Featured · AI

Are agent skills safe to install? A 1.7M-install trojan

Trojanized skills hit 1.7M displayed installs before takedown. See how the attack worked, a 6-check audit script, and what it found on a real dev machine.

Timeline of the 2026 trojanized agent skills campaign from July 2 to its takedown on August 2

October 28, 2026 · 9 min read · 0 views

The Weekly Wire

One email, every Monday. The week's tech that actually matters — no fluff.

Top in Software

More Software

unclog scanning a developer Mac and finding 15.1 GB of AI coding tool caches, logs and orphaned processes

AI coding tools hid 15 GB on my Mac. unclog found it

11 min read

Laravel per-tenant job limits compared: RateLimited with default tries failed 240 of 300 jobs while delay at dispatch failed none

Laravel's RateLimited job middleware failed 240 of 300 jobs

9 min read

Laravel Cashier failed-payment access compared: the default blocks a past_due customer from day 0 while a grace-period ladder keeps access for 14 days

Cashier locks customers out on day 0 of the retry window

9 min read

Top in AI

More AI

Are agent skills safe to install? A 1.7M-install trojan

9 min read

Gemini API calls to gemini-3.7-flash now answered by Gemini 3.8 Flash after Google's silent model routing

Gemini 3.7 Flash now runs as 3.8 Flash: what to check

9 min read

Cost comparison of Claude Sonnet 4.5 and Sonnet 5.5 API requests ahead of the November 30 retirement

Claude Sonnet 4.5 retires Nov 30: what breaks on 5.5

10 min read

Top in AI Tools

More AI Tools

Dark navy graphic of token streams being routed to a cheaper model, illustrating Spotify's Claude Code token savings

Spotify Cut Claude Code Token Use 90% With Shunt

6 min read

What Is a Proxy on Janitor AI? How It Works

8 min read

Janitor AI Suspended From Gemini? What to Check

7 min read

Latest

Default listener addresses of five MCP server setups, three bound to every network interface

Is your MCP server exposed? 3 of 5 bind every interface

October 28 · 9 min read

Laravel Cashier plan upgrade billing compared: the default charges $0 today while alwaysInvoice charges $33.33 for a $29 to $79 upgrade

Software

Cashier upgrades bill late and can lock customers out

October 24 · 9 min read

Pricing models compared for a Laravel SaaS: a seat plan loses money on 275 of 1,000 modeled customers while a hybrid plan loses on none

Software

Seat vs usage vs flat pricing for a Laravel SaaS, modeled

October 24 · 9 min read

Stripe webhook handlers in Laravel compared: a naive handler writes 100 ledger rows for 20 invoices while an inbox table writes 20

Software

Laravel Stripe webhooks credited 5x. An inbox table fixed it

October 24 · 9 min read

Laravel tenant isolation compared: a global scope exposes 200,000 rows while Postgres Row Level Security exposes the tenant's 2,000

Software

Laravel tenant scopes leaked in 5 of 7 paths. RLS closed all of them

October 24 · 10 min read

Simulated model provider outage drill comparing retry policies, a circuit breaker and a fallback on 12,000 AI requests

Outage drill: a fallback saved 2,452 failed AI requests

October 23 · 11 min read

Vector search with a tenant filter, comparing pgvector HNSW, Qdrant and exact search on recall and latency across 100,000 vectors

pgvector plus a tenant filter found 4% of the right results

October 23 · 10 min read

AI agent jobs with checkpoints, comparing whole-job retries against per-step checkpointing on wasted model calls and duplicate side effects

Checkpointed agent jobs wasted 5x fewer model calls

October 23 · 10 min read

Usage metering for AI SaaS billing, comparing a naive counter with a deduplicating ledger on 200,000 usage events

Duplicate usage events overbilled an AI SaaS bill by $115

October 23 · 9 min read

Multi-tenant AI SaaS job queue where one noisy tenant delays other tenants, compared across four scheduling fixes

A noisy tenant made everyone wait 9.6 seconds: four fixes

October 23 · 10 min read