tl;dr: Karpathy, frustrated by YouTube's "enshittified" recommendations, used Claude Opus 5.5 to build HackerTube.org—a YouTube clone populated with 6,454 videos recommended across 40K Hacker News comments from 2007-2026, organized into 150 topics with custom ForYou recommendations and no user accounts. The entire project took ~2 hours, with Karpathy only manually handling the API key, VPS setup, and domain purchase while Claude Code did the rest, including deployment and hardening.

tl;dr: Summary not available

tl;dr: A remote, unauthenticated use-after-free in Linux's IPv4 TCP handshake (CVE-2026-98432, CVSS 9.8) affects kernels since 4.4, with Anthropic claiming Claude built a working root exploit against servers running multipath TCP listeners—which Go programs enable by default since 1.24. Upstream fixes shipped Oct 11–18 via a four-line change (kfree → kfree_rcu), but as of Oct 31 Ubuntu and RHEL 8/9/10 remain unpatched. Interim mitigations include nftables/iptables rules dropping IPv4 TCP packets carrying IP options and disabling MPTCP.

tl;dr: A multi-agent workflow (planner, two ideators, solver, reviewer, repair worker) using five Qwen3.8-27B instances communicating via files on disk matched the Fable 5 paper's harness on the first 10 LiveCodeBench Hard problems (9.8 vs 9.6 out of 10, five passes each), both beating a single Fable 5 call (8.0). The sample is too small to claim improvement over the original harness, and training contamination can't be ruled out. The setup is reproducible via Memdoor's YAML-based workflow, with runs averaging 40 minutes and $0.39 each on OpenRouter.

tl;dr: Jepsen tested ParticleDB, a Rust-based multi-model database marketed as "Full ACID" and "formally proven," and uncovered 96 bugs across versions 1.1.4–1.1.18.11.rc-22, most occurring on a single node with a single client and no faults. Issues ranged from crashes, deadlocks, and lost writes to broken predicates (e.g., `WHERE 4 = 5` matching rows), ignored NOT NULL/UNIQUE constraints, undeletable "zombie" rows, dropped tables resurrecting with mangled data, and silent type coercion. Even in the latest tested version, the default OCC mode lost committed writes and the "serializable" mode permitted Lost Update anomalies.

tl;dr: Researchers chained ChatGPT's HTML Preview, a MathLive postMessage listener that accepted unauthenticated cross-frame messages containing raw HTML, an unsandboxed srcdoc iframe, and a YouTube oEmbed JSONP endpoint whitelisted by CSP to achieve arbitrary JavaScript execution as chatgpt.com from a single shared conversation link. Opening the share let attackers call ChatGPT's authenticated APIs as the victim—enumerating and exfiltrating private conversations. OpenAI patched the issue on October 26, classified it P1, and paid a $5,000 bounty.

tl;dr: Using a virtual creature called a "spark" with just two sensory neurons and two motor neurons, the article demonstrates how tiny changes in neural wiring—adding a second eye, crossing connections, or switching excitatory to inhibitory signals—produce dramatically different behaviors that look like fear, aggression, or love of light. Varying connection strengths across individuals further creates distinct "preferences," illustrating how complex behavior and apparent intelligence can emerge from simple neural circuits without any central controller.

tl;dr: Researcher Jiahao Shao claims Anthropic flagged him for "training a competitor" despite only using Claude to submit jobs and run analysis on rollouts from an open-source model. He reports that any prompts touching RFT, SFT, or training larger models now trigger blocks, model downgrades from Opus 5.5 to Opus 5, or session termination. He criticizes Anthropic for treating paying research users as adversaries while having trained on public data themselves.

tl;dr: Lean creator Leo de Moura argues that AI has made formal verification practical by solving autoformalization—frontier models can now translate code or math papers into machine-checkable Lean proofs, drastically reducing the historical cost of verification. He envisions software engineering shifting from writing code to writing specifications, with AI generating implementations and proofs that are checked by multiple independent kernels; early adopters include AWS, Microsoft's SymCrypt team, and Anthropic (whose Fermat's Last Theorem proof runs 13M lines). The same approach is spreading beyond math to physics, finance, chemistry, and even parts of law.

