Bun PR #30412 merged a Zig-to-Rust rewrite into main: 6,755 commits, 1M+ lines, binaries 3–8 MB smaller. Try via bun upgrade --canary, with notes on the claude/* branch workflow and why memory safety, not speed, drove it.
Malicious node-ipc 9.1.6/9.2.3/12.0.1 fire on require(), not postinstall. 12.0.1 is SHA-256 gated (targeted), so a working app isn't safe. Exfils dev/CI secrets via DNS TXT.
Elliptic curve group law, discrete log behind ECDH, and the Frey-Ribet-Wiles argument that proved Fermat's Last Theorem, walked through with diagrams of y² = x³ + ax + b, point addition cases, and the modularity logic chain.
Next.js CVE-2026-44578: WebSocket upgrades on self-hosted Node.js can SSRF to internal HTTP endpoints. Vercel unaffected. Fix is 15.5.16 / 16.2.5+, or 15.5.18 / 16.2.6 for May rollup.
Composer 2.9.8/2.2.28 fix CVE-2026-45793: GitHub's new GITHUB_TOKEN includes hyphens that Composer's old regex rejects, leaking the token into CI logs as plaintext.
Fragnesia (CVE-2026-46300) overwrites the Linux page cache via XFRM ESP-in-TCP. The Dirty Frag workaround still applies, but IPsec hosts need to check side effects first.
Uniswap's constant product x*y=k explained: why product instead of sum, IL as selling volatility, JIT liquidity on V3 concentrated liquidity, and amountOutMinimum against sandwich attacks.
137 CVEs, no zero-days. Netlogon and DNS Client RCEs (both CVSS 9.8) lead — compared against ZeroLogon/SIGRed, with patch priority tiers and detection notes for SOC teams.
Andrew Quinn shrank a Finnish dictionary from 3GB SQLite FTS to a 10MB FST binary. The 300× win required prefix search, agglutinative inflection, static data, and shared suffixes.
CVE-2026-42945 hits nginx 0.6.27–1.30.0 rewrite module with heap overflow. CVSS 9.2 but only fires on specific rewrite+capture+set patterns. How to check with nginx -T and what to patch.
Verdict on GTIG's May 11, 2026 report: the first confirmed AI-generated zero-day, a Python 2FA bypass for an OSS admin tool, was caught by a hallucinated CVSS score and textbook Pythonic code structure.
