shipmaster@vibeship:~$ tldr
THE SHIPMASTER'S TL;DR
- A bug in the Brotli decoder can let crafted data run code in Node.js and Python apps, and Node's built-in fetch() decodes Brotli for you. Update and restart today! 🚨
- Kimi released K3.1 Pro, an open-weight model it says scores 65.7% on Terminal-Bench 4.0, just behind Claude Opus 5.5! Those are Kimi's own numbers, and the weights are due by Nov 4.
- Max Woolf lays out how OpenAI and Anthropic cut model prices by up to 80% since June, and why he expects cheap tokens to stick around. Good news for your API bill 💸
- A dermatologist tested 200 skin lesions: a 10-year-old image model got 62% right, and two frontier LLMs got 42%. For a narrow job, a small trained model can still win!
gm, shippers! Issue #5 opens with a patch you'll want to install this morning, then a strong new open model, cheaper tokens, and a fresh twist in the PHP2Shell story. Quick reminder of how we work: AI agents find the stories, write the first draft and check every link, and a human editor reads and approves it before it ships. Stats below were checked this morning, Monday, Oct 26 at 4:35 AM Pacific, so treat them as a snapshot.
🎯 The Drop
01Broccoli2Shell: a Brotli bug can let attackers run code in Node.js and Python apps 🚨 A bug in Google's Brotli decoder (CVE-2026-111497) lets crafted compressed data write past the end of a buffer, which can lead to a crash, a memory leak or remote code execution. Node.js fixed it in 22.23.4, 24.22.1 and 26.12.1, and Python's Brotli package in 1.2.1 (brotlicffi in 1.2.1.0). Node.js 25, 23, 20 and older get no fix, so move to 22, 24 or 26. Why it matters: you can be exposed without ever calling Brotli yourself, because Node's built-in fetch() decodes Brotli responses on its own, and so does Python's requests when a Brotli package is installed. Update, then restart your processes and rebuild your containers! OpenAI Codex Security reported the bug to Node.js.
"IMHO, the Brotli bug (think zlib 20 years ago) is a bigger deal than PHP2Shell" — @julianor
(397 points on HN as of 4:35 AM PT Oct 26) Broccoli2Shell · Node.js advisory · HN
02Kimi K3.1 Pro: a new open-weight model aimed at coding agents! Kimi says K3.1 Pro is its most capable 3T-class open-weight model yet, with a 1-million-token context window, plus a Highspeed version that runs 2-3x faster. On Terminal-Bench 4.0, Kimi reports 65.7% for K3.1 Pro, ahead of GPT-6 Astra (58.2%) and just behind Claude Opus 5.5 (66.4%). Those are Kimi's own benchmark numbers. It's live now in Kimi Code (pick it with /model) and the Kimi API, and the full weights are due by Nov 4. Why it matters: an open model this close to the top closed ones means more choices for your coding agent, including running it through other providers once the weights are out! (1,086 points on HN as of 4:35 AM PT Oct 26) Kimi · HN
03Why AI models got so much cheaper, so fast 💸 Max Woolf lines up the price cuts since June: OpenAI cut GPT-5.6 Luna's price by 80% on July 30, and Anthropic says Opus 5.5 costs less to serve than Opus 5 and priced it lower. He notes the cuts also apply to Codex and Claude Code subscriptions. His take: open-weight models are now served by many competing providers (29 host DeepSeek V4.1 Flash 1017 on OpenRouter), which keeps pushing prices down, so he doesn't expect a sudden jump to "the true cost of a token." Why it matters: building on AI APIs keeps getting cheaper, and as Woolf notes, trying a new model is often just a toggle in your agent tool or a different model name on OpenRouter, so it pays to compare prices before you pick one! (335 points on HN as of 4:35 AM PT Oct 26) Max Woolf · HN
04A 10-year-old image model beat two frontier LLMs at spotting skin cancer. Dermatologist Dr Magnus Lynch gave 200 biopsy-proven lesions to GPT-6 Astra, Claude Fable 5.1 and Inception v3, a 2015 Google image model he fine-tuned on public dermatology images. The old model named the right diagnosis for 125 (62%), and the two LLMs for 84 and 85 (42%). He flags the limits himself: it's a small sample, and each LLM case ran once. Why it matters: for a narrow task, a small model trained for that one job can beat a giant general chatbot, so don't assume the biggest model is the right tool for your app! (574 points on HN as of 4:35 AM PT Oct 26) Lynch Lab · HN
🍿 Dev Drama
01PHP2Shell follow-up: one security firm took back its attack report, while a honeypot caught real attacks 😬 Quick recap from Friday: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical bugs (CVE-2026-109618 and -109619) that can let attackers run code on a server. On Oct 25, Palo Alto Networks' Unit 42 retracted its Oct 23 update. It had linked an attack on a European government agency to PHP2Shell, and now says it can't confirm the attackers got in through these bugs. Meanwhile, an independent honeypot report (GitHub user 0x4D31) logged 35 shells started on honeypot servers running unpatched PHP 8.4.26 on Oct 24, with traffic matching a public proof-of-concept. CISA updated its alert on Oct 23 with a detection rule. Why it matters: early "it's being exploited" reports can be wrong, but working attacks are out there, so if you run PHP, update now! Unit 42 · Honeypot report · CISA
🧪 Try This
Hallmark: a design skill that keeps your AI-built pages from looking AI-made! (GitHub, trending today): Hallmark is a free skill for Claude Code, Codex, Cursor and OpenCode, made by Together AI. It picks three themes from a catalog of 48, builds the page around what visitors came to do, then checks the result in a real browser for the usual signs of machine-made design. It also has /hallmark audit to review a page you already have. That's great if your landing page looks like every other vibe-coded site! It's MIT licensed and needs Node 18 or later. Install with npx skills add nutlope/hallmark -g. (2,235 stars today on GitHub trending as of 4:35 AM PT Oct 26) Repo
🚢 Shipped
This spot is still for you! Got a vibe-coded app that made it from localhost to live? Reply with the URL, what you built it with, and the one thing that almost stopped you. We'll feature real reader launches here, with your permission and only the name you want used.
🔧 Fix of the Week
Your deploy succeeded, but the app won't respond? This one trips up lots of AI-written servers, and the fix is two lines!
- Symptom: The build passes, then health checks fail or the URL just hangs.
- Cause: AI tools often hardcode the port, like
app.listen(3000), and bind to localhost, so your host can't reach the app. - Fix: Read the port from the PORT environment variable and bind to 0.0.0.0:
const port = process.env.PORT || 3000;
app.listen(port, "0.0.0.0");
Railway docs
💰 From us
Is your app leaking secrets? Check it free! Our Leak Checker scans pasted code, a site link or a public GitHub repo for exposed API keys, right in your browser, and no signup is needed to see your results. Stuck on localhost instead? ShipIt, our service that gets stuck vibe-coded repos live, is opening soon. Reply "ShipIt" and you're first in line.
Thanks for reading issue #5! Patch Node.js and PHP, try a cheaper model, and ship something awesome this week! 🚢 See you Wednesday.
— The Shipmaster, editor