Related reading
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
Hacktron reported an RCE in libheif, an AVIF decoder used by Next.js image optimization. Vercel and Hacktron reproduced the issue, then coordinated with upstream maintainers (sharp, libvips, libheif) to deploy platform-wide mitigations and release fixes across the ecosystem.
Vercelvercel.com4 minWhen scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…
Cloudflarecloudflare.com21 minHN2Reverse-engineered Jev-like model
Jevlike is an open‑source starter model that scores a list of text options in a single forward pass. It provides a minimal architecture (option queries, shared dot‑product scorer), synthetic data generation, training/evaluation CLI, and examples on Doom and chess. The repo supports a byte‑level encoder or a frozen Hugging‑Face encoder (e.g., Qwen2.5‑0.5B), runs on CPU/MPS/CUDA, and reports benchm…
Hacker News front pagegithub.com4 minreleaseHN16224Building a Reliable Script-to-Video Pipeline for Modern Web Applications
A practical guide to building a reliable, observable script‑to‑video pipeline. It advocates a staged architecture (scene manifest → asset generation → voice → rendering → encoding), validates AI‑generated JSON with Zod, persists project and scene state, uses explicit workflow states, runs heavy work in background queues, limits concurrency, and stores voice, captions, and assets separately to ena…
SitePointsitepoint.com11 min
