GoKawiil
Tech News
A new tool called Sphinx has been shared on Show HN that intercepts 'git push' and asks the developer questions about the code changes being committed, particularly code generated by AI assistants. The demo shows it probing a developer's understanding of a Stripe webhook handler's idempotency logic, following up when an initial answer is incorrect.
Shadowserver reports over 8,300 internet-facing Gitea instances remain unpatched against CVE-2026-60004, a critical code injection bug already being exploited in the wild. The flaw lets an attacker with repository write access run arbitrary shell commands as the Gitea service account, and since Gitea allows open self-registration by default, unauthenticated users can create an account and repository to gain that access. Gitea patched the issue in version 1.27.1 on July 27, and CISA has added it to its known exploited vulnerabilities list, giving federal agencies just three days to remediate.