AI 资讯

Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system? So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit. Need more context? I wrote a summarising one here. wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell Aditya Pidurkar Aditya Pidurkar Aditya Pidurkar Follow Jul 22 wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell # wordpress # wp2shell # cybersecurity # cve Add Comment 4 min read S1: Stop assuming you're patched. Go check. WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT. Go look at your actual running version right now: In the dashboard: wp-admin > Updates Via WP-CLI, if you have shell access: wp core version You want to see 7.0.2 if you're on the 7.0 line, or 6.9.5 if you're on 6.9. If you see anything else — 6.9.0 through 6.9.4, or 7.0.0/7.0.1 — you're still exposed. Update it now!! Come back when done. A few situations where the forced update quietly doesn't happen, in what I read on internet: Managed hosting environments where the host controls the update pipeline and hasn't pushed it yet Sites with a "disable auto-updates" plugin installed months ago for stability reasons and never revisited wp-config.php with WP_AUTO_UPDATE_CORE explicitly set to false Staging or dev environments nobody thinks of as "production" but that are still internet-facing If any of that describes you, don't wait on the automation. Update manually. S2: If you genuinely can't update right now, here's your stopgap aybe you're facing a compatibility issue, a change freeze, or a custom plugin that isn't ready yet. It happens. If you need a little more time before applying the real fix, here'

Express does not validate request input for you. Without a check at the edge, handlers get raw req.body , req.query , and req.params - strings where you expected numbers, missing fields, and shapes that only blow up deep in business logic. Zod is a TypeScript-first schema library. You declare the shape once, infer types with z.infer , and parse at the HTTP boundary so route handlers only see valid data. Invalid input becomes HTTP 400 before your code runs. This post covers Zod 4 schemas ( z.email() , z.uuid() , z.coerce ), Express validation middleware, error formatting and pitfalls. Prerequisites Node.js version 26 Zod 4: npm i zod Express: npm i express and npm i -D @types/express Zod 3 method forms like z.string().email() still work but are deprecated in v4. Prefer the top-level APIs below. Schemas // schemas.ts import { z } from ' zod ' ; export const createUserSchema = z . object ({ email : z . email (), name : z . string (). min ( 1 ). max ( 100 ), age : z . number (). int (). min ( 0 ). max ( 150 ). optional () }); export type CreateUserInput = z . infer < typeof createUserSchema > ; export const userIdParamSchema = z . object ({ id : z . uuid () }); export const listUsersQuerySchema = z . object ({ limit : z . coerce . number (). int (). min ( 1 ). max ( 100 ). default ( 10 ), q : z . string (). trim (). min ( 1 ). optional () }); z.coerce.number() is useful for query strings - HTTP query values arrive as strings. Prefer safeParse over parse at the edge so you control the HTTP status and response body. Format errors once Map ZodError.issues into a stable JSON body, or use Zod 4 helpers z.flattenError() / z.treeifyError() when you want field-keyed or nested shapes. // format-zod-error.ts import { ZodError } from ' zod ' ; export function formatZodError ( error : ZodError ) { return { message : ' Validation failed ' , issues : error . issues . map (( issue ) => ({ path : issue . path . join ( ' . ' ) || ' (root) ' , message : issue . message , code : issue . c

Unity is replacing its scripting runtime. Not tweaking it, replacing it. The Mono runtime that has sat under every line of C# you have written in Unity for years is being retired in favour of Microsoft's CoreCLR. It is the most significant change to Unity's foundation in over a decade, and it is no longer a distant roadmap item: the Unity 6.7 public alpha is out now, with CoreCLR arriving as an experimental option. Most of the coverage treats this as good news wrapped in a version number. It is good news. But if you run a real project, the interesting questions are the practical ones: when does this actually reach me, what changes underneath my game, and what is going to break. Here is that read, from the perspective of a studio that plans and runs Unity upgrades for a living. What CoreCLR Is, and Why Unity Is Doing It Unity has been running a heavily customised fork of Mono for years. That custom fork is the reason Unity has always trailed the wider .NET ecosystem: while the rest of the C# world moved to modern runtimes, garbage collectors, and language features, Unity developers looked on from behind a runtime that could not easily keep pace. CoreCLR is Microsoft's modern, open-source .NET runtime, the same one that powers current .NET. Moving to it does three things at once: it gives Unity a far more capable runtime and garbage collector, it unlocks modern C# and the current .NET library ecosystem, and it dramatically improves iteration time, the write-save-wait-for-domain-reload loop that quietly eats hours of every Unity developer's week. Unity 6.8 is expected to target .NET 10 and C# 14. To make room for it, Unity has done something telling: it paused new work on animation and world-building workflows specifically to concentrate engineering on this migration and on architectural stability. That is a company choosing foundations over features, which is the right call, and a sign of how big this change is. The Timeline That Actually Matters The migration lands a

