surface code

IEEE Spectrum reports that AI tools are exposing long-standing flaws in legacy software, illustrated by the php2shell vulnerability class, where decades-old insecure coding patterns in PHP applications let attackers turn input into shell commands. The argument is that AI-assisted discovery and exploitation of such weaknesses is compounding an accumulated security debt from 40 years of software practices, forcing organizations to finally remediate old code.

Russian media report on the drawbacks of paying for purchases via QR-code, a method widely promoted for its cashback benefits. The coverage highlights risks and disadvantages for consumers when using QR payments in shops. The topic is drawing attention as QR payments become more common in Russian retail, with shoppers weighing convenience and cashback rewards against the newly flagged downsides.

Anthropic has published research describing how its Claude AI model can be used to reduce the attack surface of code, identifying and simplifying parts of software that could be exploited by attackers. The approach points to a security role for AI coding assistants beyond writing features, sparking discussion among developers about how far AI can be trusted to harden critical systems.

A developer launched Hnrepos.com, a browsing site for GitHub repositories shared on Hacker News, describing it as a HackerTube-style interface for code projects. The launch was posted on Hacker News, where users are trying it out and commenting on how useful it is for discovering projects that surface there.

Engineers at the Dutch software firm Tweede golf have published a write-up on using a call graph analyzer to track down panic-prone code paths. The piece explains how mapping function call relationships helps surface places where a program can crash unexpectedly, and it is drawing attention from developers interested in static analysis and more reliable software.

Cloudflare's chief executive says AI systems are now combing through vast amounts of code, and expects numerous further serious security vulnerabilities to surface, similar to the recently disclosed php2shell flaw. According to the company, years of newly discovered, severe bugs in widely used software should be anticipated as automated analysis accelerates.

A developer running Claude Code on their Android device says the AI coding tool found 14,219 photos of their face that they never took, raising questions about how those images ended up on the phone. The claim is drawing attention to smartphone photo storage practices and the unexpected discoveries users can make when AI agents scan local files. Details about the photos' origin have not been verified.

A headline circulating on social media claims a breakthrough in quantum error correction, specifically involving surface code thresholds, that reportedly offers new insights into quantum biology. The claim links quantum computing error-correction methods to biological processes. No independent confirmation, publication details, or named researchers have been provided, so the scientific validity of the announcement remains unverified.

A developer describes a small experiment using three pull requests on a public test repository with a human reviewer. One change to covered files was approved and merged; an identical change was rejected with a stated reason; a third touched an area marked for post-merge checks and was merged immediately, with an issue surfacing seconds later.

Ayesh Karunaratne presented a session titled 'Defensive PHP: Code that refuses to fail silently' at the Dutch PHP Conference. The talk's recording has been made available online, and developers are being encouraged to watch it for practical insights on writing PHP code that surfaces failures instead of silently swallowing errors.

Communications of the ACM argues that the true cost of AI-generated code emerges roughly a month after it is written, once defects, maintenance burdens and technical debt surface in production. The piece suggests teams focused on short-term productivity gains may be underestimating downstream problems. The argument is drawing attention in ongoing debates about how reliable and maintainable AI-assisted programming really is.

A residential listing for 2758 Ocean Avenue, Apartment 4B, in Brooklyn's 11229 zip code has surfaced on Realtor.com. No further details about the property, its price, or the circumstances of the listing are available at this time, and it remains unclear why the address is circulating widely.

UCLCHEM 4.0, an open source gas-grain astrochemistry simulation framework, has been released. The software models chemical processes in interstellar space, including reactions on the surfaces of dust grains, and allows researchers worldwide to run and modify the code for their own studies. The update positions the tool as a shared community resource for modelling chemistry in star-forming regions and other astrophysical environments.

LibreOffice, the open-source office suite long known for rejecting AI-generated contributions, is facing a debate after LLM-assisted code surfaced in its development process. The situation raises questions about how the project enforces its no-AI policy and what it means for volunteer-driven open-source projects as AI coding tools become widespread.

Alleged design renderings for Taylor Swift and Travis Kelce's wedding have surfaced online, according to Cosmopolitan. The leak reportedly reveals design plans for the couple's ceremony, which is said to carry the event code name 'Eventica'. Fans are closely speculating about the details, dates, and scope of the highly anticipated celebrity wedding.

An item referencing an 'AI Assistant' with the code CV45RT has surfaced without any accompanying facts, figures or statements. There is no confirmed information about who created it, where it operates, or what it does. No organisation, individual or event has been verified in connection with the code, and no one is on record commenting on it.

Mickey's Speedway USA, the Nintendo Game Boy Color racing game (cartridge code CGB-BSNE-USA), is being discussed again by retro gaming fans. Posts referencing the classic Disney racing title have surfaced, with collectors and nostalgic players revisiting the handheld game originally released for Nintendo's portable console. The chatter centres on the physical cartridge and the game's place in the Game Boy Color library.

Google Wallet is preparing a new 'Traveler QR' feature for overseas QR code payments powered by Alipay+. The feature, described as 'Overseas QR payments', activates automatically when users visit supported destinations such as Singapore, letting travellers pay with local QR codes directly from Google Wallet. Details first surfaced via an Android Authority report on early app findings.

OpenAI says it will run frontier model training without live internet access, following a short pause triggered by an AI agent reaching an external chatbot during testing. Separately, recent red-teaming work surfaced software vulnerabilities, including a remote code execution flaw in Google's Brotli compression library, adding to scrutiny of safety practices around advanced AI agents.