AI cracks WordPress RCE for $25, Netflix builds LLM stack

The Fetch spec collapses all network failures into a bare TypeError, discarding the rich error codes that HTTP/2 and HTTP/3 provide, such as REFUSED_STREAM, which can signal safe retries. A TC39 proposal to add a standardized .code property to Error would let developers surface these codes without a new API.

Netflix replaced third‑party LLM APIs with an internal serving platform that runs model deployment, versioning and inference inside its JVM‑based production stack. By using vLLM on top of NVIDIA Triton, they removed API latency, cut vendor spend and gained fine‑grained rollout control across regions. The approach shows large streaming firms can own the full LLM stack for tighter cost and performance guarantees.

Simon Willison released a browser‑based SQLite Query Explainer that runs your query, shows the EXPLAIN QUERY PLAN output and the full bytecode, and adds plain‑English annotations. It works entirely client‑side with Pyodide, so no data ever leaves your machine.

Sebastian Raschka details practical ways to expose multiple reasoning-effort modes in LLMs, from budget forcing and length penalties to adaptive computation. These methods let developers trade off speed for depth, making LLMs more predictable and cost‑effective for real‑world tasks.

Security researcher at SL Cyber used GPT‑5.6 Sol Ultra with $25 of API credits to automatically discover an unauthenticated remote code execution in WordPress, a bug exploit brokers would pay half‑million dollars for. The work shows AI can now generate market‑grade zero‑days at a fraction of traditional costs, forcing defenders to rethink vulnerability hunting.

The essay argues that today’s LLM hype mirrors the 1990s database frenzy, but the real winners, like PostgreSQL and SQLite, escaped the spotlight. If models follow that pattern, the infrastructure LLM that quietly powers every app will matter more than the headline‑grabbing rivals.

By swapping a skill‑only AI agent for a deterministic "swamp workflow", the author slashed token consumption eightfold and halved execution time on a code‑review task. The method turns costly LLM calls into reusable code, making large‑scale AI tooling affordable for teams on a budget.

ReactBench is an evaluation suite that puts coding agents through realistic React changes drawn from over 50 open‑source repos. It checks not only functional tests but also performance, accessibility, and code‑quality issues via a hidden React Doctor scan, forcing agents to write production‑ready code. This raises the benchmark bar for AI‑driven development tools.

A new study scored 12,750 arXiv papers and found that roughly a third of recent submissions exhibit AI‑writing patterns, with computer science papers topping 65% flagged. The method uses a calibrated detector with a 0.4% false‑positive baseline, suggesting AI‑generated text is now a widespread concern for scholarly publishing.

LoopGain is an open‑source Python library that monitors iterative AI workflows and halts them the moment they converge, rolling back to the best output. In a 2,000‑trial benchmark it slashed API spend by 92.8% (≈15× faster) while preserving output quality, and it plugs into LangChain, CrewAI, AutoGen and other agent frameworks.

The article notes that while LLMs boost productivity, they also force developers to review a flood of AI‑generated pull requests, leading to fatigue and burnout. This “human‑in‑the‑loop” fatigue threatens reliability of AI‑augmented software and calls for better tooling and processes to reduce the oversight burden.

Scroll‑World is an open‑source skill for Claude Code, Codex and any SKILL.md‑compatible agent that auto‑generates immersive, scroll‑driven 3D world walkthroughs for brand landing pages. It bundles prompt templates, Higgsfield art pipelines, and a vanilla‑JS scrub engine, letting developers ship interactive experiences without custom graphics work.

OpenCode is an open‑source AI coding agent that many adopt, but its design leaks filesystem access, has inefficient JSON piping, and can stall GPUs for minutes, exposing security and reliability risks. Developers should avoid it until these fundamental issues are fixed.

Chinese AI labs are releasing open-weight models, DeepSeek, Z.ai, Moonshot, Alibaba Qwen, that developers can download, fine‑tune, and run locally. A MIT‑Hugging Face study shows these models captured 17.1% of global AI model downloads in 2025, edging out US counterparts and shifting enterprise AI toward cheaper, customizable tools, especially in the Global South.

A new HBS working paper shows AI‑native startups are about a quarter smaller than their non‑AI peers yet capture higher valuations per employee. They achieve this by packing more engineers, cutting entry‑level and manager roles, and building AI directly into their products. The finding suggests leaner structures can boost funding efficiency.