Unity 6.5 arrived in mid-June 2026, and if you skimmed the announcement you would be forgiven for filing it under "minor update." There is no single headline feature to point at. But 6.5 is more consequential than it looks, because the important changes are subtractions. Several systems that a lot of production projects still lean on have been marked for removal, and the countdown has started. This post is the read we would give a client: what actually changed, which parts matter depending on where you are in your development cycle, and a straight answer on whether to upgrade. First, What Kind of Release This Is Under the Unity 6 model there are two kinds of release, and the difference decides most of the upgrade question on its own. Update releases (6.4, 6.5, 6.6) carry the newest features, platform support, and performance work. Unity describes 6.5 as a Supported release with the same stability and critical-fix quality as an LTS, right up until the next release lands. They are aimed at projects in active or mid-cycle development. LTS releases (6.3 LTS, and 6.7 LTS later this year) are the ones to lock production on. 6.3 LTS is supported with fixes and platform updates through December 2027. They are the safe harbour for a title that is shipping or about to. One date to note if you have not moved recently: Unity 6.0 LTS support ends in October 2026. If you are still on it, that is the real deadline on your calendar, not 6.5. The Real Story: What Is Being Deprecated This is the part worth your attention. None of these break your project today, but each one is a planning item. The Built-In Render Pipeline is deprecated. BIRP still works, and Unity has committed to supporting it through the full 6.7 LTS lifecycle, but it will become obsolete in a future release. If your project is still on BIRP, this is your signal to scope a migration to URP while it is a controlled piece of work rather than something forced on you by an engine upgrade you cannot avoid. Unity has add

Amid all the noise about dockershim, one thing got lost: the everyday workflow of building an image with Docker and running it on Kubernetes never changed. Docker is still an excellent build tool, Kubernetes still runs OCI images, and on Ubuntu the loop is clean. Here it is end to end. 1. A build-friendly Dockerfile Multi-stage keeps the runtime image small and the attack surface low — this matters more on Kubernetes, where you pull the image onto every node that schedules the pod: # build stage FROM golang:1.22 AS build WORKDIR /src COPY go.* ./ RUN go mod download COPY . . RUN CGO_ENABLED = 0 go build -o /out/api ./cmd/api # runtime stage — distroless, no shell, tiny FROM gcr.io/distroless/static:nonroot COPY --from=build /out/api /api USER nonroot:nonroot EXPOSE 8080 ENTRYPOINT ["/api"] 2. Build and push with Docker on Ubuntu Use buildx (bundled with modern Docker) so you can build multi-arch — worth it if any nodes are arm64: docker buildx build \ --platform linux/amd64,linux/arm64 \ -t registry.example.com/api:1.4.2 \ --push . Tag with an immutable version, never rely on :latest . Kubernetes caches images per node; :latest makes "which build is actually running?" unanswerable and breaks rollbacks. 3. A deployment that behaves in production apiVersion : apps/v1 kind : Deployment metadata : name : api spec : replicas : 3 selector : { matchLabels : { app : api } } template : metadata : { labels : { app : api } } spec : containers : - name : api image : registry.example.com/api:1.4.2 # the exact tag you pushed imagePullPolicy : IfNotPresent ports : [{ containerPort : 8080 }] resources : requests : { cpu : " 100m" , memory : " 128Mi" } limits : { memory : " 256Mi" } readinessProbe : httpGet : { path : /healthz , port : 8080 } initialDelaySeconds : 3 livenessProbe : httpGet : { path : /healthz , port : 8080 } initialDelaySeconds : 10 The readinessProbe is the piece people skip and regret: without it, Kubernetes sends traffic to a pod before your app is listening, and

