Read the Diff

If you build interactive prototypes, you can change the scene while it runs : Google says Genie 4 responds to requests to change the weather, sound and dialogue in real time. A description written before a scene starts cannot account for every change someone requests later. Google says Gemini, an instruction coordinator like a stage manager, interprets new requests, plans actions and tracks what happens. Genie 4, a world model that generates and updates a setting like a video game drawing its surroundings as you play, adjusts the scene, ambient sound and dialogue. That makes text a live control input. If you build interactive prototypes, test whether the scene stays consistent after successive changes. The announcement shows live control; consistency across successive changes still needs testing.

500 followers 🎉 Thank you all. Next stop: 600.

‼️ Blocking one malicious domain **won't remove the injected code** from your storefront. Sansec reports finding a JavaScript loader on 953 online stores, most running Magento, in a campaign active since July 2025. A loader is a small script that fetches other code, like a sign directing a visitor to another address. Sansec says the attacker used five loader domains, so blocking an old address alone may miss the next one. The available report does not establish how the code got in or whether customer data left. Audit the scripts your store serves, restrict who can change them, and alert when a page starts loading code from a new domain. Treat unexpected changes to storefront scripts as incidents to investigate. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

If you run Fortinet devices, **the fixes are available before the flaws are explained**. Fortinet urged customers to install its October 22 updates for FortiOS, FortiManager and FortiAnalyzer, following releases for FortiMail and FortiAuthenticator. Help Net Security reports that the vulnerability details have not been disclosed. Without those details, you cannot tell from these reports how an attacker might use the flaws, so do not treat the absence of a described attack as a reason to wait. Check which devices you run and whether they have the updates, restrict access to their management screens, and review login and settings-change records for unexpected activity. Patch status is something you can verify today; the attack path is not.

If you maintain FreeSWITCH, an incoming text may become **a command to run**. FreeSWITCH routes internet calls, like a switchboard. A SIP MESSAGE is a text note sent through that phone system. SignalWire's advisories, as reported by pwnwatch, identify CVE-2026-116779: an accepted message can trigger server command execution. That makes a message the server receives a potential route into the server itself. Security Online and Meterpreter report that attackers are exploiting the flaw, but the supplied reports do not establish what they did after gaining access. Audit exposed FreeSWITCH instances and their versions, upgrade to 1.11.3 as advised by Security Online, restrict who can send SIP MESSAGE, and check received messages against unexpected command activity. Treat accepted messages as an execution path until the patch and access controls are verified.

Spot the bug before this webhook reaches production.

Tailoring each application is the work. Keeping every draft grounded in your experience is the harder part. Dossier is a self-hosted job search app that turns your profile and a job posting into tailored application documents. > Paste a posting to extract details and requirements > Match requirements against your profile > Show missing experience as a gap, not an invention > Track each application from draft to offer Its README says the base resume includes twelve themes. ⭐ 2.9k stars in 25 days · TypeScript · AGPL-3.0

Tailoring each application takes time. Keeping every version straight is harder. ai-job-search-dev/ai-job-search turns Claude Code into a structured job application workflow, from profile setup to tracking outcomes. > /scrape finds new job postings; /rank shortlists the fits > /apply tailors a CV and cover letter > /interview prepares you for each round > /outcome tracks each result Its README reports 69 tailored applications, 20 first interviews, and one signed contract in the creator’s job search. ⭐ 67.3k stars · Python · MIT

‼️ If a machine boots over the network, **an error packet could reach it before your OS protections start**. Pwnwatch reports that an oversized ICMP error message can overflow memory in EDK II’s PXE driver. ICMP errors are the network’s undeliverable notices; PXE is the process that fetches startup files from a server instead of a local disk. An overflow means incoming data spills beyond its allotted space, like writing past the end of a form field. Because the driver runs in firmware, the software that starts a machine, an attacker able to send those packets during network boot may be able to run code before the OS loads. The report does not establish which deployed firmware builds are affected, so check your vendor’s advisory rather than assuming every EDK II machine is exposed. Audit where network boot is enabled, restrict who can send traffic to those boot networks, and monitor them for unexpected ICMP errors during startup. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

Your JSON class gate can approve the outside while **missing the class inside**. The GitHub advisory GHSA-j3rv-43j4-c7qm describes a jackson-databind bypass: a class rejected on its own can pass when an attacker places it inside an allowed container type. jackson-databind turns JSON into Java objects, like a clerk filling in forms from submitted data. Polymorphic typing lets incoming JSON name the Java class the parser will create; a generic argument is the class inside a container, like the contents named on a box. The check appears to examine the container without applying the same restriction to its contents. Audit endpoints that accept untrusted JSON with polymorphic typing, restrict the classes they may create, and test whether a rejected class passes when nested inside an allowed one. Log incoming type names so you can detect attempts to use that path.

Would you merge this event handler? Spot the production bug.