Peter C. has released coopiano, an open-source C++17 piano synthesizer that models hammers, strings, a soundboard and sympathetic resonance rather than using samples. It renders notes and MIDI files to stereo WAV on supported platforms and offers live MIDI/audio on macOS; the MIT-licensed release does not include the developer’s prototype AU or VST plugins.
Former Google engineer Evan Czaplicki says sending email is technically straightforward, but reliable delivery is costly because inbox providers use varying spam filters and sender-reputation systems. He argues that reaching providers that judge entire IP address blocks may require dedicated address space and enough mail volume to build trust.
The author found that Windows 11 can run `CDPLAYER.EXE`, linked in a Windows NT 3.1 pre-release build on November 16, 1992, without modification; a small DLL can emulate a CD drive so it plays audio. An earlier 1993 FreeCell version also runs, while a 1985 Windows 1.01 Reversi game works only with the 16-bit compatibility tool otvdm.
Maker [Smashcat] adapted a ZX Spectrum game port into an engine that runs Manic Miner, Scramble, Space Invaders and Pac-Man on an Arduino Uno. It draws a scrolling 256×256 map and up to nine sprites at 50 frames per second, generating video and two-channel audio directly; the code is available on GitHub, with a WebAssembly version for testing.
Bruce Ediger says Apache logs show a centrally coordinated crawler operating from Contabo GmbH IP addresses repeatedly traversed every page in his Scraper Junkyard, following its binary-tree links. Across six crawls, it made about four requests per second, with no duplicate page requests; 7,690 IP addresses appeared across four series, and 2,964 took part in all four.
Citizen Lab says Israeli ad company Discover-Tech enabled Candiru spyware attacks through targeted ads, documenting zero-click infections of at least 45 Al Jazeera devices in 2024 and 2025. Its report says Discover-Tech’s Controlium platform could select targets by advertising ID, browser ID or IP address, and that analysis of four billion bid records found its ads on nearly 200,000 sites and apps; several ad platforms have since cut off the company.
Trail of Bits tested 25 package managers against repositories altered to inject malicious code, finding that only Go and vcpkg verified every downloaded package by default and fewer than half used lockfiles that checked for tampering by default. The study also found that signatures are often available but go unverified, require extra setup, or lack verification support, leaving many ecosystems exposed to repository compromise.
Meta has released the weights for Muse Spark Open, a multimodal model with 816 billion total parameters, 42 billion active parameters and a 1-million-token context window, aimed at coding and agentic tasks. The company says it can run on two Apple M5 Ultra Mac Studios and is available through several model platforms under a license with limited commercial terms.
Jake Archibald’s comparison finds AVIF generally produces smaller lossy web images and decodes faster than JPEG XL, with especially large size advantages for screenshots, illustrations and transparency. JPEG XL can win on some photos and is substantially better for lossless images; Archibald recommends defaulting to AVIF 4:4:4 at high effort and testing JPEG XL when AVIF files seem unusually large.
Antirez has released c64-hw-sim, an open-source simulator that models the Commodore 64’s ASSY 250407 motherboard and components pin by pin, letting users introduce faults such as removed chips, broken pins, and open resistors. It can help users study the hardware or investigate repair hypotheses, but it runs at only about 31–48% of real speed on the listed modern computers and does not model several analog effects or internal chip faults.
Cloudflare made Hyperdrive’s MySQL support generally available after fixing a caching bug that caused rare empty query results or hangs. The bug arose when Hyperdrive’s Client and Endpoint shared a cache but stored MySQL responses in different protocol formats; Cloudflare fixed it by caching responses in a canonical format, bringing Client connection success to 99.99%.
Developer [sandwich] created vfio-native, a set of Linux kernel patches and changes that makes KVM virtual machines appear more like bare-metal hardware. Against one VM-detection tool, it scored 1 out of 85 detection points, compared with 10 for standard KVM; the tool is available in Arch Linux’s AUR and may help malware researchers or users of software that refuses to run in virtual machines.
KillaBoi’s writeup presents a standard-library Python proof of concept for the Steal My Bitcoin PHP CTF: memory-exhaustion requests leak heap and code addresses, which are used to forge a PHP cleanup callback that runs a command. The author reports reproducing the chain in a local PHP 8.4.26 Alpine lab and says a 2026 live run returned a checksum-valid private key, while noting the original network traffic was not captured and the key did not match the advertised prize address.
A researcher named Ava released Shadow, a Kindle jailbreak for firmware versions 5.19.6 and later, chaining an uninitialized-memory leak with a stack-buffer overflow in Amazon’s MTP daemon to execute code as root. Amazon patched the exploit in firmware 5.20.1; Shadow requires the jailbreak script to be transferred to the device and a replug before triggering the exploit.
Wails maintainer Lea announced the release of Wails v3.0.0, a Go framework for building desktop apps with web frontends and each platform’s native WebView. The major version adds an explicit application-and-window architecture, runtime multiple windows, system trays, native menus and dialogs, generated service bindings, an updater and server builds; mobile support remains experimental. v2 will continue receiving critical updates, but moving to v3 requires porting rather than a simple version upgrade.
