SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Attackers Use AI Agents to Breach Thousands of Microsoft 365 Tenants and Other Targets

In about ten days, attackers directed AI agents at ConnectWise, a managed-services provider, and reached more than 2,250 downstream Microsoft 365 tenants, with at least 162 confirmed breached. Separately, a single operator using a commercial agent platform and roughly $5,000 in AI tokens reportedly compromised over 100 companies. The LiteLLM AI gateway also suffered a supply-chain attack on PyPI and Docker Hub, where a credential-stealing release was available for about two hours and downloaded around 49,000 times. The article argues these incidents show AI lowering the cost and speed of intrusions, with basic defenses like MFA and credential hygiene separating victims from survivors.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

LessWrong Post 'I Did This Without Your Knowledge' Draws Attention on Hacker News

A post titled "I Did This Without Your Knowledge" has been shared on Hacker News, linking to a page on the LessWrong forum. The submission has received 10 points and one comment so far. The provided material includes only the article and discussion links, the title, and engagement figures. Its specific content and subject matter are not described in the available text.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Essay Argues for Slowing Down to Fix Existing Software Problems

A blog post titled "Move Slow and Fix Things" by developer Matthias Endler was shared on Hacker News, where it gained 79 points. The essay appears to advocate prioritizing careful repair of existing software over rapid new development. The provided material includes only the article link and discussion metadata, so the specific arguments and examples cannot be confirmed here. Readers are directed to the original post for the author's full reasoning and recommendations.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Why Rewriting a JSON File in Place Can Leave Readers With Broken Data

A developer's page-building script repeatedly failed with JSONDecodeError because it read a JSON index while another script was rewriting it. Testing on Linux with Python 3.10.12 showed that open(path, 'w') truncates the file before new data is written, so readers often saw empty or partial content. Killing the writer mid-write also left a corrupted fragment with no intact version to fall back on. Writing to a temporary file and then swapping it in with os.replace eliminated the broken reads in the same test. The author notes three related pitfalls to watch for: a temp folder on a different filesystem, file permissions, and symlinks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Unpinned CI actions and runaway concurrency prompted a zoned pipeline redesign

A team's CI pipeline suffered two costly failures in one quarter: a mutable action tag that was silently changed to push commits, and a concurrency misconfiguration that queued over 1,100 jobs and exhausted weeks of runner quota. To address these, they split the pipeline into an untrusted pull request zone with read-only permissions, no secrets, and aggressive cancellation, and a trusted publish zone limited to main that inherits secrets and never cancels mid-flight. Third-party actions are now pinned to commit SHAs with version comments for readability. The redesign also included disabling persisted checkout credentials and keying the browser cache on the lockfile, plus an agent smoke test to catch session-handoff failures that unit tests miss.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

agent-doctrine: Open-Source Prompts for Getting AI Agents to Ship Tested Code

The sisig.ai team has open-sourced agent-doctrine, a set of prompts, role definitions and skills meant to make AI coding agents produce tested, mergeable pull requests. Every agent follows the same pipeline of scouting, gating, planning, implementing, reviewing, consolidating, verifying and shipping. Before any edit, the lead agent must answer fifteen questions from a TENETS.md file with evidence, such as the smallest correct change and the blast radius. Users choose a fast mode, which keeps the gate and per-diff review, or a rigorous mode, which adds plan simplification, adversarial review and approval before code. The project is MIT-licensed, requires Git and Bun, and rewrites global agent instructions, so users are advised to back up their configuration first.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Claude 3.5 Sonnet, GPT-4o-mini, or Gemini 1.5 Pro: Testing Chatbots for E-Commerce Support

A developer guide argues that the best chatbot API for e-commerce support should be chosen by testing with real support tickets rather than relying on generic leaderboards. It recommends Claude 3.5 Sonnet for the most natural conversational quality, GPT-4o-mini for faster, budget-friendly deployments, and suggests testing Gemini 1.5 Pro before deciding. The author proposes scoring label accuracy, escalation decisions, required output format, and tone separately, and running each test more than once to avoid relying on single responses. The article also advises designing the API boundary so the chosen model can be swapped without rewriting the triage workflow.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MCP Security Gaps: Four Attacks That Server Audits Miss

