An AI-assisted paper on Z-Library cites sources that may not exist

TorrentFreak found that at least 10 of 44 references in a recent peer-reviewed paper about Z-Library could not be located, including a nonexistent TorrentFreak article. The authors disclosed using Consensus AI to sift literature and ChatGPT to improve language; the publisher says its ethics team is investigating.

That does not establish that AI generated the bad citations: TorrentFreak says it cannot confirm the cause, and it notes that AI-detection tools can produce false positives. The two-comment HN thread questioned whether fabricated citations are still novel and broadened the criticism to academic publishing, rather than offering independent verification of the article’s findings.

• Hacker News discussion

Apple reopens applications for its Security Research Device Program

Apple is accepting applications through October 30, 2026 for its loaner iPhone program for iOS security researchers. Approved participants get a specially configured device with shell access, custom tools and entitlements, and the ability to customize the kernel; the loan lasts 12 months, is renewable, and the device must stay in a controlled research setting.

The Hacker News thread debated whether the program’s required vulnerability reporting gives Apple too much control and whether researchers should be able to unlock devices they own. One commenter cautioned that the published page requires prompt reporting but does not explicitly forbid later public disclosure; the policy separately directs researchers to report third-party bugs to the relevant third party. The program is limited and eligibility depends on research track record and location.

• Hacker News discussion

A dozen banking apps now explicitly permit GrapheneOS

GrapheneOS says around a dozen banking apps have begun explicitly supporting its non-Google-approved Android OS, a growing change for users who want a privacy-focused phone without losing access to mobile banking. The project says roughly 10% of banking apps remain unavailable because they reject non-Google-approved systems; it also notes that some apps’ anti-tampering checks can conflict with memory-corruption protections.

The Hacker News discussion split between users who want banks to offer web or hardware-token access rather than require proprietary phone apps, and those who value app convenience. Replies also challenged broad claims about data collection and legal protections. This is the project’s own report, not an independent survey of bank support.

• Hacker News discussion

Brotli flaw CVE-2026-111497 reaches beyond Node.js

The “Node2Shell” Brotli decoder bug also affects Python packages and other products that process attacker-controlled Brotli data over HTTP. The article reports an out-of-bounds write in Brotli versions through 1.2.0, with possible memory disclosure, crashes, or code execution; affected paths include inbound compressed requests and outbound responses from untrusted servers.

Fixed releases are available for several projects, including Brotli 1.2.1, Python Brotli 1.2.1 / brotlicffi 1.2.1.0, Node.js, Bun, Envoy, and Istio. Aikido notes that dependency scanners may not yet map the CVE to the Python packages, so teams should inspect resolved dependencies and rebuild affected deployments. The linked HN page exposed no readable comments when checked, so I’m not attributing reactions to its discussion.

• Hacker News discussion

Docker is weird

Building a small container runtime makes Linux containers feel less magical: they are ordinary processes constrained by namespaces, cgroups, filesystem roots, and networking setup—not a single “container” kernel feature. The author also sketches how images become filesystems and how runc works around Go runtime constraints when setting up a child process.

The article is an early-stage learning exercise, not a full account of Docker or container security. Lobsters commenters added important context: OCI image extraction must handle whiteout markers and storage-driver details; rootless networking can require userspace machinery; and Linux namespace behavior is more complicated than the article’s introductory treatment suggests. Discussion also pointed to a proposed kernel “cells” abstraction and disagreed over how much Docker’s early design shaped today’s container ecosystem.

• Lobsters discussion

Railway Preliminary Report: Oct 21st Security Incident

Railway’s preliminary account says an attacker accessed internal systems from October 20 to 22, and that a subset of customer environment secrets were decrypted. The company estimates up to 1.85% of workspaces—about 100,000—may have had variables exposed; it recommends rotating sensitive values stored before October 21. Railway says running customer services stayed online, though builds and deployments were paused, and its forensic investigation is ongoing.

The seven-comment Lobsters thread questioned the company’s framing of services staying online, highlighted gaps in logging and uncertainty about which secrets were decrypted, and challenged the stated motive of AI-model distillation. These are commenters’ concerns, not confirmed findings; Railway’s report remains preliminary.