NotARoomba has published Keybytes, an open-source modular keyboard design with individual 1u key modules that connect via pogo pins and can be rearranged. Each key uses a CH32V003 RISC-V microcontroller; a central STM32WB55 board provides Bluetooth, USB-C, battery charging and key programming.
OpenLDK creator and former GNU Java compiler developer E. J. Green describes a Common Lisp JIT runtime that translates Java bytecode into Lisp for SBCL, letting Java classes and methods interact directly with Lisp and several JVM languages. In a Spring Boot startup test, an image saved with the initialized application context launched in a median 83.9 ms, compared with 53.5 ms for GraalVM Native Image; OpenLDK used more memory and remains under development with compatibility gaps.
Jaime’s Meatloaf is an ESP32 device that connects Commodore computers to files stored locally or at online URLs, sending them over the computers’ IEC serial port. Users can access files from the Commodore without configuring the device, and Meatloaf can unpack nested archive files as if they were on a floppy disk.
Voxelmanip’s guide shows how to build a Java ME MIDlet without Sun’s legacy SDK, using OpenJDK 8, MicroEmulator API stubs and ProGuard for compilation and preverification. It walks through packaging and testing a simple app, then transferring it over Bluetooth to a Sony Ericsson S312, and notes Java ME’s limits in language features, device compatibility and performance.
Vim Classic is a human-maintained, long-term support fork of Vim 8.x. Its first release, Vim Classic 8.3.0, was announced on June 2, 2026; the project says it is maintained without generative AI tools.
A 2021 update to Chromium’s Flatpak runtime brought glibc 2.33, which changed how condition-variable waits call futex; Chromium’s audio sandbox then rejected the added `FUTEX_CLOCK_REALTIME` flag, crashing the audio service and breaking playback. The post’s author traced the bug to a sandbox policy that failed to account for that flag, and says a one-line change fixed it.
Zagitta’s GPU-unlock 1.0.0 is a Linux kernel module that unlocks the FP/BF16 instruction issue rate on Nvidia GeForce RTX 3000 cards based on GA102, GA103, GA104 and GA106 chips, without patching the Nvidia driver. User reports show BF16 dense matrix-multiplication gains of roughly 25–80%; on an RTX 3090 Ti, the project reports BF16 throughput rising from 87.5 to 157.41 TFLOPS.
The post warns that POSIX `wordexp(3)`, often used for tilde expansion in C, can execute commands embedded in its input by default. It argues that even `WRDE_NOCMD` may be bypassed in some implementations, including musl and reportedly macOS’s helper, and advises against using the API on untrusted input.
Developer Shraiwi built a SIMD-accelerated FAST feature detector for the ESP32-S3 microcontroller, using its 128-bit instructions and workarounds for limitations in pixel alignment and signed comparisons. In testing, it raised throughput from 5.1 to 11.2 megapixels per second—about 2.2 times faster—and processed a 320×240 frame in roughly 6 milliseconds.
A home-built luggable computer called the Slurptop packs a Ryzen 7 7730U mini PC, 64GB of RAM, a 14-inch display, mechanical keyboard and trackball into a custom 3D-printed chassis. Its builder powers it with swappable 24V Kobalt tool batteries through a UPS-style circuit, reporting more than four hours of light use on a 4Ah battery.
Argus is an early-stage, MIT-licensed open-source security operations platform by Thomas Unise, designed for self-hosted, multi-tenant deployments. It combines asset collectors, 12 starter detection rules, governed read-only AI agents, and an action broker that requires policy checks and approvals before changes; cloud collectors and action executors have been tested with fixtures and mocked APIs, not live accounts.
A vintage Mac enthusiast released a first version of software that lets Apple Network Servers boot Mac OS using a preproduction ROM while retaining the ability to run AIX. The pack fixes the server’s built-in MACE Ethernet and video and restores proper restarts; it includes an Ethernet INIT, a native video driver, and a Startup Items utility.
Goose is a C- and Rust-like systems programming language that uses compiler-managed data stacks instead of a heap, with the project claiming this enables memory safety without lifetime annotations. Its repository reports that across 16 benchmarks Goose was 3.51 times faster than idiomatic C++ and 1.13 times faster than the best safe Rust, while using less peak memory; the claims come from the Goose project hosted at aardappel.github.io.
Healey Codes’ author decompiled the 2001 game Fast Food Tycoon 2 using Ghidra and an AI-assisted workflow, analyzing more than 4,000 functions. The investigation maps out how the game renders its isometric city and lighting, animates characters, and scores pizzas—including a recipe-copying check that penalizes copied recipes.
The post explains Go’s experimental SIMD packages, `simd/archsimd` in Go 1.26 and portable `simd` in Go 1.27, with examples of vector operations and how the compiler maps them to CPU instructions. Its dot-product example reports about a ninefold speedup over a scalar loop on the author’s AMD Ryzen AI Max+ 395, while noting that SIMD is experimental and gains depend on the workload.
