Wiz Red Agent + Claude Opus Found 3,000+ Critical Risks Every Week. Wiz's AI-powered attacker scans over 150,000 production web apps and APIs weekly, using frontier Opus models to chain multi-step exploits that traditional scanners can't see. Zero false positives, every finding comes with proof of exploitability. MORE

The Gift That Keeps Giving: Exploiting Git Integrations in Cloud Services. Four vulnerabilities found in Google Cloud Platform services show how git integration becomes a powerful exploitation primitive. Includes RCE via path traversal in git config, argument injection, and a CVSS 10.0 cross-tenant access chain chaining npm symlinks through JGit. MORE

The Untrainable: What AI Can't Commoditize. Sarah Guo maps the landscape where AI eats the measurable and leaves behind the untrainable corner: work whose correctness exists only in private data, behind security reviews and customer trust. The absorption frontier keeps rising, but value keeps sliding toward what models can't reach. MORE

Has AI Already Killed How-To Nonfiction? Tim Ferriss shares his own catalog sales data showing an 80% decline from 2022 to 2026, with the steepest drops after LLMs went mainstream. Self-help publishing is the canary in the coal mine, and podcasts, courses, and advice blogs are next. MORE

Do Things You'll Love Yourself For. David Cain reframes self-discipline as a loving relationship between Present Self and Future Self. Shine the sink before bed, freeze the leftover pizza before a trip: acts of love for the person who inherits your choices tomorrow. MORE

How to Earn a Billion Dollars. Paul Graham explains that becoming a billionaire through startups requires exactly two numbers: growth rate and how long it lasts. Neither requires cheating, and the math works out to about 9.5 months of 93% growth from $2M. A talk to future prime ministers, but useful for everyone. MORE

Burp Extensibility 2026: Awards, Talks, and Highlights. PortSwigger's month-long event drew 200+ nominations across 46 extensions. Highlighter And Extractor took most nominated, Backslash Powered Scanner won Recon, and community talks covered everything from AI-driven extension development to Bambda automation with Claude Code. MORE

Google Introduces the Open Knowledge Format. OKF is a vendor-neutral, markdown-based open specification for sharing metadata and curated knowledge that AI agents need. A bundle is just markdown files with YAML frontmatter, readable by humans and parseable by agents without any SDK. MORE

Running Local Models Is Good Now. Vicki Boykis reports that local agentic coding with Gemma 4 now hits about 75% of frontier model accuracy. With Pi as the harness and LM Studio as the inference server running in Docker, she's refactoring modules, writing tests, and bootstrapping repos entirely offline. MORE

WordPress + Claude: A New Look for cate’s blog. Cate Huston spent four days redesigning her blog with Claude Design, maxed out her Pro plan twice, and learned that WordPress tooling makes AI-assisted redesigns far harder than they should be. The gap between where AI accelerates and where it doesn't is revealing. MORE

How Building an HTML-First Site Doubled Users Overnight. A UK utility replaced a React form with an Astro-powered HTML-first site and watched completions double. Users on decade-old phones in fields with bad connections could finally finish the form. Javascript enhanced the experience but was never required. MORE

Ask HN: Has Anyone Replaced Claude/GPT with a Local Model for Daily Coding? A sprawling 560-comment thread full of real setups: Mac Studios with 128GB RAM running Qwen 3.6 35B, Pi in Docker, llama.cpp on Vulkan, and detailed comparisons of speed vs. accuracy. The consensus: local models are like a knowledgeable junior, not a senior. MORE

Write For One Person. Julia Evans' latest zine comic captures the best writing advice in four panels: pick one real person, write for them, and stop trying to please everyone. MORE

How I Made $30,000 Hacking Broken Access Control. A bug bounty walkthrough showing how client-side access control checks are still trivially bypassed in production applications. Real case studies, real payouts. MORE

@brxxnh1 - Security researcher, views and opinions are those of a wild ostrich on the loose

@EmmaBostian - Engineering Manager at Spotify, American in Stockholm

@jackhcable - Ethical hacker, CEO and Co-founder at Corridor, formerly CISA and Stanford

