kotlin to Rust shattered internal preconceptions around delivery velocity and engineering overhead. She discusses the ergonomics of the Rust borrow checker, shares how compile-time safety shortens the developer feedback loop, and profiles how tools like Criterion and flamegraphs optimize concurrent code paths. By Ruth Linehan
AI Agents with Cloud Credentials Are Outrunning Billing Guardrails Built for Human-Speed Mistakes
A three-person agency received a $14,000 AWS bill in one day after attackers extracted static access keys and burned Claude invocations on Bedrock. Combined with May's DN42 incident, where an autonomous agent provisioned $6,531 of oversized infrastructure in 24 hours, practitioners warn that cloud billing lags roughly a day behind agent-speed spend. By Steef-Jan Wiggers
OnePlus halts operations in USA and Europe
Article URL: https://community.oneplus.com/thread/2170715118587871237 Comments URL: https://news.ycombinator.com/item?id=48932539 Points: 350 # Comments: 193
AI Can Find Bugs, But Human Knowledge Still Proves Them
Artificial intelligence (AI) is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive testing workflows at impressive speed. That is a real advantage for security teams. It also
Forgejo v16.0 is available
Comments
Aggregated from public RSS feeds & the Hacker News API · All links point to original sources · Clawship does not republish full articles