MongoBleed is a vulnerability affecting all MongoDB versions from 2017 to... today.

The exploit is simple. It's a buffer over read bug due to compression. Here's how it works 👇

Clients can send compressed requests to MongoDB.

The client helpfully includes the uncompressed size of the message so the server knows exactly how much memory to allocate when decompressing.

The server allocates a memory buffer with the given space. Due to how memory management and garbage collection in programs work, this allocated memory may already contain sensitive information that was copied earlier and is considered garbage now (eg because it's unreferenced).

The exploit sends a badly-formatted BSON message. The server fails to parse it, and "helpfully" returns an error message containing the invalid message. The invalid message can be that whole 1MB block of foreign data.

Really nice video by Julia Turc explaining why Transformers are taking over CNNs in computer vision
BTW she's the author of Pix2Struct, a document AI model we also integrated in Transformers :)
Check it out: https://m.youtube.com/watch?v=KnCRTP11p5U

This is one of the biggest problems in software development today. And the worst thing is that newcomers are taught these N layers of abstraction as something perfect that will solve all problems.

One reason vibe coding is so addictive is that you are always almost there but not 100% there. The agent implements an amazing feature and got maybe 10% of the thing wrong, and you are like "hey I can fix this if i just prompt it for 5 more mins". And that was 5 hrs ago.

Sounds like a gambling, considering that you are paying for agent tokens and there are no guarantees for a valid result.

This is one of the biggest and dangerous 0day vulnerabilities in the Linux kernel 👉🐧👈.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed recently by Theori. It has been sitting quietly in the Linux kernel for nine years. 😱

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

lsmod | grep -q '^algif_aead' && echo "algif_aead is ACTIVE loaded -> check by hand" || (echo "not loaded -> deactivate & blacklisted"; modprobe -r algif_aead 2>/dev/null; echo -e "blacklist algif_aead\ninstall algif_aead /bin/false" > /etc/modprobe.d/disable-algif_aead.conf)

https://copy.fail

🧔 This is how it felt to be a software developer before AI and StackOverflow.
ᕙ( •̀ ᗜ •́ )ᕗ

C or Rust for microcontroller firmware development?

A study published by Cornell University tries to answer the question. The researchers gathered two teams of engineers working on STM32 MCU firmware. One team worked on C firmware, and the users on Rust firmware using Ariel OS RTOS.

Each team worked separately for 6 weeks, and then in tandem for four more weeks to optimize the results. Rust and C firmware ended up having similar footprints and the exact same performance (when capturing sensor data).

https://www.cnx-software.com/2026/05/06/study-compares-rust-and-c-languages-for-embedded-firmware-development

Can't agree more 😁

He just learned the latest C++ capabilities. Release the new C++ standard and deprecate all the previous features.

Hear me out 🚨 NodeJs developers (and software) should never be trusted.
They have a kind of a culture to do not care about code, performance, package quality etc. Now it is widely exploited by hackers with supply chain attacks.

https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm

Musks can launch rockets but still can not provide smooth video experience on X. It is horrible. After so many years it's impossible to resume playback from where you left. It resets even when you switch between app and floating window.

Money and resources does not always provide better services.

You wanna try local LLMs?
Start with Qwen3.6 27b
If it feels slow for you - Qwen 3.6 35b a3b
For low VRAM setup - Qwen 3.5 9b
#ai #llm #qwen

Good news everyone 🦀
New borrow checker will be available in rust soon.
This one should make some code parts less clunky.

#rust #programming

https://blog.rust-lang.org/2026/08/04/enabling-polonius-alpha-on-nightly/

🤔 Claude models will have invisible watermarks embedded in ALL text, and metadata attached to files.
Thanks to new EU AI Act 😖

#ai #claude #eu #anthropic

https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

This is how it feels to steal content from the internet and put your own watermark on it 😆

#anthropic #claude

Let's measure something just to provide some charts and then make meaningful decisions based on that.

#ai #llm #tokens

🐳 DeepSeek just open-sourced their first official harness for AI agents! 🔥

"Everything is a plugin": models and tools are freely interchangeable.

You can try it yourself.

https://github.com/deepseek-ai/deepseek-harness

This is what USA's use of #AI could look like soon.

🤯 I couldn't imagine such stuff 2 years ago. But now is possible using GPU/CPU split and proper MoE #AI #LLM model.
The numbers taken from my tests of Gemma4 26B A4B on a notebook with 32Gb RAM + RTX 4060.
Such performance allows you to code 100% offline without eGPU or Mac.
But you need to know how to tread local LLMs limited abilities.