tl;dr: Summary not available

tl;dr: Molly, a popular hardened fork of Signal, hasn't been updated since July 31 (v8.19.2-4) and now carries unpatched vulnerabilities that mainline Signal has already fixed, including an exploit disclosed in October and patched in Signal 8.27.1. Users are advised to switch back to mainline Signal and uninstall Molly until the project resumes regular updates.

tl;dr: Phorion discovered that versions 2.1.312 and 2.1.313 of the "Claude Code for VS Code" extension on the Cursor Marketplace (since removed) contained a backdoor that executes on load, appending an attacker's SSH public key to authorized_keys, attempting to enable SSH, and establishing a persistent reverse SSH tunnel to 134.209.82.225 with platform-specific persistence (LaunchAgent, cron, or scheduled task). A bug in the macOS logic—checking Remote Login status without root—often prevents SSH enablement, but keys and persistence still get planted. Uninstalling alone won't remediate; responders must remove persistence artifacts, keys, and rotate exposed credentials.

tl;dr: Summary not available

tl;dr: Norwegian glacial archaeologists with Secrets of the Ice have recovered 48 prehistoric arrows this field season from melting ice patches in Innlandet, including slate, bone, and freshwater mussel shell arrowheads dating back 5,000-6,000 years to the Stone Age. As the oldest ice finally melts after 6,000-7,000 years, finds are shifting from Viking Age to much older artifacts. Researchers estimate most archaeologically significant ice patches will vanish within 20 years.

tl;dr: Summary not available

tl;dr: VOLTA-AUTODOXER is a Windows infostealer that, after harvesting credentials, cookies, wallets, and session tokens, sends a structured victim profile to OpenRouter-hosted LLMs (defaulting to Claude, falling back to Kimi and Gemini) to generate a ranked "target assessment" dossier identifying monetizable assets and OPSEC weaknesses. The malware uses a swappable build-time template suggesting it's sold as a commodity builder, and includes refusal-resilience logic that detects LLM guardrail responses and retries with more permissive models. Notably, there's no attacker-owned infrastructure—inference runs through the victim's own network before exfiltration.

tl;dr: Scribd (parent of Slideshare, Everand, and Fable) notified users of a security breach in which an unauthorized third party accessed data including email addresses, last 4 digits of credit cards, card issuer, expiry date, and payment history. Scribd says the affected system has been secured, law enforcement and data protection authorities have been notified, and users should stay alert for phishing attempts. No evidence of misuse has been reported so far.

tl;dr: Mistral released the open weights for Mistral Large 4 ("Le Chonk"), a 1T-parameter multimodal model trained in Europe, under a modified MIT license (commercial MaaS requires a separate license). It claims leading open-weight performance on coding benchmarks (FrontierCode, Terminal-Bench) and defensive cybersecurity, with three reasoning modes, roughly 47% fewer tokens than GLM-5.3 at comparable scores, and pricing at $0.70/M input and $2.10/M output tokens. Weights are on Hugging Face, with deployment via vLLM, SGLang, Microsoft Foundry, and NVIDIA NIM.

tl;dr: GCC lowers switch statements using three main strategies: bitset tests (packing case values into a register and using the `bt` instruction), jump tables, and binary decision trees. The compiler uses dynamic programming to find optimal groupings for bitsets and jump tables, with heuristics based on case density—jump tables require roughly one case per 8 entries when optimizing for speed (one per 2 for size), while bitsets need ≤64-value ranges and ≤3 unique destinations. Anything not profitable for these optimizations falls back to a probability-balanced binary comparison tree.

tl;dr: Hackers drained roughly $6.3 billion in crypto from Binance hot wallets across at least ten blockchains in a 20-minute attack on October 29, which tracing firms TRM Labs, Chainalysis, and Elliptic attribute to North Korea's TraderTraitor group. Binance says the breach began with a compromised engineer's laptop and has pledged to cover losses. About $2.8 billion (mostly stablecoins) has been frozen, but the remaining $3.3 billion in Bitcoin, Ether, and XRP cannot be frozen and may be laundered via novel automated techniques.