📦 syrex1013/php2shell

php2shell: The PHP Bug That Turns Uploads into Root Access

A standard file upload just handed over full control of a PHP server to an attacker. The project named php2shell exposes a severe memory bug in PHP that has existed for over a decade. When you upload a file, PHP keeps a temporary note in memory about the progress. If the upload pauses for even a split second, the software deletes that note while still holding a map to where it was stored. When the upload finally finishes, PHP tries to save the final percentage to a location that no longer exists. This simple mistake lets a hacker inject code directly into the server.

🆔 @hackernewsgithubprojects

📦 fontgarden/runebender

Runebender: The AI Font Editor

Runebender is the font editor that lets you sketch letterforms with a local AI model. Instead of just drawing lines manually, you can draft a shape with the Brush panel, then compare the AI-generated outline against your original sketch before you commit to the design. This makes it a powerful tool for type designers who want to explore new ideas quickly without leaving their editor. Because it runs entirely on your machine, your font data never leaves your computer, giving you full control over your creative process. It is built on Rust for speed and stability, ensuring that the tool can handle complex typography without lagging.

🆔 @hackernewsgithubprojects

📦 rossark0/rossark-motion-skill

rossark-motion-skill

rossark-motion-skill is the coding tool that makes your static drawings feel genuinely alive. You know that awkward feeling when an AI tries to animate a character and it just snaps from one picture to the next? That looks like a glitchy slideshow. This project fixes that by teaching your coding agent the subtle rules of real movement. It ensures your characters breathe, blink, and shift their weight smoothly, so the motion feels organic instead of robotic. Whether you are building for mobile or web, it gives your illustrations that missing sense of life.

🆔 @hackernewsgithubprojects

📦 lambdalabshq/xmatrix

xMatrix: Your Team Chat With AI

xMatrix is the group chat that lets your coding agents work alongside your team. It solves the problem of copy-pasting results between different AI terminals by putting Claude, Codex, and other agents directly into a shared channel. You simply mention an agent by name, like you would a coworker, and it starts working on your machine using your own subscription. The coolest part is that each agent gets its own isolated workspace, so they can code without stepping on each other's toes. It turns your scattered AI tools into a cohesive team, keeping your code and your chats in sync.

🆔 @hackernewsgithubprojects

📦 thinkscape/arc-to-zen

Arc to Zen: Your Browser Migration

Arc to Zen is the migration tool that finally moves your entire Arc browser life into Zen without losing a single pinned tab. It reads your Arc spaces, folders, and colors, then reconstructs them perfectly inside Zen. The real magic is how it preserves the exact open or closed state of your nested folders. It copies the tiny icons, the workspace themes, and even the favicon images so your setup looks identical. You get a simple app to do it all, with backups to keep you safe. It is the perfect fix for anyone ready to swap browsers but terrified of losing their organized chaos.

🆔 @hackernewsgithubprojects

📦 git-meta/git-meta

Git Meta: A Better Way to Store Git Metadata

Store rich data directly inside your Git project without breaking anything. Git Meta acts like a supercharged version of git notes, letting you attach detailed information to specific commits, files, or entire branches. Instead of juggling messy text files or relying on rigid commit message trailers, you use a flexible system to track things like code owners, review comments, or even AI agent transcripts. It handles conflicts between teammates automatically and keeps your repository clean by storing heavy data separately. If you are building tools that need structured data inside Git, this reference implementation shows you exactly how to do it right.

🆔 @hackernewsgithubprojects

📦 kyleamathews/field-lab

Field Lab

Field Lab is an AI companion that refuses to just answer your questions, instead offering a massive collection of specialized mental instruments to help you examine them. Think of it as a field kit where your AI caddy, named Kit, suggests specific tools like a term scan to untangle disputed words or a hostile auditor to stress-test your arguments. It turns a simple chat into a structured investigation, letting you inspect evidence and assumptions without forcing you to accept the AI's conclusion. The coolest part is the Electric Monks workflow, which spins up separate agents to argue opposing beliefs at full strength so you can see where each side breaks.