• Lobsters discussion
• Railway’s initial disclosure

How close can pure FP get to C?

Roc’s DEFLATE compressor is now close to C’s libdeflate on the author’s benchmark: its median was 8.9% slower on a Ryzen 9 3900X and 2.6% slower on an M1. The comparison is encouraging, but it is a focused result, not evidence that Roc generally matches C: the work targets non-streaming APIs, uses one corpus, and includes deliberate low-level optimization.

The article describes measured changes such as prefetching and bounds checks that help the compiler optimize loops. In the 11-comment Lobsters discussion, readers praised opportunistic mutation, asked whether the optimized code is idiomatic, and emphasized that languages differ in ergonomics and guarantees rather than their theoretical performance ceiling.

• Lobsters discussion

Harbor Adds Docker Sandboxes to Run Reproducible AI Agent Evals in Isolated MicroVMs

Harbor can now run each agent-evaluation task inside its own Docker Sandbox microVM, separating untrusted agent code from the host and other tasks. Docker reports testing 64 concurrent cloud tasks; network policies can allow dependency setup and then restrict access during evaluation, reducing one source of inconsistent results.

This is a useful isolation and reproducibility option, not a complete answer to eval integrity: the article notes no overhead, cost, or score-variance benchmarks, and sandboxing does not stop an agent from tampering with writable test files. InfoQ has no reader-comment section.

• Docker announcement

Linux 7.4 Introduces New Driver For The Nintendo Switch 2 Controllers

Linux 7.4 adds preliminary HID and USB configuration-interface drivers for Nintendo Switch 2 controllers, supporting general input for Joy-Con 2, Pro Controller 2, and GameCube NSO devices. The split-interface design handles input and rumble through the main HID interface while configuration uses a separate one; Bluetooth pairing and broader communication still need userspace and BlueZ work.

The same HID updates add a driver for several Pulsar gaming mice and related devices. Phoronix’s forum discussion returned HTTP 403, so I couldn’t review comments or report reader reactions.

• Phoronix forum

Software is slow because of bad design, not slow languages

Rewriting a program in a faster language often misses the largest sources of latency: unnecessary work, serial operations, database query patterns, and poor data flow. The article argues for profiling and redesign first, with language rewrites reserved for genuine CPU-bound hotspots.

The Lobsters discussion pushed back on the article’s broad claim that most software is I/O-bound: commenters pointed to CPU-heavy browser, graphics, and ML workloads, and noted that memory use and vertical scaling can also make language choice matter. That makes the useful takeaway narrower than the headline: measure the actual bottleneck before choosing a rewrite.

• Lobsters discussion

Linux 7.4 power-management updates add initial Zen 6 support

The Linux 7.4 power-management merge adds initial AMD P-State maximum-frequency capacity handling for Zen 6 Ryzen client CPUs, tunes energy-performance preference values across Zen 6 core types, and adds Intel Rugged Panther Lake support to the RAPL power-capping and thermal drivers. The merge also contains ACPI and temperature-reporting fixes.

This is early kernel support rather than a finished platform feature; Phoronix’s article provided no readable reader discussion.

Linux 7.4 improves PCI bridge power-down during hibernation

Linux 7.4 aligns the PCIe-bridge hibernation power-off path with suspend handling, allowing bridges with downstream devices to enter a low-power state when the platform supports it. Previously, bridges with active children could remain in D0 during hibernation, which could prevent systems—especially designs with discrete GPUs—from meeting regional energy-certification criteria.

This is a focused power-management fix, not a broad PCI performance change. Phoronix exposed no readable discussion for the story, so this summary makes no claims about reader reactions.

FFmpeg 9.1 prepares Vulkan video and audio improvements

FFmpeg 9.1’s release branch adds Vulkan-based encoding for the royalty-free APV format and NVIDIA optical-flow frame-rate up-conversion, alongside H.265 Vulkan encoding improvements. The feature release also lists an improved AAC encoder, ASTC image encoding/decoding, H.264 data partitioning, and additional codecs and filters.

The Phoronix forum page returned HTTP 403, so I could not review its two comments and have not attributed reactions to readers.

