Just tried for the first time, holy crap, fast, easy, may need to open a few PR's for some things I'd love to see but bro, good work.
Over the last several days been watching the team get t3 pilled. There is a lot for a founder to learn from @theo on this journey from a product and business perspective.
I feel like this should be turned into a paid course for founders.
Zack Chapple retweeted
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
🚨 A MASSIVE internet security emergency is unfolding right now. 🚨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
→ NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
→ TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
→ Attackers could potentially take control of vulnerable servers remotely, without authentication.
→ Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
→ EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
→ Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
→ WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
→ Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
Thank you @NorthsideHosp Cherokee for helping get me fixed up. Going home today, I won’t miss the food but I do appreciate the doctors and staff who helped me.
Zack Chapple retweeted
If you aren’t sure if you are protected for php2shell we are making it one click to check.
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Zack Chapple retweeted
Tried tsrs, the Rust port of TypeScript 7 by @Cloudflare and @voidzerodev, on our monorepo at @ZephyrCloudIO.
Type-check, 36 tsconfig projects, cold:
25.8s → 8.5s (3x faster)
Peak memory on the largest project: 2.3 GB → 0.9 GB
Module federation type generation, 7 remotes:
12.4s → 4.0s (3.1x faster)
Peak memory on the largest remote: 1.4 GB → 0.6 GB
Zack Chapple retweeted
We just shipped an updated T3 Code Stable release with over 1,400 changes 🤯
Quick highlight reel of my favorites:
- Massive perf wins on desktop and mobile
- Add a project to another machine from the "Run on" menu
- EAS Simulator remote hosts for iOS dev
- PR diffs now show code vs tests vs docs at a glance
- Idle Claude threads compact early so the cache stays warm (beta)
- Mobile got a big native pass. It finally feels native
- `t3 doctor` can reclaim database space
- `t3 connect` now checks your machine is reachable, and errors say how to fix them
- Webhook tasks got filters and dedupe
- Skill discovery is much more reliable
- Tons of Windows, terminal, and scroll fixes
Least favorite: I caved, LaTeX renders on web and mobile
Also heads up, we're getting a bit more experimental with how we treat Nightly, so now would be a good time to move back to stable :)
Zack Chapple retweeted
I wanna thank @theo for T3Code which has enabled me to juggle harnesses efficiently enough to smoke 2 claude max accounts and a gpt pro account in 2 days.
Zack Chapple retweeted
🫡
Introducing tsrs: a Rust port of the TypeScript compiler 🦀
We are not forking TypeScript!
◆ In close collaborating with the TypeScript team
◆ Up to 8x faster than TS 7.0 & ~70% less memory
◆ Runs in WASM, so it works in your browser & on Workers
◆ Soon part of the Oxc toolchain
npx tsrs
blog.cloudflare.com/typescri…
the cloudflare connect registration needs some love. registered digitally so I can watch the @eastdakota keynote from the hospital and the page is no where obvious enough what I need to actually click to watch. Any of my @CloudflareDev @Cloudflare friend able to drop me the link?
First spinal epidural procedure (and hopefully last) is done. Now we wait 24 hours to see how it goes and if I can go home.
Zack Chapple retweeted
Cloudflare is taking ownership of tsrs, a port of TypeScript to Rust. It's 8x faster and uses 70% less memory than TypeScript 7.0.