I'm a scrum master. I was a developer ten years ago. I have enough background to discuss design and trade-offs with an LLM — but three months ago I made a deliberate bet on my solo project: I would never read the code. The specs define the tests. The tests control the code. The code is a black box. I'm not claiming this is what everyone should do. But it's my bet, and it forced a system into existence: when nobody reads the code, the process has to carry the trust that a code-reading human normally provides. I've just published that system as a reference implementation: backlog-as-data — the full writeup, the Claude Code skills translated to English, and the CLI source, verbatim from my daily setup. Here's the short version. The backlog is git data, not a document Most agent task-management tools store tasks in a dedicated place — a tasks.json , a database, a backlog/ folder. My bet is different: the backlog is the YAML frontmatter of my spec files. One file per ticket, and the ticket's status is a field — never a location in a document. --- id : PARSE-07 title : Tolerate CRLF in decklist import type : ticket status : todo priority : should exec : model : sonnet effort : think review : light matured : 2026-07-22 --- # PARSE-07 — Tolerate CRLF in decklist import The spec body: design, contracts, test cases. The ticket file IS the spec. Everything below the frontmatter is the spec — written by the LLM, after it has challenged the need I expressed in conversation. The frontmatter is data — owned by a small CLI, mutated only through it. Same file, so they can never drift apart. Why it matters: "move it to Done" is not an operation. LLMs (and humans) mangle documents when a state change means relocating text. Making status a field makes every transition a one-line, idempotent, testable mutation. The board I look at (a small web page on my server, with GitHub deep links to each spec) and the readable markdown view are generated projections , locked by a do-not-edit sentin

If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated. So I built a pipeline to fix that — for real. The problem CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version. That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look. ** What I built** A Python pipeline that: Pulls the real regulatory source data — NIST's official CPRT export for SP 800-171, and the verbatim text of 48 CFR § 52.204-21 for CMMC Level 1 Normalizes it into a structured SQLite schema Generates a JSON rule for every single control, with a machine-actionable instruction attached Here's what one rule actually looks like: \ json { "rule_id": "nist_sp_800-171_rev_2_3.1.1", "framework": "NIST SP 800-171 Rev 2", "control_id": "3.1.1", "title": "ACCESS CONTROL — 3.1.1", "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "agent_guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "generated_at": "2026-07-15T16:42:56.026218+00:00" } \ \ That agent_guidance field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail. Three ways to actually use this 1. AI coding agent system prompt

Documentation is often the last thing developers think about—until a broken link frustrates users or a README sends someone to a 404 page. I wanted a simple way to automatically verify links in Markdown documentation during CI, so I built urldn-link-check. It's an open-source GitHub Action and CLI that scans your documentation and reports issues before they're merged. Features ✅ Detect broken links (404/500) ↪️ Detect redirect chains 🔒 Detect insecure HTTP links 📏 Find overly long URLs 📄 Scan Markdown & MDX files ⚡ Fast concurrent scanning 💬 GitHub PR summaries 📊 JSON & Markdown reports Installation npm install -D urldn-link-check or npx urldn-link-check . GitHub Action uses: urldn/link-check@v1 That's it. Every push or pull request can automatically verify your documentation. Why I Built It While maintaining documentation, I noticed that broken links often go unnoticed until someone reports them. Instead of checking them manually, I wanted a lightweight tool that integrates directly into GitHub Actions and fits naturally into a CI workflow. Open Source The project is MIT licensed and contributions are welcome. ⭐ GitHub: https://github.com/urldn/link-check 📦 npm: https://www.npmjs.com/package/urldn-link-check https://www.npmjs.com/package/urldn-link-check This is the first developer tool in the URLDN ecosystem, with more open-source projects planned in the future. If you have ideas or feedback, I'd love to hear them.

Java is everywhere in backend systems, enterprise applications, and production environments. But when it comes to numerical computing, data manipulation, and scientific-style operations, Python's NumPy ecosystem has become the standard. I wanted a similar experience in Java: a lightweight, dependency-free library for working with multidimensional arrays and linear algebra. That idea became NumPy4J. What is NumPy4J? NumPy4J is an open-source numerical computing library for Java inspired by NumPy. It provides: Multidimensional arrays (NDArray) NumPy-style broadcasting Array creation utilities Reshaping and slicing Element-wise operations Linear algebra operations Example: NDArray A = NDArray . of ( new double []{ 1 , 2 , 3 , 4 }, 2 , 2 ); NDArray B = NDArray . ones ( 2 , 2 ); NDArray C = A . add ( B ); Matrix operations: NDArray result = LinearAlgebra . matmul ( A , B ); Solving equations: NDArray x = LinearAlgebra.solve(A, b); Why build another numerical library? There are already excellent Java math libraries available. The goal of NumPy4J is different: Provide a NumPy-like API experience Make multidimensional arrays a first-class concept in Java Keep the API simple and approachable Create a foundation for future scientific computing features Testing approach To make sure behavior stays consistent, NumPy4J uses Python NumPy as a reference implementation. Test cases are generated with NumPy and validated against the Java implementation, covering: Broadcasting Matrix operations Reshaping Transpose Linear solving Element-wise calculations What's next? The roadmap includes: More NumPy-compatible operations Matrix decompositions (QR, LU, Cholesky) Eigenvalue computation More statistics functions Performance improvements Try it out If you work with Java and need NumPy-style numerical operations, I would love for you to try NumPy4J, provide feedback, and contribute ideas. GitHub: https://github.com/darius1973/numpy4j Documentation: https://darius1973.github.io/numpy4j/inde