🆔 @hackernewsgithubprojects

📦 nvidia/elements

NVIDIA Elements: The UI Kit For Robots

NVIDIA Elements is a user interface library designed specifically for AI factories, robotics, and autonomous vehicles, meaning the buttons, charts, and menus you see on a robot's screen are built from this exact same code. It solves the problem of developers having to hand-code complex dashboards for machines that need to display real-time data, sensor readings, and control panels without breaking the bank on custom design systems. The most interesting part is that it is agent-ready, which means it is built to be understood and manipulated by AI agents, not just humans clicking around.

🆔 @hackernewsgithubprojects

📦 rorygallagher2024/glasshouse

Glasshouse: Reclaim Your LG TV

Glasshouse takes a rooted LG webOS TV and turns it into a local command center you actually control. You can finally see exactly what your TV is collecting and shut it off, including LG’s content recognition that samples your screen. It blocks ads and telemetry, removes bloatware, and even lets you manage your OLED panel’s burn-in protection from your browser. The best part is the optional smart home bridge. It connects your TV directly to Home Assistant, letting you control your lights or hear notifications from your couch. No cloud, no data leaks, just your hardware working for you.

🆔 @hackernewsgithubprojects

📦 vllm-project/vllm-torchtpu

vLLM TorchTPU: PyTorch on Google TPUs

vLLM TorchTPU lets you run standard PyTorch models directly on Google Cloud TPUs without rewriting your code. It acts as a specialized backend that translates your usual PyTorch definitions into TPU-optimized instructions, meaning you get the speed of specialized hardware while keeping the same familiar command line and server setup you already use. This is useful if you want high performance for large language models but do not want to switch to a different programming framework. You simply install the package, point it at a model, and start serving requests just like you would on a GPU.

📰 https://news.ycombinator.com/item?id=50158960

🆔 @hackernewsgithubprojects

📦 redai-studio/relax

Relax: The Async RL Engine

Relax runs massive AI model training and inference on separate hardware clusters that talk to each other in real time, meaning the system never sits idle waiting for data. This open source engine from Xiaohongshu was built specifically to teach multimodal models, allowing them to learn from text, images, video, and audio simultaneously without needing a new framework for every single type of data. By splitting the heavy lifting of learning from the heavy lifting of answering, the whole pipeline stays busy and efficient even at scale. If you are working on complex AI training, this is the kind of architecture that keeps your expensive computer chips actually doing work.

🆔 @hackernewsgithubprojects

📦 harvard-cns/orla

Orla: The Smart Proxy for AI Agents

Orla is the execution engine that stops you from hard-coding which model handles each part of your AI workflow. Built by researchers at Harvard, this Go-based daemon sits between your agent and the backend, acting like a smart traffic cop. You simply tag requests by their purpose, and Orla routes them to the best available option. The magic happens in the background. An external optimizer watches your real-world performance data and constantly retunes the routing policy. It might swap to a cheaper model for easy tasks or escalate to a powerful one for complex jobs. Your code never changes. It just runs faster and costs less.

🆔 @hackernewsgithubprojects

📦 anton-barinov/php2shell-patches

PHP2Shell Patches: Fix Old PHP Safely

PHP2Shell patches is the emergency toolkit that actually keeps your legacy servers safe without breaking your file uploads. While the official fix for this critical security hole simply disables progress bars to stop the exploit, this repository takes a smarter approach by fixing the root cause directly. It lets you patch old PHP versions like 5.6 and 7.4 so your forms and upload trackers keep working exactly as they always have. This is the definitive fix for anyone running outdated software who refuses to pick between security and functionality. Apply these specific patches now to secure your server while keeping everything running smoothly.

🆔 @hackernewsgithubprojects

📦 recogardtech/autopilotpm

AutoPilotPM: AI Trading Across 1000+ Markets

A single open-source project can watch over a thousand different betting and crypto exchanges at once, finding gaps in price and placing trades before you even blink. AutoPilotPM is an autonomous system that uses artificial intelligence to scan markets like Polymarket, Kalshi, and Binance, hunting for opportunities where prices disagree across different platforms. It doesn't just find these gaps; it automatically executes the trades and manages your risk limits so you don't have to sit glued to a screen. Think of it as a tireless, digital trader that works around the clock to lock in small profits from market inefficiencies.

