GoKawiil
Tech News
Lasm is a new toolchain that ahead-of-time compiles standard Lean 4 programs into WebAssembly, letting a single codebase run as a Node server, serverless or edge function, WASI/Fastly module, or browser app. It ships via npm bundling Lean and its Lake build tools, requiring only Node, Bun, or Deno. Its flagship demo, a RealWorld-spec app called Conduit, includes 117 formally proved theorems.
CISA confirmed attackers are actively exploiting a critical vulnerability in Google's Brotli compression library, dubbed Node2Shell, that can let unauthenticated attackers crash systems, leak memory, or run arbitrary code. The agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04. Microsoft separately issued an emergency .NET update days earlier addressing related privilege-escalation risk from the same flaw.
Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode and the eMudhra certificate authority each disclosed serious security incidents. PHP, Node.js and GitLab all shipped fixes on October 21, the same day a bad LiteLLM release was pushed out. Amazon's MadPot honeypots recorded attempts to exploit the PHP flaws four days before they were publicly disclosed.
HeyPuter has released the Everything Project, a mono-repository on GitHub aiming to recreate proprietary software like Office, Slack, Photoshop and AutoCAD as free, MIT-licensed alternatives. The repo spans categories including office tools, collaboration, creative tools, engineering, productivity, finance, business, developer tools and games, and requires Node.js 22.12 or newer to run.
A critical buffer overflow in the Brotli compression library, affecting versions 1.0.3-1.0.9, 1.1.0 and 1.2.0, can let attackers craft malicious compressed streams that corrupt memory on vulnerable decoders. The bug, nicknamed HTTP2Shell, Broccoli2Shell or Node2Shell, originated in Node.js but also touches Python libraries like urllib3, requests, httpx and aiohttp, prompting Microsoft to ship an emergency .NET update on Sunday.
Security researchers disclosed a flaw in Brotli decoder versions 1.0.3 through 1.2.0 that lets maliciously crafted compressed data trigger an out-of-bounds write, potentially causing crashes, memory leaks, or remote code execution. The bug, rated 9.2 Critical by GitHub, affects any software built on Google's C decoder, including Node.js's built-in fetch and zlib bindings, Python's requests and aiohttp libraries, and frameworks like Express and body-parser that decompress Brotli-encoded data.
A developer has released CleanFrame, a stripped-down Tizen home screen replacement for Samsung's The Frame TV, showing apps, a photo background and a 12-hour clock, navigable via the TV remote. The code is published on GitHub along with a browser-based preview and setup notes, built and tested specifically on the creator's own TV and firmware.
A wave of cybersecurity incidents struck simultaneously: AI-discovered PHP vulnerabilities took government websites offline and prompted an NSA advisory to patch or disconnect affected systems. Node.js patched four high-severity bugs including a remote code execution flaw and TLS bypass issues, while LiteLLM confirmed its packages on PyPI, Docker Hub and GHCR were compromised with malware that stole credentials and enabled remote access. Separately, certificate authority eMudhra had private keys compromised, raising concerns about fraudulent website certificates.
A new open-source project called Battlezone Online (bzo) lets players join BZFlag multiplayer tank battles directly in a browser, on desktop, phone or VR headset, without installing a client. The server runs on Node.js and the browser client uses Three.js over WebSockets, WebTransport and WebRTC, connecting to existing BZFlag servers through a proxy list. Tagged releases ship as GitHub source tarballs and Docker images built on Ubuntu 26.04, supporting both amd64 and arm64.
Cloudflare has acquired Deno, the company founded by Ryan Dahl behind the JavaScript/TypeScript runtime of the same name. Cloudflare will maintain the open-source Deno runtime for one more year before ending development, while Deno Deploy will shut down in six months with migration support offered to paying customers moving to Cloudflare Workers. The team's focus shifts to a new project called celld, built on the Cloudflare Workers programming model, and the JSR package registry will keep running under Cloudflare's infrastructure.
Ryan Dahl announced the Deno team is moving to Cloudflare, with the Deno runtime being wound down over the next 12 months. JSR will keep running on Cloudflare's infrastructure, and the team will now work on merging Deno's celld component into Cloudflare's workerd runtime. The move follows Bun's team joining Anthropic ten months earlier.
Jev is a local code review tool that classifies changes in agent-generated pull requests into priority tiers (P0, P1, P2), showing only the highest-priority changes by default. It runs on the reviewer's own machine, translates diffs into natural language explanations, and does not post anything back to GitHub. The tool integrates with a Chrome extension and GitHub CLI to analyze real pull requests, alongside a offline demo mode.