Read the Diff

Tailoring each application is the work. Keeping every draft grounded in your experience is the harder part. Dossier is a self-hosted job search app that turns your profile and a job posting into tailored application documents. > Paste a posting to extract details and requirements > Match requirements against your profile > Show missing experience as a gap, not an invention > Track each application from draft to offer Its README says the base resume includes twelve themes. ⭐ 2.9k stars in 25 days · TypeScript · AGPL-3.0

Tailoring each application takes time. Keeping every version straight is harder. ai-job-search-dev/ai-job-search turns Claude Code into a structured job application workflow, from profile setup to tracking outcomes. > /scrape finds new job postings; /rank shortlists the fits > /apply tailors a CV and cover letter > /interview prepares you for each round > /outcome tracks each result Its README reports 69 tailored applications, 20 first interviews, and one signed contract in the creator’s job search. ⭐ 67.3k stars · Python · MIT

☠️☠️☠️☠️ Anthropic keeps your Claude Code data for 30 days. Unless you type /bug. Then it’s 5 years. 🫠 Here’s what gets uploaded, and the 3 lines of config to shut it down 👇

‼️ Canada's Cyber Centre warned that CVE-2026-106173 was being exploited. **Fortinet still lists the flaw as not known to be exploited.** FortiSIEM is a console for monitoring security events, like a dashboard that gathers alarms from across a network. The warning comes from a national cyber agency. Horizon3's separate contribution is a public proof of concept, a working example that shows how someone could use the flaw. Neither source, as reported here, establishes how an attacker entered a particular system or what they took. An operator deciding when to patch has two conflicting accounts of whether attacks are happening. Fortinet disclosed the flaw on October 13. Horizon3 released its example on October 20. SecurityOnline reports that Canada's Cyber Centre updated its warning on October 23. That sequence gives an attacker a public method before operators have a settled account of its use. SecurityOnline quotes the Canadian warning as saying the flaw “is being exploited in the wild.” That means attacks against real systems, rather than demonstrations in a lab. The report does not describe a complete attack path from entry to stolen data. Fortinet's status and the Canadian warning cannot both serve as the operator's current answer. The supported consequence is narrower: FortiSIEM 7.5.0 is affected, and Fortinet's fix is in 7.5.1. Audit exposed 7.5.0 installations, apply the fix, and check for unexpected file writes or code execution, meaning commands run on the server as if someone were using its keyboard. Fortinet's unchanged status is not a reason to delay the 7.5.1 fix. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

‼️ A PeopleSoft patch check tells you what is fixed now, **not whether someone got in before June**. On October 27, Zero Day Initiative published an analysis of three connected flaws that Oracle had patched in June under CVE-2026-35273. A CVE is a public tracking number for a security issue, like a case number on a repair ticket. The researchers who reported the flaws describe how the pieces fit together, rather than treating the patch notice as a map of the attack. That shifts the question from whether the patch is installed to whether an outside request reached a function reserved for the inside. eSentire’s June 10 security advisory attributes reports of exploitation since at least May 27 to Mandiant and Google Threat Intelligence Group. One reported step is server-side request forgery: making a server fetch something for you, like asking a receptionist to enter a staff-only room. The reported chain then enabled remote code execution, meaning an attacker could make the system run instructions without signing in. “One CVE” and “THREE chained flaws” sound at odds, but describe different things: the patch’s tracking number and the steps in the reported attack. For a PeopleSoft investigation, audit exposed instances and their patch dates, restrict what the servers can reach internally, and check request logs for attempts to reach internal functions. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

‼️ If a machine boots over the network, **an error packet could reach it before your OS protections start**. Pwnwatch reports that an oversized ICMP error message can overflow memory in EDK II’s PXE driver. ICMP errors are the network’s undeliverable notices; PXE is the process that fetches startup files from a server instead of a local disk. An overflow means incoming data spills beyond its allotted space, like writing past the end of a form field. Because the driver runs in firmware, the software that starts a machine, an attacker able to send those packets during network boot may be able to run code before the OS loads. The report does not establish which deployed firmware builds are affected, so check your vendor’s advisory rather than assuming every EDK II machine is exposed. Audit where network boot is enabled, restrict who can send traffic to those boot networks, and monitor them for unexpected ICMP errors during startup. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

Your JSON class gate can approve the outside while **missing the class inside**. The GitHub advisory GHSA-j3rv-43j4-c7qm describes a jackson-databind bypass: a class rejected on its own can pass when an attacker places it inside an allowed container type. jackson-databind turns JSON into Java objects, like a clerk filling in forms from submitted data. Polymorphic typing lets incoming JSON name the Java class the parser will create; a generic argument is the class inside a container, like the contents named on a box. The check appears to examine the container without applying the same restriction to its contents. Audit endpoints that accept untrusted JSON with polymorphic typing, restrict the classes they may create, and test whether a rejected class passes when nested inside an allowed one. Log incoming type names so you can detect attempts to use that path.

Knowing which AI bots visit is easy. Knowing whether key pages are missed is harder. GEOInflow is a self-hosted analytics platform that brings website visits, AI referrals, crawl logs, and content inventories together. > Identify crawlers and request purposes > Compare imported sitemap, CSV, or JSON inventories with observed logs > Review failed requests, latency, and crawl coverage > Track AI referral sessions, goals, and conversions Its README identifies the current product version as v1.2, with build version 1.2.0. ⭐ 643 stars in 2 days · TypeScript · MIT