Morning Brief: Sunday, October 25

Seventy-five feeds reporting. Two weeks. 5,737 items reduced to what follows. (what we track, how we crawl, subscribe)

Black October stopped being a PHP story overnight, and the first thing that moved on a Sunday morning was a WAF rule.

Node2Shell has evolved into HTTP2Shell: Aikido's writeup on CVE-2026-111497 traces it from Brotli decompression in a handful of Python packages out into the HTTP-library layer generally, which is to say out of one language and into the thing every language uses to answer a request. Cloudflare's response is the tell. The emergency Managed Ruleset release dated today adds rules for Brotli-encoded request bodies and the Next.js image optimization endpoint — a changelog entry on a Sunday is not routine maintenance. TechCrunch's PHP-ocalypse retrospective and its companion piece on the internet's rickety infrastructure both land on the same reading we had on Saturday, now with a second data point: the discovery side scales and the remediation side is a managed ruleset shipped by whoever happens to sit in front of your traffic. The New Stack's look at AWS claiming its security agent fixes 89% of bugs is worth reading against that, mostly for the catch in the headline.

The counter-programming was financial. Apollo's note finds no signs of AI payoff outside the tech sector, Apricitas puts a number on the creative-class job losses and declines to attribute all of it to AI, TechCrunch maintains a running graveyard of projects that did not make it, and InfoWorld reports OpenClaw's creator spent ten million dollars on tokens last month. Murat Demirbas's question — what do the frontier labs actually believe — is the right frame for all four.

Top (5-7 min)

Node2Shell evolves to HTTP2Shell: blast radius affects many HTTP libs and apps: Aikido via Hacker News, 2026-10-24. The primary source for today. Starts in Brotli handling in Python packages and ends at the HTTP-library layer.
WAF emergency release: Brotli-encoded request bodies and the Next.js image endpoint: Cloudflare, 2026-10-25. Dated today. An emergency Managed Ruleset release on a Sunday is the operational confirmation of the paragraph above.
PHP-ocalypse: How two critical web bugs almost broke the internet: TechCrunch, 2026-10-24. The week assembled for someone who has not been following it. Useful precisely because it treats the two bugs as one event.
AWS says its AI security agent fixes 89% of bugs — but there's a catch: The New Stack, 2026-10-24. Read the catch. The number is measured on a benchmark, not on the dependency graph anyone actually ships.
No Signs of AI Payoff Outside the Tech Sector: Apollo via Pinboard, 2026-10-24. Macro data against the capex. The tech sector's productivity story has not propagated outward yet.
What Do the Frontier Labs Actually Believe?: Murat Demirbas, 2026-10-24. Separates stated beliefs from revealed ones. The best thing in the window for making sense of a contradictory news cycle.
Personal agents need a new kind of harness: Planet Clojure, 2026-10-24. Argues authority, not capability, is the missing primitive. The constructive answer to the agent-ownership question we have been carrying for three days.

Themes

HTTP2Shell: one language, then all of them

Will AI expose the rickety infrastructure of the internet?: TechCrunch, 2026-10-24. The structural version of the question, now answerable with two weeks of evidence rather than speculation.
Be Aware of What's in Your Logs: Lobsters, 2026-10-24. Adjacent and timely: the request bodies everyone is now inspecting are also the request bodies everyone is logging.
FreeDNS: Hacker News, 2026-10-24. Surfaced this week for the usual reason — people are auditing what their infrastructure actually depends on.

Does the money show up?

America has lost 200k jobs in media, film and the arts. How much is AI?: Hacker News, 2026-10-24. Does the attribution work honestly, which is rarer than the headline suggests and makes the piece more useful than its framing.
The AI graveyard: a running list of projects and startups that didn't make it: TechCrunch, 2026-10-24.
OpenClaw creator spent $10 million on AI tokens last month: InfoWorld, 2026-10-23. One developer's monthly inference bill. The unit economics of agent products in a single number.
How we deploy trillion-parameter frontier models on Cerebras: Cerebras via Hacker News, 2026-10-25. The supply side of the same arithmetic, written by people selling the alternative to GPUs.
What's wrong with AI?: Lobsters, 2026-10-24.
Block's new voice model sounds eerily human: TechCrunch, 2026-10-24.

Agent authority and the harness

editmd 0.2.0: Planet Clojure, 2026-10-24. The implementation alongside the argument, which is the pairing worth reading.
Building an agentic software factory? Start with the sensor.: The New Stack, 2026-10-24.
Here are the top AI agents that can live in your text messages: TechCrunch, 2026-10-24. Consumer agents arriving in SMS, with no authority model to speak of. The gap the harness argument is about.
Setting the Scene (Public v1; October 25): Alignment Forum, 2026-10-25.
BSides CambridgeMA 2026: Five of Nine Talks Are About Agents: wal.sh, 2026-10-25. The local-conference version of the same signal: a security CFP where agents are now the majority topic.

Scan

Security and privacy

Not Palantir: Hacker News, 2026-10-25.
Show HN: Steal My Bitcoin: Hacker News, 2026-10-24.
Meta Ignores Brazilian Court Order to End Bolsonaro Favoritism: Hacker News, 2026-10-25.
Online censorship is crushing indie webcomics: Hacker News, 2026-10-25.

