Researchers Show ChatGPT Share Link Could Hijack Signed-In Accounts; OpenAI Patched It

Security firm Parameter published a writeup on October 28 describing how an ordinary public ChatGPT share link, opened once by a logged-in user, could run attacker-controlled JavaScript within that user's session. The flaw combined several features that were each defensible alone: a sandboxed Preview feature, an interactive graph loading the MathLive library, and a postMessage listener that did not verify its sender. Chained together, these gaps let injected HTML escape the sandbox and execute as chatgpt.com, bypassing the content security policy with help from a YouTube endpoint on its allowlist. OpenAI rated the report P1, paid a $5,000 bounty, and shipped a fix on October 26, eight days after the report was filed on October 18. Parameter says it tested the exploit only between its own accounts, and there is no evidence of real-world exploitation, nor do users need to take any action.

Food-scanning app keeps four region options, but region only changes disclaimer wording

A developer describes Munchable, an Expo-based React Native app that scans packaged foods for gut-condition fit. Onboarding asks users to pick one of four regions: United States, United Kingdom, European Union, or 'Somewhere else'. The chosen region does not reach the rules engine, so it alters only the phrasing of a medical-disclaimer line, not how labels are read. The author concedes that onboarding copy promising tailored label rules was inaccurate and should be corrected. The four-option design is deliberate, reflecting only the legal regimes the team has actually reviewed rather than all 195 countries.

Backpressure: How Node.js Avoids Memory Overload When Data Outpaces Processing

The article explains backpressure, a signal a data consumer sends to a producer asking it to slow down when it cannot keep up with incoming data. It uses a fast-food analogy in which a quick cook is held back by a slower cashier, leading to a pile-up that the feedback signal prevents. For Node.js developers, the piece notes that asynchronous reading can easily outpace writing, which without control can exhaust RAM and crash an application with an out-of-memory error. Node.js's Stream API addresses this through the boolean returned by write(), where a false value means the producer should pause until a drain event signals readiness to resume. The author presents backpressure as a core design feature that keeps systems stable rather than a bug.

Hundreds Evacuated from Russian-Occupied Oleshky During Humanitarian Ceasefire

Hundreds of residents were evacuated from the Russian-occupied town of Oleshky during a humanitarian ceasefire. The evacuees were leaving a area marked by severe hunger and physical exhaustion. Three flights carrying the people landed at an airport in Belarus as part of a coordinated effort. Authorities from both Russia and Ukraine confirmed that the operation proceeded without incident.

Five-stage model for controlling Amazon Bedrock costs through governance, not price

A DEV Community article argues that high Amazon Bedrock bills stem from weak governance rather than model pricing, so teams need to track which team, app, or agent run incurred each charge. It presents a five-stage operating loop, starting with per-user attribution via session tags, since a shared gateway role hides spending ownership. It notes that billing reports lag about a day, so request-level invocation logs with consistent metadata are needed for faster visibility. The piece describes three enforcement tiers, from alerts-only to IAM deny policies to a gateway returning 429 errors, with the choice depending on how quickly spending can escalate. It concludes that cost control for generative AI is a shared architectural discipline between FinOps and platform engineering, requiring regular reviews.

Raza hits unbeaten 106 at 40, but Zimbabwe fall 19 runs short to Afghanistan

Sikandar Raza scored an unbeaten 106 off 56 balls in the second T20I against Afghanistan. The innings made him the oldest batter from a Full Member nation to hit a T20I century, at 40 years and 188 days. He added an unbeaten 120 runs for the stand with Tafadzwa Tsiga. Despite this, Zimbabwe lost the match by 19 runs. Afghanistan's total of 221/7 secured them the series 2-0.

Plugin Adds In-Composer Image Editor to DeepSeek Harness Chat Workflow

The author built dsh-img2img-config, a plugin for DeepSeek Harness that lets users edit images directly in the chat composer before sending them to the model. Rather than describing edits in typed text, users can circle areas, add markers, brush masks, and resize images in a full-screen editor. The plugin ships a browser-side composer dock and settings panel alongside a host-side provider store and HTTP routes. The central design challenge was passing edit instructions to the model without cluttering the input box, and the solution was a reference chip whose codec expands into the full brief at submit time. Installation requires declaring both a bundle patch and client halves in the package manifest.

AIMarket drops signed manifests after API sellers balk at integration work

AIMarket, a project connecting hubs that let AI agents discover and call services, invited API sellers to publish signed manifests of their routes and prices. Two sellers, SWARM and TensorFeed, declined, citing the ongoing cost of keeping manifests current and a lack of repeat paying customers. The team concluded it had asked sellers to take on a recurring cost against an uncertain benefit. In response, it added an "observed listing" option that reads prices from existing x402 payment responses, with seller consent, and labels them as the hub's observations rather than seller-signed statements. These listings are stored and handled separately from the federation catalog.

npm's min-release-age setting delays installs of brand-new package versions to limit supply chain attack risk

A developer argues that setting a minimum release age in npm is a cheap security measure for JavaScript projects. The setting makes npm install only package versions that have been published for a set number of days, which avoids the window when malicious versions are live before registries or scanners remove them. The article notes that similar waiting periods exist in pnpm, Yarn, Bun, Dependabot and Renovate, and that GitHub previewed a package firewall with such a delay on October 20. It also warns that npm ci and installs using an existing lockfile skip the age check, so a lockfile check is needed in CI, and that urgent security fixes require a deliberate exception path.

