Jefferson Cabrera 🇵🇪

Arq. & AI 🧠| Back. Lead | Java, SQL, AI |👇 Tu siguiente nivel empieza aquí

[Rajiv Ayyangar @rajivayyangar]

As CEO of Product Hunt, I see hundreds of launches a week. One trait separates winners from losers.

Every few months, new models come out. Some products become better, effortlessly. Some don't improve, or become irrelevant.

This property needs a name. I'm calling it Buoyancy.

Buoyant startups rise with model improvements the way a boat rises with the tide.

Anti-buoyant startups come in two flavors: over-scaffolded (which hinders the new, smarter models) and too thin - which makes them redundant when models improve.

To be buoyant, you need a "hull" - usually proprietary data, a vertical-specific harness, network effects, or distribution advantage. This hull keeps you buoyant as models improve.

Hulls are the new moats.

My number one advice to startups in 2026: Be buoyant. Find your hull.

(Full essay on my blog)

[Andy L @AndyL5cc]

太夸张了！一个人指挥 50 多个 AI Agent，干了 20 个工程师的活！😱

一位曾在 Cursor 工作的 SpaceXAI 高级工程师，分享了她的 AI 自动化工作流：

每天早上喝杯咖啡，就能管理整个 AI 团队。

她的配置是：

1 个 AI 总管：统筹所有工作
3 个 AI 项目经理：分配任务、协调进度
40 多个 AI 员工：通宵自动执行任务

她还声称，97% 的 SpaceXAI 工程师已经在使用类似的工作方式。

她用一场 60 分钟的教程，从零教你搭建整套系统。

以前有人收费 5000 美元教的东西，现在直接公开了。

以后一个人就是一家软件公司，真不是开玩笑！🤣

建议收藏！

[AI_Explorer @ai_explorer25]

the best 20 accounts to follow in AI:

@karpathy = learn LLMs
@steipete = learn openclaw
@gregisenberg = learn startup ideas
@rileybrown = learn vibecoding
@corbin_braun = learn cursor
@jackfriks = learn solo apps
@levelsio = learn solo startups
@marclou = learn solo startups
@EXM7777 = learn AI ops + systems
@eptwts = learn AI money
@ai_explorer25 = learn about ai tools
@mardehaym = learn enterprise AI
@vasuman = learn AI agents
@AmirMushich = learn AI ads
@0xROAS = learn AI UGC
@AndrewYNg = learn AI engineering
@kloss_xyz = learn systems architecture
@emollick = learn AI science
@Hesamation = learn AI/ML
@claudeskills101 = learn Claude

follow them all and learn.

[Deni @0xDeniAi]

this is getting f*cking dangerous...

REA creator just dropped 20 GitHub repos to build a f*cking reverse engineering studio:

[01] analysis core
> REA: a single MCP that plugs into everything https://t.co/78k8zO6CUv
> Ghidra: decompiler, free https://t.co/T4UwApebCS…
> GhidraMCP: lets your agent drive Ghidra https://t.co/TJhvovWOVJ…
> ida-pro-mcp: hooks your agent into IDA Pro https://t.co/xm7FUywscM…

[02] mobile & apps
> jadx: turns Android APKs back into Java https://t.co/E4Yg0NKeQN
> Apktool: take APKs apart and put them back together https://t.co/Dx5Mxj6Xst…
> Frida: hook into apps while they run https://t.co/J7VPj371J9
> ILSpy: decompiles .NET https://t.co/dbnyEBZMSU…

[03] binary & low-level
> radare2: RE framework that lives in your terminal https://t.co/0zjfDIkiTm…
> x64dbg: debugger for Windows https://t.co/D4fskuXqhJ
> ImHex: hex editor with its own pattern language https://t.co/tRLAMVCOH4
> angr: symbolic execution engine https://t.co/GNA0rXyuu7

[04] network & runtime
> mitmproxy: sits in the middle and reads the traffic https://t.co/aexBKlRIPt…
> dnSpy: debug and edit .NET apps https://t.co/5VMhkWlxSS
> rizin: the radare2 fork https://t.co/V0eGBoTMBY
> raddebugger: the debugger from Epic Games https://t.co/UR4huJ2fEn…

[05] rebuild & verify
> awesome-ai-reverse-engineering: 122 repos, every one graded https://t.co/nnfVgcjPyD…
> awesome-reverse-engineering: curated by the guy who made REA https://t.co/psahTNrb0m…
> REA workflows: ready-made investigation prompts, ship with REA
> clean-room loop: SPEC.md, oracles and checks until it matches

how it runs: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry

save this, point it at any app and watch it explain itself.

[Martí @BettaTech]

OpenAI ha publicado nuevos descubrimientos. Entre ellos, el que más me interesa (a mi) es el de ETH.

Ahora mismo lo están revisando, pero antes de que veáis posts diciendo cosas incorrectas:
- No, esto NO demuestra P=NP ni P!=NP.

Esta demostración es interesante porque muchos papers usaban ETH como guía (diciendo cosas tipo: "Bajo ETH, este problema no puede resolverse en 2 elevado a o(n)"), entonces, al demostrar que esa guía no es correcta, se abren muchas investigaciones posteriores.