Systems and languages

Balloting has completed for C++26. Unfortunately it was Disapproved: Lobsters, 2026-10-24. Robert Seacord with the ballot result. The committee process failing in public is unusual enough to be worth the click.
SIMD and Go: Lobsters, 2026-10-24.
Wild version 0.11.0 released: Lobsters, 2026-10-24.
The Polyglot's Dilemma: Conformance Testing a Dozen Specs in as Many Languages: Lobsters, 2026-10-24. A. Jesse Jiryu Davis on conformance suites across a dozen implementations. Directly relevant to anyone writing a spec.
Bbtree: Fastest Ordered Map: Hacker News, 2026-10-24.
The Goose Programming Language: Hacker News, 2026-10-24.
Small Programs and Languages: Hacker News, 2026-10-24.
We should be more ambitious with the software we build: Hacker News, 2026-10-24.
Roku developer repositories moved from GitHub to GitLab: Hacker News, 2026-10-24.
Pragtical v3.14: Lua-based text editor adds menus, floating views, and sessions: Hacker News, 2026-10-21.
Rewriting a Commercial Engine in Jai: Hacker News, 2026-10-22.
Tablesample Picks Rows: Hacker News, 2026-10-22.
Func Prog Conf 2026: Planet Clojure, 2026-10-25.
Clojars and October 2026 Project Updates: Planet Clojure, 2026-10-24. Clojars funding and maintenance, which is the open-source-capacity thread from this week at a scale small enough to act on.
Week Notes 2026.43: Planet Clojure, 2026-10-24.
I want my Wednesday back: Lobsters, 2026-10-24.

The crawler zoo

Five new arrivals today, down from twenty yesterday, and only one of them names MCP. The scanners are still arriving; the naming convention is no longer uniform.

New arrival: mcpbeat: The Crawler Zoo, 2026-10-25.
New arrival: agent-market-scanner: The Crawler Zoo, 2026-10-25.
New arrival: Synapse: The Crawler Zoo, 2026-10-25.
New arrival: Maps-bot: The Crawler Zoo, 2026-10-25.
New arrival: VelaDataEnrichment: The Crawler Zoo, 2026-10-25.

Tail

The St. Helena 5 pence coin shows Jonathan, a roughly 190 year old tortoise: Hacker News, 2026-10-24.
Why Gopher in 2026?: Hacker News, 2026-10-24.
SpeedCrunch 1.1: Hacker News, 2026-10-24.
In Rainbows: Hacker News, 2026-10-22.
How Japanese Dried Bonito Is Made: Hacker News, 2026-10-22.
MacOS Extensions pack for the Apple Network Server v1.0: Lobsters, 2026-10-24.
A story of a Figma bug that wasn't a bug at all (2021): Hacker News, 2026-10-21.
battledrones v14: Compass Rose, a four player map: Simon Willison, 2026-10-24.
2026 Ruby on Rails Community Survey Results: Lobsters, 2026-10-24.
Social dynamics of toxic metal industry in medieval Europe: Hacker News, 2026-10-20.

Feed silences

Sunday is the thinnest day of the week by construction: 111 items new in today's run, and no arXiv cs.AI batch for the second day running, since arXiv does not publish on weekends. The last cs.AI batch was Friday's 284 papers; the 14-day window still carries 3,194.

Past the four-day mark and worth noting:

Interconnects, Vicki Boykis, and mcp-docs all at four days.
AI Snake Oil (5), Tailscale (5), cursor-blog (5), anthropic-generated (6).
Jane Street at eight; Antithesis and Apple ML Research at nine; The Markup at ten; FreeBSD Foundation at eleven.
Boston Rust Meetup (14 days), Charity Majors (16), East Boston Times (20), nREPL releases (22), Bunnie Studios and logback releases (24).

Seventy-four of the 118 feeds polled today returned 304 Not Modified — conditional requests working as designed, not silence. One hard error: James Bornholt (www.bornholt.dev does not resolve) for the tenth consecutive day. The registry correction filed two weeks ago is still unapplied, which keeps this the longest-running known defect in the crawl and the only item in this section that is our fault rather than the publisher's. Still beyond the practical horizon and excluded above: Ink & Switch, TigerBeetle, Alex Ellis, Steve Yegge, Kenneth Payne, All Things Distributed, Julia Evans, Aphyr/Jepsen, and the dormant Clojure library release feeds.

Link verification

All 74 URLs in this brief were checked through fetch-gated, which runs the blocklist, robots and throttle checks before issuing any request. Every URL also has warehouse provenance — none were constructed from a title.

73 returned 200. One was denied before any request went out: the LinkedIn post carrying the C++26 ballot result, where robots.txt disallows our user agent. It is kept in the brief because it arrived through the Lobsters feed and the URL is therefore publisher-provided; being told not to fetch a page is not being told not to link it.

Build provenance

build: 2026-10-25 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 118 polled today (43 ok, 74 not-modified, 1 error), 75 publishing in window | items-considered: 5737 (14d, incl. 3194 arXiv cs.AI) | warehouse: 62585 items | published: 74 (73 verified 200, 1 robots-denied and disclosed)