@Gromak123_Sec - French security researcher, bug bounty hunter at YesWeHack and HackerOne, 3x LeHack Bugbounty winner

@strager - Developer

Cameron's World: A Love Letter to the Internet of Old. A web-collage of text and images excavated from archived GeoCities pages from 1994 to 2009. 38 million pages distilled into one glorious, chaotic tribute to the days when personal spaces were always under construction. MORE

Artemis II Photo Timeline. Every photo and video taken during the Artemis II mission, organized on an interactive timeline. Filter by crew, camera, or media type, with detailed metadata and image descriptions. MORE

The Virtual OS Museum. Over 1,700 pre-installed operating systems spanning 1948 to today, ready to run in QEMU, VirtualBox, or UTM. From the Manchester Baby to TempleOS, every click boots a piece of computing history. MORE

Roman Name Attestations. An interactive map of roughly 250,000 inscriptions from across the Roman Empire, enriched with AI-extracted name data. Click any marker to see the people recorded, inscription text, and translations. MORE

Are you in the weights? The weights are the billions of numbers forming an AI's brain. Type a name and see how strongly the leading AI models recognize it. MORE

kindaVim: Vim Mode for macOS. Brings Vim movements to any app that implements macOS Accessibility, including Xcode, Safari, and Notes. Fallback key remapping catches everything else. Unlimited free trial, subscription keeps it awake in the mornings. MORE

Raycast Store: Vim Leader Key. A Vim-style keyboard shortcut sequences extension for Raycast that enables quick navigation through your apps without touching the mouse. MORE

Indexing 669 GB GoPro Videos Using an M1 Max. Ilias Haddad built a local ML pipeline that transcribes, face-recognizes, object-detects, and embeds all his cycling footage into vector DBs. Then he can search by natural language and send clips straight to DaVinci Resolve. MORE

Single Server: Git Push to Production in Under 5 Seconds. One Linux box, wired to Cloudflare, Tailscale, Docker, and Kamal. Every git push builds on the server and swaps the new version with zero downtime. No CI queue, no registry upload, no per-app bills. MORE

Intigriti RootedCON HackerNight 2026. A recap of the Intigriti team's live hacking event in Madrid, bringing together the European bug bounty community for talks, hacking, and connection. MORE

L8 Principal's Agentic Engineering Workflow. An inside look at how a principal engineer weaves AI agents into daily development, from WezTerm to Claude integration, showing what a mature agentic workflow looks like in practice. MORE

How to Write AI Agent Loops in Claude Code and Codex. A breakdown of every loop type from scratch: heartbeat, cron, hook, and goal loops, with practical code for each pattern. The reusable unit inside the loop is a skill, not a prompt. MORE

State of Agentic Coding #7 with Armin and Ben. A wide-ranging discussion on looping, token economics, what vendors really want you to do with your agents, and where the agentic coding tooling is heading next. MORE

The Obsidian Theme I've Refined for 3 Years. Nick Milo shares the Obsidian theme and workspace he's been iterating on for years, plus his full Ideaverse template for linked thinking. MORE

Explorations in iPhone Notes. Chris Silverman creates daily abstract art using only the iPhone Notes app, posting a new piece every single day. A masterclass in constraint-driven creativity. MORE

39 (Or So) Lessons On The Way To 39. Ryan Holiday's annual birthday reflection covers 20 years of these posts. Highlights: "harder is what makes me better," the Misogi year-defining challenge, and the ancient play from 430 BC that's still about what's happening now. MORE

Being Good at Things. A pro golfer's answer to what makes an amateur "good" isn't a score, it's finishing every hole without picking up a two-footer. Jim Nielsen applies the same logic to programming, design, and writing: do the hard, little things others gloss over. MORE

How To Think So Clearly People Assume You're Brilliant. A framework for sharper thinking that cuts through mental fog and makes your reasoning stand out in any conversation. MORE

Layla Read the Best Systemization Books. Here's What Actually Works. A practical rundown of what systemization techniques survive contact with a real small business, separating the frameworks that stick from the ones that don't. MORE

How To Master Dictation in Raycast. A walkthrough of Raycast's dictation feature with tips for getting accurate transcriptions across macOS and Windows. Available in Raycast Beta. MORE