Linux 7.4 corrects AMD Zen 5-and-newer TLB size reporting

Linux 7.4 fixes an under-reporting issue introduced with Zen 5: the processors report TLB sizes in multiples of 32, but the kernel had not accounted for that change. The corrected values will be exposed through /proc/cpuinfo and related interfaces. The same merge window also adds an optimization for lightly loaded Zen 6 SEV guests and a sysfs interface for reporting AMD SEV status.

Phoronix’s page exposed no readable reader discussion, so no reactions are claimed.

LibreSSL 4.4 released with faster SHA-3 and bug fixes

LibreSSL 4.4 removes an eMudhra ECC root certificate associated with the recently reported weak intermediate certificates, while adding uncompromised intermediates for compatibility. The release also improves SHA-3 performance through an unrolled, interleaved implementation and includes portability and other fixes.

The Phoronix forum thread mostly discussed the project logo rather than release details; one commenter corrected the historical identification. No technical consensus emerged from the comments.

• Phoronix comments

Attention people who think UB is fine

A compact compiler example shows why undefined behavior in C/C++ is more dangerous than “it will probably crash”: once the program reaches UB, the compiler may make transformations that produce surprising effects elsewhere.

The example uses std::unreachable() after a volatile device write; GCC emits code that appears to write a second value in a function that is never called. A null-pointer variant writes zero before trapping, rather than the requested value. The Lobsters discussion stressed that UB differs from implementation-defined behavior, while debating how standards, POSIX assumptions, sanitizers, warnings, and static analysis can help maintainers manage existing C code.

• Lobsters discussion

oneDNN 3.14 brings AMD Zen optimizations into the upstream library

The oneDNN 3.14 release starts integrating AMD Zen optimizations into the upstream library used by PyTorch, TensorFlow, and OpenVINO, reducing reliance on AMD’s separate ZenDNN fork.

The new MATMUL and inner-product optimizations are opt-in at build time and currently require ZenDNN code in the tree or fetched during the build. The release also adds initial support for AI Compute Extensions planned for future AMD and Intel processors, plus performance work for upcoming Intel CPUs and GPUs. Phoronix’s discussion page contained only the article stub, so there were no reader reactions to report.

Linux may remove the obsolete HPFS filesystem driver

A proposed patch would remove 6,969 lines of Linux’s orphaned HPFS driver, which has no known active users and fails on SMP and PREEMPT kernel configurations. The patch has been submitted for review; removal is not yet settled.

The proposal also cites the driver’s long-unmaintained state and a recently reported denial-of-service bug. In the seven-comment Phoronix discussion, readers noted that the driver is effectively unusable on current SMP kernels and that HPFS had long-standing limitations; one suggested a FUSE alternative for archival use.

OpenSSL 4.1 adds DTLS 1.3 and broader TLS and crypto improvements

OpenSSL 4.1 is a substantial protocol and performance release: it adds DTLS 1.3, TLS GREASE support, and AVX-512 acceleration for SHAKE x4 operations used by ML-DSA and AES-CBC decryption.

DTLS 1.3 brings faster handshakes and forward secrecy for datagram-based secure connections. GREASE sends reserved, meaningless values in TLS handshakes to expose peers that mishandle unknown protocol codes. The two-comment thread welcomed the release; one reader separately criticized Firefox’s current handling of Ed25519-signed certificates, which is not a change addressed by this release.

Vercel Labs Open-Sources fx: A Zig Coding Agent Designed to Be Embedded

Vercel Labs has open-sourced fx, an experimental coding agent written in Zig that is built to work as a CLI, script component, or embeddable library rather than only as a full-screen terminal app. It exposes structured output for automation and an Agent Client Protocol interface for editors; the reported small binary and startup figures are Vercel’s claims, not independently verified benchmarks.

InfoQ notes that the project is still pre-1.0 and changing quickly. It also reports early questions about provider routing and a naming collision with an existing terminal JSON tool; later releases broadened provider support. The article links an older HN discussion, not a current reader-comment thread, so I’m not treating that as reactions to this new announcement.

• Project repository
• InfoQ article