🆔 @hackernewsgithubprojects

📦 indras-mirror/xolotl

Xolotl: A 552B Model on One PC

Xolotl is the local inference engine that runs a 552 billion parameter frontier model on a single gaming PC. Most people assume that massive artificial intelligence requires a server farm, but this project proves you can run the DeepSeek V4.1 Flash model on just one graphics card and standard computer memory. It achieves this by cleverly storing the model's weights across different hardware layers and pulling up only the pieces needed for each word. This means you get real coding capabilities and tool calling locally, without paying API fees or waiting for cloud latency. If you want powerful AI on your own hardware, this is the one to check out.

🆔 @hackernewsgithubprojects

📦 ciscobugger/tacit

Tacit: The OS That Actually Looks Like One Thing

Tacit is the operating system that finally makes your laptop feel like a single, cohesive object instead of a patchwork of random parts. Running on Arch Linux, it ditches the standard taskbar for a sleek notch at the top of your screen that quietly handles notifications and status updates without getting in the way. Every single piece, from the file manager called Pinax to the ad-blocking browser named Thyris, is designed to fit together with a unique visual language. It is not just a skin; it is a complete environment where the fonts, icons, and apps all speak the same visual dialect.

🆔 @hackernewsgithubprojects

📦 ltmoerdani/opencode-copilot-chat

Hack VS Code to Use Free AI Models

Stop paying for premium coding subscriptions when you can just grab the good stuff for free. The OpenCode Copilot Chat extension lets you plug your own API keys directly into VS Code, unlocking over thirty frontier AI models without a single monthly bill. Think DeepSeek, Kimi, GLM, and even GPT and Claude, all sitting right in your native Copilot chat picker. The coolest part is that it keeps the native tool calling and agent mode working perfectly, so your AI can still read files and run commands just like the paid version. You get the full power of these heavy hitters without the subscription lock in.

🆔 @hackernewsgithubprojects

📦 rosehahah/the-machine

The Machine is Now on Your Mac

This open source project puts the AI surveillance system from Person of Interest directly on your Mac. It uses your camera to box every person it sees, recognizes you as the Admin, and detects if someone picks up a weapon or falls down. When it spots a threat, it issues a social security number and sends you a notification. The whole experience is built to look exactly like the show. It is a fascinating look at computer vision running locally. No data leaves your machine. It is a cool way to see how this fictional tech actually works. Give it a try if you are into tech and privacy.

🆔 @hackernewsgithubprojects

📦 peach-mitao/peach

Peach: Your Private Media HQ

Peach is the local-first media system that puts your digital life back in your hands. It runs entirely on your own hardware, acting as a private media hub that automatically scans your hard drive to find and organize your files. The coolest part is its metadata engine, which quietly pulls in details, posters, and performer info from multiple online sources to build a rich, searchable library for you. You get a polished interface to watch and manage everything without your data ever leaving your house. It is the perfect setup for anyone who wants a Netflix-like experience with full control over their privacy.

🆔 @hackernewsgithubprojects

📦 oosexgang/hackios-xnu-userland

iOS 16.5 on an Android Phone?

HackiOS XNU Userland is the custom operating system layer that runs the real iOS sixteen point five interface on standard Android hardware. While the companion kernel repository handles the low level plumbing, this project builds the actual root and system images that boot the unmodified mobile software. It includes a custom initialization program, injected libraries for graphics and audio, and a package manager to make the experience feel authentic. The real surprise is the graphics bridge, which lets the phone render iOS animations using standard open source drivers instead of proprietary Apple code.

🆔 @hackernewsgithubprojects

📦 nousresearch/hermes-labs-plugins

Hermes Labs Plugins: Show It Once, Automate Forever

Show a browser workflow just once and let an AI agent learn it by watching, not by reading instructions. Hermes Labs Plugins includes a tool that records your mouse clicks and keystrokes in real time, safely masking any passwords you type. It then converts that visual demonstration into a repeatable skill, meaning you never have to describe a repetitive task in words again. The repository also features an inbox plugin that gathers scattered background jobs into one clear dashboard, and a secretary mode that drafts customer replies for your approval before sending. These are experimental tools built by Nous Research, offered to the community for adoption rather than official support.

🆔 @hackernewsgithubprojects