Es como volver a la uni y estar en la clase en la que explicaban los problemas NP Completos jaja

[Chrome for Developers @ChromiumDev]

No, WebMCP isn't replacing MCP.

MCP connects agents to your services.

WebMCP connects agents to your website while it's open and the user's in the loop.

Here's how they fit together ⤵️

[José Siles | AI | Data @josesilesdata]

A LA MIERDA EL VIBE-CODING!

FUE BONITO MIENTRAS DURÓ:

2025 - 2026🪦

GitHub ha sacado spec-kit

La idea: dejas de pedirle cosas al agente a lo loco y escribes primero la especificación.

Luego el agente la ejecuta.

El flujo son 5 comandos:

/speckit.constitution → los principios de tu proyecto
/speckit.specify → qué quieres construir
/speckit.plan → stack y arquitectura
/speckit.tasks → lista de tareas real
/speckit.implement → lo construye

Funciona con 30+ agentes:

- Copilot,
- Claude
- Codex
- Cursor

y muuuuchos más.

Link al repo en los comentarios👇🏼

[Miguel Ángel Durán @midudev]

JetBrains acaba de sacar de código abierto un IDE que se mejora a si mismo.

Va aprendiendo lo que hace y necesita tu proyecto y creando features para adaptarse a él.

→ https://t.co/ijZxInWmMw

[Precis0x @precisox]

Comparto esto, por que muchas personas me han preguntado.

Si quieres aprender ia y construir con ella, este es el orden que yo seguiria:

1. Las bases que nadie quiere estudiar
https://t.co/ZDJbVRJeRV

2. Que aprender mas alla del prompt
https://t.co/HJGJArmyH5

3. 11 conceptos de Claude que tienes que entender
https://t.co/YNddnRu71N

4. Más de 80 modelos gratis para practicar
https://t.co/nMI6YVc3Ld

5. Backend básico: HTTP, auth, JWT, OAuth
https://t.co/5lEMT96nKc

6. Mi backend entero cuesta $0 al mes
https://t.co/SzGsDBYjge

7. 6 repos de agentes que vale la pena estudiar
https://t.co/unTMxpPTVr

8. Lo que necesitas para lanzar un producto real
https://t.co/Z2KdFPn2np

9. El prompt de seguridad que todo vibe coder necesita
https://t.co/fSxQOI0Qwa

10. El prompt para que tu app no se caiga en producción
https://t.co/5myw4nOKg7

Guardalo.
Es la ruta completa.

Graciaaas.

[Morgan @morganlinton]

🎉 BeautifulRust v1.3.0 is now live!

The last 24 hours have been wild, amazing to see the interest in this, so I thought, why not take the most-requested feature and just build it, today.

And it's done, now live on Github. It really is amazing how fast you can iterate when so many people start using something within the first 24 hours.

Here's what’s new in this release 🔽

- a new skill that ports C, C++, Python, Go, and JS/TS to idiomatic Rust

- it ports your tests first, so the Rust version is checked against the original’s own behavior

- NULL and None become Option, error codes and exceptions become real error types, and magic strings become enums

- every port ships with a PORTING.md that maps the old API to the new one and lists every deliberate difference

Keep calm and Rust on 🤘 🦀

https://t.co/fw8jkfAq5e

[OpenAI @OpenAI]

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.

Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.

This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://t.co/TW3jrSbB3f

[Sara Maridueña @sarimariduena]

La crisis de PHP explicada para no informáticos 🧵

Hoy medio mundo apagó páginas web por una falla en algo llamado PHP. Si no eres informático y te preguntas qué pasó, por qué hubo gobiernos que cerraron sus sitios y si deberías preocuparte, te lo explico con ejemplos de cocina y cerraduras 👇

[Fazt @FaztTech]

🚨 Si tienes un servidor con PHP, actualízalo hoy. Ya salió el parche y ya hay ataques reportados.

Las versiones corregidas son PHP 8.5.12, 8.4.27, 8.3.36 y 8.2.35. Todo lo anterior a esas versiones está afectado.

Ayer habia mucha especulacion pero ahora sí es oficial: son 2 fallos en el núcleo de PHP (CVE-2026-109618 y CVE-2026-109619), conocidos como PHP2Shell, con gravedad 9.2 de 10, que permiten a un atacante ejecutar código de forma remota en servidores web sin iniciar sesión. Ambos son errores de memoria, en simple: PHP a veces no limpia bien la memoria entre una petición y otra, y un atacante puede aprovechar esos restos para meter su propio código.

Y esto afecta a toda instalación de PHP que atienda peticiones web: PHP-FPM, Apache con mod_php, php-cgi, FrankenPHP y LiteSpeed. Los más expuestos son los que usan mod_php.

Los ataques ya lo estan reportan empresas de seguridad: watchTowr detectó explotación real en su red de honeypots, Cloudflare dice que los ataques empezaron y Patchstack confirmó varios incidentes. PHP todavía no lo ha confirmado y CISA aún no los agregó a su catálogo de vulnerabilidades explotadas.

