Flux
Couleur d'accent
13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds
Cybersécurité Programmation

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed…

Socket
Join Us for The PHP Foundation Community Hour
Programmation Web

Join Us for The PHP Foundation Community Hour

Here at The PHP Foundation, we are continuously looking for ways in which we can increase our connections with the PHP community, especially when the goal is to improve the sustainability of the PHP language. Increasing the contributor pool ties in directly with sustainability, so encouraging contributions back to the PHP ecosystem is something we want to foster and support. As part of this effort, we are excited to be launching a monthly one-hour interactive podcast in partnership with the…

The PHP Foundation
Understanding ChatGPT Work
IA Programmation

Understanding ChatGPT Work

OpenAI announced ChatGPT Work on July 9th, and have been furiously iterating on it ever since. It is an extraordinarily confusing and very powerful product. Here's what I've figured out about it so far. ChatGPT Work is actually two products The more interesting version of ChatGPT Work is the one that runs in the cloud. This can be accessed via chatgpt.com or through the ChatGPT mobile apps. Let's call it Work Cloud. If you install the ChatGPT desktop app - the app that used to be called Codex -…

Simon Willison's Weblog
Introducing Hy4 Preview
IA Programmation

Introducing Hy4 Preview

Introducing Hy4 Preview New open weight text input (no vision) LLM from Chinese company Tencent today: 770B total parameters, 49B active parameters, 1M token context window, 1.56TB on Hugging Face. This is a big size increase from their previous Hy3 in July, which was 295B, 21B active, 256,000 context, 598GB. I recently started using model chat templates to better understand their capabilities. Here's Hy4's chat_template.jinja on Hugging Face, which includes this section: {%- if not…

Simon Willison's Weblog
Stop Repeating Yourself in Code Review: Build a Custom Mago Lint Rule
Programmation Web

Stop Repeating Yourself in Code Review: Build a Custom Mago Lint Rule

Video version: https://youtu.be/Sns4iMSa3qA Every team I have ever worked on has a rule that lives in someone’s head instead of in a tool. An example of this is that if you’re working with a Laravel project, you should use Illuminate\Support\Carbon and not Carbon\Carbon directly. We all knew it, but we still shipped the wrong import […] The post Stop Repeating Yourself in Code Review: Build a Custom Mago Lint Rule appeared first on PHP Architect.

PHP Architect
Just a rumour of a bug is enough to find a security exploit these days
IA Programmation

Just a rumour of a bug is enough to find a security exploit these days

Just a rumour of a bug is enough to find a security exploit these days Anil Madhavapeddy is a professor of computer science at Cambridge and a core maintainer of the OCaml compiler. In this somewhat alarming post he reports that security issues in OCaml projects are seeing evidence of attempted exploits within minutes of patches being shared for discussion: This normally takes a few days and a release within a week or two is reasonable. Within about ten minutes (!) this website was fielding…

Simon Willison's Weblog
Esc