Speros Kokenes

During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below: patchtheplanet.org/brotli

AI orchestrator review: Paseo paseo.sh/ TBH I've never heard of this app until my harness research had suggested it. At first glance, it seemed very similar to t3.code. Similar layout, similar features, runs 3rd party harnesses. The website puts accent on mobile apps and remote control, which is for me a nice to have, but not the killer feature. Also supports CLI workers + remote control, which looks enticing, but I haven't tried it yet. But then, I realized it has one amazing concept that I haven't seen anywhere before, and that might just be good enough to rethink my workflow. Instead of the usual project -> chat structure, it has a 3 layer structure: project -> workspace -> chat. Workspace can include multiple chats, but can also include terminals and browser windows. And you can set them up in an arbitrary layout. The most interesting part: paseo can inject MCP into the agent context, which allows it to control the terminals and browser windows within the workspace. I can totally see what they're aiming at here. You start a new workspace, and the orchestrator + agent automatically setup a worktree, install your stuff into it, and then boot up dev servers and open browsers in attached terminals. You can tell agents to restart your dev servers or interact with your browsers. When you toggle between workspaces, you toggle between entire entire instances of your work - chats, shells and browsers together. This solves an actual problem, in that it's difficult to toggle between things you're working at among a heap of different browsers, IDE-s, and chats. I vaguely remember people talking about this pain, but I don't remember seeing an actual solution. This feels like one. I'm still exploring here, but as I said, this is the first orchestrator idea good enough to make me consider adapting to it. Downsides? The usual slopbase ills. Eg. voice recording just silently failed for me, no idea why. Plus, it doesn't know how to deal with my symlink-based setup, but none of these apps do, so whatever🤷. So why isn't this app better known around these parts? Marketing, I think. The author ( @moboudra ), doesn't have the same twitter presence and clout as theo and dax. On pure merit, paseo *seems* to be on the same level as opencode and t3.code, and maybe even better. Certainly more innovative.

BREAKING: Trae Young intends to sign a four-year, approximately $212 million deal to stay with the Washington Wizards, with a player option in Year 4, sources tell ESPN. The four-time NBA All-Star declined his $49M player option for a long-term commitment ahead of free agency.