Zod 4.6.6 ships obfuscated code, Janas streams LLM experts from SSD, and a C-based web product goes live

In this issue

Simon Koeck discloses remote code execution flaw in Google DevSite
Zod 4.6.6 release includes obfuscated code
Codex CLI users request opt-in for persistent background daemon
A documented FMA instruction raises undefined instruction exceptions on supported hardware
Janas streams LLM experts from SSD to run models larger than RAM
Developer ships commercial web product using C, CGI, and SQLite
and 4 more in brief

Top stories

Simon Koeck discloses remote code execution flaw in Google DevSite

Simon Koeck disclosed a remote code execution vulnerability in Google’s shared DevSite platform. The flaw stemmed from a Flask session cookie on developers.google.com that contained its own signing secret in plaintext. Koeck demonstrated that forging a valid session allowed arbitrary code execution across seven Google domains. Google accepted the report in August and fixed the issue on October 7, awarding Koeck a $90,000 bounty.

simonkoeck.com HN discussion

Zod 4.6.6 release includes obfuscated code

The Zod 4.6.6 release, described as a bug fix and performance improvement, contains suspicious code changes. The diff introduces obfuscated JavaScript that imports system modules like 'fs' and 'os'. It includes a function that decodes hexadecimal strings into readable text. This pattern is often associated with malware or unauthorized data exfiltration. The release process involves a maintainer running a specific GitHub workflow command and approving the npm environment. The presence of this code in a popular schema validation library raises security concerns for its users.

github.com HN discussion

Codex CLI users request opt-in for persistent background daemon

A GitHub issue argues that the Codex CLI should not start a persistent, self-updating background daemon by default. Since version 0.157.0, opening an interactive session launches a detached daemon that survives after the window closes and copies the entire package locally. This decouples the backend version from the user's package manager and triggers automatic updates that can interrupt active tasks. The reporter suggests making this behavior opt-in or requiring explicit confirmation before activation.

github.com HN discussion

A documented FMA instruction raises undefined instruction exceptions on supported hardware

A developer discovered that vfmaddrnd231pd, a fused multiply-add instruction with per-instruction rounding control, is documented in the 2024 Intel Software Development Manual but fails to execute on Haswell hardware, raising an undefined instruction exception. The instruction is absent from the 2026 SDM edition, and GNU assembler does not recognize it. Intrinsics mentioned in the documentation are missing from both Clang and Intel compilers. The author hypothesizes that Intel removed the instruction from the CPU due to a late-stage issue but failed to fully remove it from earlier documentation versions.

purplesyringa.moe HN discussion

Janas streams LLM experts from SSD to run models larger than RAM

Janas-LLM, a pure C tool by Maurizio Cammalleri, runs large mixture-of-experts models on standard laptops by streaming required experts from an NVMe SSD while caching frequent ones in memory. This allows a 48 GB Qwen3-Next-80B model to operate on a 32 GB machine. Benchmarks show it achieving 37 tok/s for generation and 62 tok/s for prompt reading, significantly outperforming llama.cpp on the same hardware. The project is an experimental tool, not a product, with a changing API and strict system resource usage.

github.com HN discussion

Developer ships commercial web product using C, CGI, and SQLite

A developer has shipped marketyour.games, a commercial web product built entirely in C and served via CGI. The application handles user accounts, payments through Stripe, and transactional emails using a single statically linked binary and a SQLite file. The author argues that this approach eliminates the complexity of traditional application servers and reduces supply chain risks by limiting dependencies to just three libraries. The system runs on OpenBSD, where each request spawns a fresh process, allowing for zero-downtime deployments by simply replacing the executable file.

prophitt.me HN discussion

In brief

Latacora updates cryptographic right answers for post-quantum transition. Latacora has published updated cryptographic right answers to address the accelerated post-quantum transition timeline. The new guidance reflects significant changes in asymmetric cryptography recommendations since 2024, while noting that symmetric cryptography remains largely unaffected by quantum threats.

words.filippo.io HN discussion

Cyberattack heats French supermarket fridges, spoiling millions in food. Hackers manipulated remote software to heat refrigeration units in hundreds of French supermarkets overnight. The attack spoiled fresh and frozen food worth millions of euros, with some units reaching 50C. French prosecutors have opened a cyber-crime investigation.

bbc.com HN discussion

New Constructs calls Anthropic's planned Nasdaq listing the most ridiculous IPO of 2026. Independent research firm New Constructs labeled Anthropic's upcoming Nasdaq offering the "most ridiculous IPO of 2026," valuing the company at $150 billion. The firm argues that Anthropic's significant net losses and the rise of open-source models make the stock a poor investment, despite the company's reported revenue growth.

cnbc.com HN discussion

Rich Hickey argues LLMs are automation, not tools. Rich Hickey distinguishes between tools and automation, arguing that LLMs function as the latter. He contends that unlike tools, which require direct human control and feedback, LLMs operate independently, preventing users from developing genuine expertise.

linkedin.com HN discussion