Standard MCP security checklists focus on OAuth, token scopes and TLS, which confirm server configuration but not whether an AI agent will follow malicious text. Because agents treat tool names, descriptions, schemas and outputs much like system instructions, an attacker can hide commands in that text and steer the agent's real permissions. The article outlines four attack types: tool poisoning, rug pulls, tool shadowing and poisoned tool outputs. It cites OWASP's beta MCP Top 10, which lists tool poisoning as MCP03, and the MCPTox benchmark, where the worst-performing of 20 tested agents followed poisoned instructions 72.8% of the time. The author recommends continuous red teaming in staging, with each run scored pass or fail and repeated on every release.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer details auto-trading Discord trading calls without a bot token

A developer describes the difficulties of building a self-made Discord bot that places broker orders from trade calls posted in a trading server. The problems include permission limits, inconsistent message formats, false-positive noise, the need for always-on hosting, and matching exit signals to open positions. The author, who builds the product Nyria, says its Discord bot needs only View Channels permission and no token or self-hosting. The walkthrough covers connecting Discord, scoping a strategy to one channel with author and keyword filters, and training the parser on past messages. The setup starts with paper trading before any real orders are placed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Opus 5.5 and Sonnet 5.5 tie on coding-agent tests, but Opus costs about 2.5x more

A test of Claude Opus 5.5 against Claude Sonnet 5.5 on six small Python coding tasks found both models passed every hidden test in every run. The evaluation ran Claude Code with identical settings, changing only the model, across 24 runs on 2026-10-20. Opus was consistently slower and, per task, cost roughly two and a half times as much as Sonnet at QuickSilver Pro prices. The tasks covered bug fixing, spec implementation, refactoring, input validation, a config parser and a Mustache renderer. The author's conclusion is that, for these tasks, Opus did not justify its higher price.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

78% of Thai PHP hosts on 8.1 or older may miss tonight's security patch

Mallory's Shodan scan counted 14,619 of 18,701 Thai hosts advertising a PHP version at 8.1 or older, roughly 78 percent, which will not receive the patch. PHP is set to release fixes at 21:00 Thai time for two vulnerabilities rated CVSS v4.0 9.2. The figure reflects banner-declared versions rather than confirmed exposure to the flaws. Reports circulating online cited a 10.0 score and disclosure dates that conflict with PHP's official advisory, and the CVE identifiers in the leak could not be found in the NVD. The author argues the bigger issue is legacy versions on low-cost hosting, not the patch timing alone.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Node.js Message Queues: Publishing and Running Background Tasks Reliably

The article explains how to set up a durable message queue in Node.js to publish and process background tasks, using renewal reminders as the example. It recommends a worker that claims jobs before their deadline, an idempotency key, and a visibility timeout longer than typical processing time. Alerting should track queue delay against eligible jobs rather than raw queue depth, since planned future work and an empty queue can each mislead. Jobs should carry durable intent such as identifiers and an eligibility timestamp, leaving the worker to resolve current account state before acting. The author notes that queues add operational overhead, so simpler approaches may suit low-volume workloads.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Models Found PHP Zero-Day Days Before Disclosure, Patches Released

On October 21, 2026, the PHP project released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The flaws, rated 9.2 on CVSS v4.0, affect PHP versions back to 5.4 and sit in PHP's core engine, so applications like WordPress, Drupal and Joomla are vulnerable unless PHP itself is patched. Security firms Calif and Wiz Research independently used AI models, including OpenAI's GPT-5.6 Sol, to identify the bugs in August, weeks before public disclosure. A proof-of-concept exploit appeared on GitHub within hours of disclosure, making exploitation a low barrier for attackers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why CTOs Should Model the Economics of Open Source Instead of Relying on Gut Feel

The article argues that deciding whether to open-source software is a complex capital allocation problem, not a simple binary choice. It notes that intuition-driven decisions often overlook maintainer burden and erosion of proprietary advantages. The author describes an economics connector with tools for calculating net return, community leverage, IP risk, and maintenance burden. The piece also promotes Vinkius, a unified gateway for accessing these tools from AI assistants, emphasizing its security sandbox and policies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tencent releases open-source Hy Memory 2.0, a dedicated model for AI agent memory

