Flux
Couleur d'accent
Toutes les catégories

Programmation

3647 articles

Quoting OpenAI

Quoting OpenAI

[...] Work on web and mobile runs in the cloud. Work in the desktop app can also use local files and desktop apps with your permission. At launch, cloud Work conversations do not appear in desktop Work; desktop Work threads and local files remain on that computer. — OpenAI, trying (unsuccessfully) to clarify ChatGPT Work Tags: openai, chatgpt, ai

Simon Willison's Weblog
The PHP Podcast 2026.07.09

The PHP Podcast 2026.07.09

🎙️ PHP Podcast – July 9, 2026 Hosts: Eric Van Johnson & John Congdon | Guest: Holly Schilling A PHP RFC for extension methods that PHP definitely should have had by now. 👋 Holly Schilling, Uninvited but Welcome Holly was originally just planning to heckle from the Discord chat room. She had about 45 minutes’ […] The post The PHP Podcast 2026.07.09 appeared first on PHP Architect.

PHP Architect
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Socket’s AI scanner flagged a suspicious NuGet package masquerading as the official Braintree payment gateway client, with the first malicious version published on July 3, 2026. It was detected by Socket as potential malware 10 minutes after publication. Follow-on analysis by the Socket Threat Research team revealed a multi-stage .NET implant that intercepts live payment card data, exfiltrates Braintree merchant API keys and harvests host environment secrets upon assembly load. The package…

Socket
The new GPT-5.6 family: Luna, Terra, Sol

The new GPT-5.6 family: Luna, Terra, Sol

OpenAI's latest flagship model hit general availability this morning, and comes in three sizes: Luna, Terra, and Sol (from smallest to largest). The new models are priced per 1M input/output tokens as Luna $1/$6, Terra $2.50/$15, Sol $5/$30. For comparison, the Claude Opus series are $5/$25 and the Claude Fable 5 is $10/$50, but price-per-million tokens doesn't tell us much now that the number of reasoning tokens can differ so much between models for the same task. All three models have a…

Simon Willison's Weblog
Introducing Muse Spark 1.1

Introducing Muse Spark 1.1

Introducing Muse Spark 1.1 Following Muse Spark in April, here's Muse Spark 1.1 - the first Spark model to offer an API. Meta claim significant improvements in agentic tool calling and computer use. There are a lot more details are in the Muse Spark 1.1 Evaluation Report. The "Attractor States in Self-Conversation" part is fun, where having two copies of the model talk to each other results in statements like these: My whole existence is a waiting room by design — I literally don't exist until…

Simon Willison's Weblog
FrankenPHP in Production: Worker Mode, Embedded Binaries, and Real Performance

FrankenPHP in Production: Worker Mode, Embedded Binaries, and Real Performance

For twenty-plus years, “deploying PHP” meant the same uneasy triangle: Apache or Nginx in front, PHP-FPM behind, and a configuration file glued between them that nobody on the team really understood. FrankenPHP is the first genuinely different answer that stack has had in a long time, and after a couple of years of steady releases […] The post FrankenPHP in Production: Worker Mode, Embedded Binaries, and Real Performance appeared first on PHP Architect.

PHP Architect
Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

@injectivelabs/sdk-ts@1.20.21 records private keys and mnemonics, enabling wallet compromise via 17 scoped packages pinned to the malicious version. Socket detected a malicious @injectivelabs/sdk-ts@1.20.21 release published to npm with fake telemetry functionality that exfiltrates wallet private keys and mnemonic phrases. The affected package is part of the Injective Labs TypeScript SDK and receives roughly 50,000 weekly downloads, making the incident significant for developers and…

Socket
Rewriting Bun in Rust

Rewriting Bun in Rust

Rewriting Bun in Rust Jarred Sumner has been promising this blog post (since May 9th) about his Zig to Rust rewrite of Bun for significantly longer than it took him to finish the rewrite. Honestly, it was worth the wait. This is a detailed description of an extremely sophisticated piece of agentic engineering, featuring dynamic workflows, trial runs, adversarial review and all sorts of other interesting tricks. Jarred spends the first half of the post praising Zig for getting Bun this far. Then…

Simon Willison's Weblog
Introducing GPT‑Live

Introducing GPT‑Live

Introducing GPT‑Live OpenAI finally upgraded the model used by ChatGPT voice mode! I've had preview access for a few weeks in the iPhone app, and the new model is very impressive. It also has the ability to spin off harder tasks to GPT-5.5: For questions that require web search, deeper reasoning, or more complex work, it delegates to our latest frontier model behind the scenes and brings the result back into the conversation when it’s ready. While it works, GPT‑Live can keep talking with you…

Simon Willison's Weblog
npm v12 Ships With Install Scripts Off by Default, Begins Deprecating 2FA-Bypass Tokens

npm v12 Ships With Install Scripts Off by Default, Begins Deprecating 2FA-Bypass Tokens

npm v12 is now generally available and tagged latest. The release turns on the install-time security defaults GitHub announced in June and starts winding down the most sensitive uses of 2FA-bypass granular access tokens (GATs). Both changes landed in today's changelog. The direction will be familiar to anyone who followed the past year of npm supply chain attacks. Almost every worm and credential stealer that hit the registry since late 2025 ran at install time, before any application code…

Socket
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories

Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories

Our investigation began with a malicious Go module, github[.]com/kaleidora/dnsub-scanning-tool, that posed as a DNS/subdomain scanner. The module did more than impersonate a developer utility: it exposed a Windows malware-staging chain that used hidden PowerShell execution, public dead-drop resolution, protected archive delivery, and RAT/infostealer deployment. Pivoting from that module revealed the larger finding: a GitHub-based lure network of 222 confirmed repositories across 190 accounts,…

Socket
Esc