Artificial Analysis's Intelligence Index v5 shifts to majority private evaluation datasets, reshaping benchmark reproducibility and model rankings for developers.
Oracle's plan to offer Google TPUs on OCI starting in 2027 raises key questions about AI capacity planning, scheduling, and abstraction layers for multi-cloud accelerator portability.
A single HTTP header parsing flaw behind HTTP2Shell and PHP2Shell has reached .NET, FFmpeg, ClickHouse, and Apache Arrow, with active exploitation prompting emergency patches.
A deep, hands-on benchmark of tsrs, the AI-generated Rust port of TypeScript, comparing its performance and compatibility against tsc and showing how to validate it before adopting it in a build pipeline.
Oracle plans to offer Google TPUs on OCI from 2027. That single sentence, reported on 28 October 2026, is the entire confirmed claim: no named TPU generation, no region list, no pricing, and no statement about whether buyers reserve capacity or request it on demand. This short works through what to do with a fact that thin. It covers why accelerator capacity planning is really a negotiation over allocation shapes, why a TPU slice is a topology rather than a device, how the job spec ends up naming a geometry instead of a chip, and where the checkpoint interval arithmetic lands once preemption is treated as a scheduled event rather than an incident. The position argued in the post: architect for abstraction at the orchestration layer now, keep the compiler layer vendor-specific, and treat the 2027 date as a reason not to foreclose an option rather than a reason to commit budget. Every performance number and topology sketch in the piece is an assumption to be replaced, not a specification. Full write-up: https://hackyjs.com/posts/google-tpus-on-oci-capacity-scheduling-and-abstraction-before-2027
One HTTP header parsing flaw — reported under the researcher names HTTP2Shell and PHP2Shell — has reportedly reached .NET, FFmpeg, ClickHouse, and Apache Arrow, and CISA has reportedly warned that one side is under active attack. This short separates what the public reporting actually supports from what it doesn't: the summaries carry no CVE identifier, no affected version ranges, and no named parser function. Then it looks at the bug class itself. Header parsing is string handling with security consequences, and what spread between these four ecosystems is a permissive mental model — split on the colon, trim, lowercase, merge duplicates, move on — not a single shared line of code. What the video covers: - The reported timeline of 27 and 28 October 2026, and which outlet said what - RFC 9110 and RFC 9112 on whitespace before the colon, obsolete line folding, duplicate field names, and Transfer-Encoding together with Content-Length - The decision points where parsers diverge, and why divergence is the exploitable part - Why Kestrel, FFmpeg's HTTP protocol handler, the ClickHouse HTTP interface, and Arrow Flight all end up parsing headers outside a hardened frontend - The trust boundary that matters: attacker-controlled bytes, parser A, normalized value, parser B - How to scope and test your own exposure before you patch This is defensive, lab-scoped material: header grammar probes only, with no exploit payloads and no target lists. Names are not identifiers — for triage, go to the CISA Known Exploited Vulnerabilities catalog and the vendor bulletin for your specific versions, not to a news summary. The author's sources here are secondary summaries, and the post lists what was not tested. Read the full post: https://hackyjs.com/posts/why-one-http-header-parser-bug-reached-net-ffmpeg-clickhouse-and-apache-arrow
Reports name Cloudflare and VoidZero behind tsrs, described as an AI-generated Rust port of TypeScript. But the public reporting confirms no version, compatibility matrix, API surface, or installable artifact. So instead of repeating a speedup number, this video walks through the harness: capture a tsc baseline with extended diagnostics, check whether the checker reproduces TypeScript's deliberate unsoundness and diagnostic identity, and see why the compiler API matters as much as the CLI. The rule is correctness first: matching diagnostics and emit gate adoption, then wall clock and peak RSS. Read the full write-up for the three-corpus setup and version pinning: https://hackyjs.com/posts/benchmarking-tsrs-against-tsc-testing-an-ai-generated-rust-typescript-compiler-before-it-hits-your-build-pipel