The wrong way to install Docker on Ubuntu is the one that looks easiest: sudo apt install docker.io . That package exists, it installs, and it runs a container. It is also whatever version happened to be frozen into the archive when 26.04 was cut, it lags the real releases by months, and it ships without the Compose and Buildx plugins you will want by the end of the week. Use Docker's own apt repository instead, and this is the post I keep open so I do not re-derive the repo setup from memory each time. This is short on purpose. The steps are the official ones, and the only place worth slowing down is step 5, where adding yourself to the docker group quietly hands out root. That tradeoff is the part most guides skip, and it is the one thing here actually worth reading twice. TL;DR Remove any distro docker.io / containerd packages, add Docker's GPG key and the deb822 .sources repo, then sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin . Verify with sudo docker run hello-world . Add yourself to the docker group to drop the sudo (it is root-equivalent, more below). Prerequisites Ubuntu 26.04 (Resolute Raccoon), server or desktop, on amd64 or arm64 . A user with sudo. If you are still on root, create a sudo user first . Outbound HTTPS to download.docker.com . 1. Remove the distro Docker packages first Ubuntu ships its own docker.io , docker-compose , and containerd packages, and any of them will fight the official ones over the same files and the same containerd socket. Clear them out before you add Docker's repo. This is safe on a fresh box because there is nothing to lose yet; on a box that already ran the distro Docker, it removes the packages but leaves your images and volumes in /var/lib/docker alone. sudo apt remove $( dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc podman-docker containerd runc | cut -f1 ) The dpkg --get-selections wrapper is just so the command does not error out on pac

LLM-written bibliographies do not stop at arXiv preprints. Law review drafts invent reporter cites; multilingual papers mangle Chinese titles. citesure 0.2 extends the integrity gate into those failure modes. US case law via CourtListener References that look like court cases — @jurisdiction entries, Plaintiff v. Defendant titles, or reporter strings such as 347 U.S. 483 — are resolved against Free Law Project CourtListener. Ranking prefers an exact reporter cite over companion orders, so Brown lands on 347 U.S. 483 rather than a later procedural listing. @jurisdiction { brown1954 , title = {Brown v. Board of Education} , year = {1954} , howpublished = {347 U.S. 483} , } citesure check examples/packs/us-case-law.bib citesure warm-cache cases.bib Optional COURTLISTENER_TOKEN for higher rate limits. Law-review CI: templates/journal/law-review.yml . CJK-aware matching NFKC + fullwidth folding; character-level similarity for CJK-heavy titles; CJK bigrams in claim scoring so Chinese claims are not silently empty. Evidence Integrity bench 242/242 (US cases + Chinese titles + multi-domain set) Claims mini-bench 29/29 Eight domain packs including us-case-law Install pip install "git+https://github.com/SybilGambleyyu/citesure.git[pdf]" Source: github.com/SybilGambleyyu/citesure · Demo: workers.dev

There’s a debate going on in the Trump administration over how to handle increasingly powerful Chinese AI models.

Several federal agencies are contributing toward the interdisciplinary research efforts.

I built The Daily FM because I wanted a daily summary of the latest AI news sent to my podcast app and then realized it was useful in summarizing other stuff: - Any blogs, websites, or X handles - The top Hacker News stories with comments - Long podcasts (think Lex Fridman) - Changes in state/federal legislation It pulls your sources, writes a script with a frontier-ish model of your choice, runs it through TTS (MAI-2 studio voices), and publishes a standard RSS feed. You can also combine severa

Treasury Secretary Scott Bessent warned the U.S. government could sanction Chinese AI companies after White House officials accused Moonshot of distilling Anthropic's Fable model to develop Kimi K3.

A closely watched social media addiction lawsuit that had been set to go to trial next week has been dropped after the plaintiff voluntarily dismissed his claims against Meta, leaving none of the major tech companies facing trial in the case.

Two nested loops can do the same work, have the same O(n²) complexity, and still run around 15× apart. A visual explainer on why: the RAM model, the memory wall, cache lines, locality, L1/L2/L3, prefetching, data layout and false sharing. It also covers how the timing difference between a cache hit and miss became the side channel behind Spectre and Meltdown. submitted by /u/Ok_Marionberry8922 [link] [留言]