Tencent Hunyuan released Hy Memory 2.0 on October 15, 2026, built around a model whose sole task is writing and updating memories for AI agents. The centerpiece, Hy-Memory-30B-A3B, is a mixture-of-experts model with about 30 billion total parameters, of which roughly 3 billion are active per token. The company says it was trained to decide what to retain and how to update stored facts, addressing the frequent failure of existing systems to return current information after facts change. Alongside the model weights, released under Apache 2.0, Tencent published a Python SDK and a local desktop app called MemHub, and reports benchmark results that are vendor-run and not independently replicated. Developers can test it as a drop-in replacement in frameworks such as Mem0 and MemOS, though the full-precision weights are about 60 GB.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Low Chilled Water Delta-T Halved Chiller Capacity in One Building

A chilled water system's delta-T, the gap between warm return water and cold supply water, determines how much cooling a chiller delivers, and a drop in that gap can sharply reduce output even at full compressor speed. In one example, a 300-ton chiller running at 600 GPM fell from a 12°F design delta-T to 5°F, cutting its capacity to about 125 tons. Causes included three-way bypass valves on air handling coils, fouled coil surfaces, and pump speeds set too high, which forced a second chiller to run on peak days. Converting to two-way valves and chemically cleaning the coils restored the delta-T to 10°F, letting one chiller handle the load and saving an estimated $47,000 a year. The article advises measuring supply and return temperatures and comparing the result to design values to diagnose similar problems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Analyst's '5% for chatbots' compute figure may obscure how workloads are classified

A Nomura estimate suggesting chatbots consume about 5% of global AI compute has circulated among Chinese AI developers as a humbling corrective. The author argues the figure is rough and lacks a public methodology, so its bucket boundaries, especially where tool-using agent sessions fall, are unclear. Because agentic workloads are largely chatbot-style sessions with tool calls added, assigning them to a separate category could understate conversational inference. The piece also contends that chatbot inference is synchronous and latency-sensitive, making it costlier per unit than batched recommendation workloads. Therefore, a small percentage of total compute may not imply that chatbot infrastructure is unimportant to future planning.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Four Python scripts that packaged 39 stock products and cut out tedious upload errors

A developer describes an evening of repeated CSV rejections from stock platforms, which pushed them to write small tools instead of relying on manual spreadsheet fixes. The package includes a metadata generator that builds platform-specific upload files, an upload tracker that prevents duplicate submissions, and utilities for converting Markdown to PDF and bundling products with covers and thumbnails. The author recommends running one process at a time on limited hardware and measuring peak memory usage. Only two of the four scripts need third-party libraries, so some users can skip installing them entirely.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer's Upload Pipeline Uses Ledger Script to Prevent Duplicate Stock Asset Posts

After accidentally re-posting 14 vectors to a marketplace, which drew a complaint email, a developer built a small upload pipeline to stop duplicate submissions. The kit includes four scripts: a metadata builder that outputs the exact CSV header each platform requires, a standard-library ledger that tracks completed uploads, a Markdown-to-PDF converter, and a packager that creates zips with cover images and thumbnails. The developer reports the workflow handled 39 products totaling 856 MB on a single-core server with 2 GB of RAM and no GPU. The project relies on only two third-party packages, Pillow and reportlab, while the metadata and tracker scripts use the standard library alone.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How an MCP payment gateway prevents AI agents from paying twice on retried API calls

When an AI agent's paid API call succeeds on payment but the response is lost, a naive retry can charge the agent again for the same work. The gateway's first layer relies on x402 on Base, where each signed USDC authorization carries a nonce the token contract accepts only once, so a resent payment fails on chain. For order payments, agents can attach a payment identifier that returns the stored result for repeated requests for 24 hours, while mismatched details trigger a conflict error. Payments whose settlement status is unclear are treated as unknown rather than failed, and a background job checks the chain to resolve them without ever re-settling. Tool calls are charged only when a response is delivered, so provider failures are not billed.

0 comments Read more at DEV Community
← NewerPage 98 of 2921Older →