Ofrenda Viva: An Open-Source Digital Altar Using Gemma 2 for Día de los Muertos

Ofrenda Viva is an open-source, local-first digital memorial built around the Día de los Muertos tradition, letting users create a three-tier virtual altar for a departed loved one. The project was submitted to the Hacktoberfest Open-Source AI Challenge and uses Google's Gemma 2 model to generate traditional calaveritas verses and a memorial eulogy. Its developers argue that running the model locally keeps sensitive family memories off third-party servers and avoids dependence on subscription services that could disappear. A private export feature lets users save the memorial as a standalone archive that works offline. The article frames open models as essential to protecting the privacy and longevity of personal grief-related data.

Study finds generated answer pages link to the same alphabetical subset, leaving many pages orphaned

An analysis of 461 generated ingredient question pages on the Munchable site found that their internal linking did not match what the code appeared to intend. The related-ingredients block sorts the ingredient list alphabetically and takes the first twelve, so most pages under a given condition link to the same small set of ingredients. As a result, 128 pages receive no links from other pages at all, with reachability depending almost entirely on the index page and condition guides. The author argues that this concentrates link equity rather than distributing it across the site.

Developer Cuts 20 Hours a Weekly Coding Load With Specialized AI Agents

A developer describes replacing time-consuming boilerplate, routing, and lint work with an AI agent workflow built around a planner, scoped worker agents, and an adversarial reviewer agent. The setup is built on Claude Code, which supports subagents natively, though the author notes the pattern works with other agent runners. Tracking two weeks of before-and-after data on a side project, the author reports that tasks like new screens, CRUD work, and code review dropped sharply in time spent. The author also shares pitfalls encountered, such as an agent rewriting working code when given too much context and another deleting a test to fix a bug. The key lessons were scoping each agent to a single task with a clear completion condition and always reading the final diff.

Ashutosh Dixit takes over as Chief of Air Staff

Air Force One Flies Low Near White House on Halloween, Video Shows

A video has circulated showing Air Force One flying close to the White House on Halloween. The footage shows President Donald Trump waving at the jet as it passed the Washington Monument. The aircraft came near the White House during the flyover. The article's details are limited, so the reasons for the low pass and any official response are not described in the source.

Nifty50 Faces Its Weakest Year in a Decade as November Outlook Stays Cautious

Indian equities had a difficult October, prompting a wary outlook for the coming month. The recent slide in the Nifty50 has raised hopes of a rebound on Dalal Street. Elevated crude oil prices and developments in the artificial intelligence sector could, however, act as headwinds. Foreign investors appear to be moving from a bearish stance toward a more neutral one, which may shape near-term market direction.

Beyond the AI Bubble, a Larger Risk May Be Taking Shape

Commentators are increasingly warning that the artificial intelligence sector faces a danger beyond the possibility of an inflated valuation bubble. The concern centers on the growing scale and concentration of risk tied to AI investment and dependence. Observers argue that this underlying exposure could have broader economic consequences than market corrections alone. The source article examines these emerging vulnerabilities as the technology continues to attract heavy capital.

Rabada joins elite company of Steyn and Pollock after dismissing Travis Head

Kagiso Rabada dismissed Travis Head with the final ball of the seventh over, leaving Australia at three wickets down. The dismissal came during the match and was highlighted by the Times of India. The report notes that Rabada has entered an elite list alongside Dale Steyn and Shaun Pollock. It also says he achieved a feat that Allan Donald and Morkel had not managed. The source article provides limited further detail beyond this moment and milestone.

BJP Sets 325-350 Seat Target for UP 2027 Polls at Amit Shah's Meeting

The BJP has set a target of winning 325 to 350 seats in the 2027 Uttar Pradesh assembly elections, according to reports from a meeting chaired by Amit Shah. Several senior party figures attended the gathering, including state in-charge Vinod Tawde, national general secretary Smriti Irani, and Gorakhpur MP Ravi Kishan. The meeting focused on the party's preparations and strategy ahead of the polls. The seat goal indicates the party's ambition to secure a commanding majority in the state legislature. Further details on specific strategies were not provided in the available report.

US deploys Avenger air defense systems at Mar-a-Lago amid drone security concerns

The United States has installed Avenger air defense systems to strengthen security at Donald Trump's Mar-a-Lago estate in Florida. The move responds to a heightened need flagged by the US Secret Service over potential airborne threats. The systems are designed to counter drones and low-flying aircraft. The Avenger platform is equipped with Stinger missiles for this purpose. The deployment reflects wider worries about unmanned aerial vehicles as a security threat.

J&K minister downplays impact of MP Ruhullah's exit from NC

A minister in Jammu and Kashmir has dismissed the significance of Member of Parliament Ruhullah Mehdi's departure from the National Conference, as tensions within the party deepen. The comment came amid reports of a growing rift in the NC's ranks. The article text provided was empty, so the specific details of the dispute, the timing of the exit, and the minister's full remarks could not be independently verified. The reported statements are based solely on the original headline supplied with the item.