#open-source

IEEE Spectrum's Dina Genkina looks at PHP2Shell, the PHP flaw disclosed in late October that put sites running WordPress, Drupal and other PHP software at risk of data theft and remote code execution. The underlying memory bug had been reported to the PHP Foundation in 2024 but was treated as a mere crash. A researcher at the security firm Calif, auditing PHP with AI tools under OpenAI sponsorship, turned it into a working code-execution exploit within two weeks; Wiz confirmed and expanded the findings, and four PHP engineers spent two months on a patch. As far as anyone knows, it was fixed before attackers had the exploit.

"Now it is time for the technical debt to be paid off," says Matt Suiche of Tolmo. Columbia's Suman Jana describes an asymmetry: AI makes finding bugs easier, but fixes must close every path without breaking anything, which strains unfunded open-source maintainers. Johns Hopkins' Matthew Green expects little to change until something worse happens; meanwhile, he says, install updates promptly.

Ghostty, the free, non-profit terminal emulator, released version 1.4.0 on October 27 after seven months of work: 2,889 commits from 172 contributors. Highlights from the release notes:

• Memory: scrollback that isn't on screen is now compressed while the terminal is idle, cutting its physical memory use by 70-90% for typical text, so the default scrollback limit rose from 10 MB to 50 MB. Hidden tabs release GPU memory (about 385 MiB down to 18 MiB in one macOS test).
• Graphics: Ghostty now implements 100% of the Kitty graphics protocol, including animation, which the maintainers say makes it the first terminal other than Kitty to do so.
• Speed: the team found macOS caps each read from a pseudo-terminal at about 1 KiB and reworked how output is drained and parsed.
• Security: ten advisories are fixed, including paste protection that missed carriage returns and crafted Kitty graphics or hyperlinks that could, in some cases, read files or run commands. It also supports macOS 27.

On Hacker News, users compared it with Konsole, WezTerm and iTerm2, and a commenter from the project pointed to libghostty, the embeddable terminal core.

DeepSeek published DeepInfer on GitHub, describing it as the high-performance inference framework that powers its large-scale production services. This open-source release covers offline inference for DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs, with optimized kernels (FlashMLA, DeepGEMM, DeepEP and others), expert parallelism, draft-token decoding with confidence-scheduled verification, batch-invariant inference and deterministic sampling. The README says pieces needed for a complete service are not included: a KV cache system, prefill/decode disaggregation and load balancing across replicas. It is licensed Apache-2.0.

It was the most-upvoted story on Hacker News this week. The discussion centered on the economics: a commenter quoted a post on the Chinese site Zhihu claiming strong per-GPU revenue, which set off a debate over whether serving AI models is profitable and what open releases like this mean for the valuations of US frontier labs. Others asked why DeepSeek, and China more broadly, would give this away, with replies arguing it is ordinary open-source strategy rather than state direction.

OpenCode 2.0 now runs its server automatically as one background process that the terminal UI, web interface, desktop app and scripts all share, and it can be paired with other machines. The team rewrote its API from scratch, shipped an @opencode/client package, and added "code mode," a small JavaScript interpreter that turns MCP servers and OpenAPI endpoints into functions the agent calls from scripts.

The author presented Laya, an open system for fast structured decisions that does not generate text token-by-token. The post argued that similar ideas had been built before newer proprietary “System 1” products attracted attention.

Why HN cared

The technical question—how different these systems really are—quickly became a startup question: how much does good branding and distribution matter compared with being first?

Commenters also revisited the idea that many classification, routing and scoring tasks may not need a giant generative model at all.

HN snapshot: roughly 1.3k points and ~300 comments.

GrapheneOS highlighted that Android 17 introduced new public APIs without simultaneously releasing the corresponding platform source to AOSP, an unusual break with Android’s historical model.

Why HN cared

The thread centered on whether Android remains meaningfully open source when Google controls source-release timing, compatibility requirements, attestation and increasingly important proprietary pieces.

Many commenters connected the issue to a broader concern: a project can technically remain open source while one company retains overwhelming practical control.

HN snapshot: about 1.16k points and ~700 comments.