We are not forking TypeScript – we are working with the TypeScript team and as a result 7.1 is already ~2.5x faster, too.
blog.cloudflare.com/typescri…
Zack Chapple retweeted
游戏开发的工作流真的要变天了。
Epic Games 官方刚刚在 GitHub 下场，悄悄开源了 unreal-engine-skills-for-claude-code-plugin，并且已经正式上架 Anthropic 官方插件市场。
以前用 AI 做虚幻开发，你只能让它在外面苦哈哈地写 C++ 代码片段；现在，Claude Code 可以直接通过 MCP 接管你正在运行的 Unreal Editor。
不用切窗口，一句话就能让它在引擎里帮你创 Actor、连蓝图节点、调材质、甚至K动画。
一、 核心亮点与工作机制解析
• 全编辑器域覆盖（30+ Toolsets，数百个底层工具）
配合虚幻引擎内置的 ModelContextProtocol 与 AllToolsets 插件，它通过 ToolsetRegistry 暴露了覆盖虚幻编辑器几乎所有核心模块的接口：
• 场景与蓝图：生成/移动/删除 Actor，直接创建蓝图、添加节点、连线（Pin）、管理变量并编译。
• 美术与视效：编写材质图（Material Graphs）、配置 Nanite/LOD/碰撞体、搭建 Niagara 粒子系统与 Dataflow 图。
• 动画与演出：构建 Control Rigs、状态树（State Trees）、行为树，控制 Sequencer 关键帧与摄像机轨迹。
• 玩法与测试：检视 GAS（Gameplay Ability System）状态、搭建 UMG 控件蓝图、自动发现并执行 C++ 自动化测试。
• 批量 Python 执行：支持通过 ProgrammaticToolset.execute_tool_script 将多步复杂操作打包为单个 Python 脚本在编辑器进程内直接跑完。
• 极客级 Token 优化：按需工具检索（Tool Search）
如果把几百个虚幻工具的定义一次性塞进上下文，瞬间就会把 Token 撑爆并破坏 Prompt Cache。Epic 官方采用了非常巧妙的 3 个元工具（Meta-tools）架构：
• 默认只暴露 list_toolsets、describe_toolset、call_tool 三个轻量接口（上下文开销极低，仅约 250+ tokens）。
• Claude 会在对话中按需动态检索工具集并在同一轮直接调用，既保证了 Prompt Cache 持续命中（Warm），又支持并发安全调用。
• 三大核心 Skills + 自动环境感知 Hook
• unreal-mcp：指导 Agent 如何通过实时 MCP 连接安全、高效地操作虚幻编辑器。
• create-toolset：指导开发者如何扩展 C++/Python 静态函数并注册到 ToolsetRegistry。
• unreal-skill：用于在虚幻项目内创建和复用专属的引擎级 Agent Skill（支持 Python 类或 /Game/Skills/ 下的 UAsset 资产）。
• SessionStart Hook（hooks/unreal-context.sh）：启动或恢复会话时自动注入 UE 规范提示，让 Claude 默认遵循 UObject、Slate、UHT 等虚幻编码准则。
• 断线重连代理（unreal_mcp_proxy）
游戏开发中编辑器经常需要重编译或重启。官方配套提供了可选的 unreal_mcp_proxy 守护代理——当 Unreal Editor 关闭或崩溃重启时，它能维持 Claude Code 侧的 MCP 会话不断开，并在编辑器恢复后自动重连。
Zack Chapple retweeted
We moved the Zephyr Cloud dashboard (1 host + 7 Module Federation remotes) from Rspack to Rsbuild 2 by @rspack_dev, then let Rsdoctor 2 drive the cleanup.
First load: 1,045 → 729 KB gzip (−30%)
Build: 112s → 90s (−20%)
15-route journey: 1,294 → 788 KB (−39%)
Numbers 🧵
What has nobody reverse engineered @Control4 yet? I'm so tired of being locked into someone who built out my home and no way to adjust things on my own. Or will I have to do it?
Zack Chapple retweeted
You can now select TanStack Start in create-rsbuild too
TanStack CLI now supports Rsbuild! 🦀
Create your next TanStack app with:
npx @tanstack/cli create my-app
Select React → Rsbuild, and start building.
Quick update on hospital stay. I'm sitting up now and able to walk for the first time last night since Wednesday last week. Lyrica is an amazing nerve drug that did much of the magic. Epidural steroid going into my spine tomorrow. If that goes well then no surgery!
