May 12: TeamPCP open-sourced the Shai-Hulud worm on GitHub. Datadog mapped its module pipeline (Loader/Provider/Collector/Dispatcher/Sender/Mutator) and Claude Code SessionStart hook for persistence. May 15: BreachForums opened a paid attack challenge. Detection notes for the copycat wave.
What to patch, rotate, and grep after OpenClaw 2026.4.22. Walks CVE-2026-44112/44113/44115/44118 as one chain on agent runtime, with detection log fields and 24h/1w response steps.
Why Google added BERT to search in 2019, how MLM training really works (15% mask, 80/10/10, WordPiece), and where encoder-only models still beat LLMs — rerank, classification, and OCR correction.
Khala open-source song generator needs 24GB+ NVIDIA VRAM, ~52GB weights, and still carries a 2026-05-07 quality warning. Notes on the 64-layer RVQ pipeline and generate API.
Tested Mageia 9 on a junk Dell Latitude 5310: SATA RAID hides the NVMe, BIOSConnect fakes USB boot failure, ifcfg-rh keeps Wi-Fi unmanaged until keyfile migration.
xAI x-algorithm second commit: Phoenix retrieval+ranking runs locally on 537k sports posts with 3GB artifacts. Ad blending and candidate isolation code added since January.
Tested on M1 Max 64GB ComfyUI: Anima-Base v1.0 matches preview3-base in speed; WAI-Anima kana LoRA hits 22% on light prompts but 67% with hood+robe+embroidery added.
Bun PR #30412 merged a Zig-to-Rust rewrite into main: 6,755 commits, 1M+ lines, binaries 3–8 MB smaller. Try via bun upgrade --canary, with notes on the claude/* branch workflow and why memory safety, not speed, drove it.
Malicious node-ipc 9.1.6/9.2.3/12.0.1 fire on require(), not postinstall. 12.0.1 is SHA-256 gated (targeted), so a working app isn't safe. Exfils dev/CI secrets via DNS TXT.
Elliptic curve group law, discrete log behind ECDH, and the Frey-Ribet-Wiles argument that proved Fermat's Last Theorem, walked through with diagrams of y² = x³ + ax + b, point addition cases, and the modularity logic chain.
Next.js CVE-2026-44578: WebSocket upgrades on self-hosted Node.js can SSRF to internal HTTP endpoints. Vercel unaffected. Fix is 15.5.16 / 16.2.5+, or 15.5.18 / 16.2.6 for May rollup.
Composer 2.9.8/2.2.28 fix CVE-2026-45793: GitHub's new GITHUB_TOKEN includes hyphens that Composer's old regex rejects, leaking the token into CI logs as plaintext.