Asi que si estás en versiones viejas: PHP ya no da soporte a 8.1 y anteriores, pero por la gravedad publicó parches mínimos para 7.4, 8.0 y 8.1, pensados para quien compila desde el código fuente. Las distros y proveedores con soporte largo recibieron los parches antes de la publicación, así que si tu PHP viene de Ubuntu, Debian o RHEL, revisa sus paquetes. Si estás en algo más viejo y sin proveedor, toca migrar.

Lo que tienes que hacer hoy:

☑️ Actualiza a 8.5.12, 8.4.27, 8.3.36 o 8.2.35
☑️ Reinicia PHP-FPM o Apache para que todos los procesos usen la versión nueva
☑️ Si usas Docker, reconstruye tus imágenes
☑️ En Debian/Ubuntu, confirma con apt changelog: php -v puede mostrar el número viejo aunque ya esté parchado
☑️ Si usas el repositorio de Remi, hoy no tendrá actualizaciones: cambia a los paquetes de tu distro o compila PHP desde el código fuente
☑️ Si no puedes actualizar ya: pon session.upload_progress.enabled=0 y reinicia todos los procesos. Eso bloquea el ataque demostrado por esa vía, pero no los demás caminos. Actualizar es la única protección confiable.
☑️ Si estás detrás de Cloudflare, ya hay reglas de firewall contra los vectores conocidos, disponibles para todos los clientes, incluso el plan gratis. Ayuda, pero no reemplaza el parche.

WordPress, Laravel, WooCommerce, Magento… todo corre sobre PHP. El fallo está debajo de todos ellos: no se arregla actualizando plugins ni tu código, sino la versión de PHP del servidor.

[Fazt @FaztTech]

Qué será de ese Dev que tenía su app de backend en PHP y frontend ejecutandose con Node, un backend con LiteLLM , desarrollada con OpenCode, con su codigo guardado en GitLab Self-Hosted y desplegada en Railway con certificados de eMudhra.

[Miguel Ángel Durán @midudev]

¡Semana complicada para la seguridad de lenguajes de programación! No solo PHP ha tenido problemas.

Tenemos parches también para:
- Node.js (Alta) Ejecución remota de código y fallos TLS
- Java (Alta) 49 fallos explotables en remoto sin auth
- Go: Certificados comprometidos
- Python: Certificados comprometidos

¡Si tienes apps en producción, toca revisar y actualizar!

[FBI Cyber Branch @FBICyberBranch]

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[Uncle Bob Martin @unclebobmartin]

I'm designing a new system for use by my family and friends. I had most of the design discussion with grok orally while driving in the cybertruck. I finished off with an oral conversation with my grokbots. The grokbot wrote up a spec for grok build. I'm about to start the build process now.

[Artificial Analysis @ArtificialAnlys]

Mistral has released new Speech models! Voxtral Small Transcribe 3 takes the #3 spot on the Artificial Analysis Speech to Text leaderboard, and Voxtral 3 TTS enters the top 12 in both Text to Speech arenas

@MistralAI has released Voxtral 3: a new Text to Speech model and three Speech to Text models (Small Transcribe 3, Mini Transcribe 3 and Mini Transcribe Realtime 3). We evaluated all of them.

Key takeaways:

➤ Speech to Text: Voxtral Small Transcribe 3 takes the #3 spot on the Artificial Analysis Speech to Text leaderboard with a 2.1% AA-WER Index, ahead of ElevenLabs Scribe v2 (2.2%) and Grok Voice Transcribe 2.0 (2.3%). Voxtral Mini Transcribe 3 lands at #5 with 2.2%.

➤ Streaming Speech to Text: Voxtral Mini Transcribe Realtime 3 scores 3.3% final-transcript AA-WER at the 960 ms setting (#6 of 46) and 3.6% at 480 ms, down from 5.2% for the previous Voxtral Mini Transcribe Realtime.

➤ Text to Speech, Provider Voice: Voxtral 3 TTS scores an Elo of 1,218 across 1,599 arena appearances, ranking #12 of 98, just behind Breeze TTS 2 at 1,221 and ahead of Inworld Realtime TTS-2 Flash and StepAudio 2.5 TTS at 1,216. It ranks #13 in English (US) and #12 in English (UK).

➤ Text to Speech, Controlled Voice: Voxtral 3 TTS scores 1,068 across 1,614 appearances, ranking #12 of 43 with the same 8 cloned voices, behind Eleven v3 at 1,072 and level with Ant Group's Ming-3.0-tts at 1,068. It ranks #10 in Assistants and #10 in English (UK).

➤ Pronunciation Robustness: Voxtral 3 TTS scores 84.4%, ranking #13 of 32 models, behind Qwen-Audio-3.1-TTS-Plus at 84.6% and ahead of HeyGen Voice at 83.2%. It ranks #3 in Standalone Terms at 93.9%.

➤ Pricing: Voxtral 3 TTS is priced at $13/1M characters, compared to Gemini 3.8 Flash TTS at $16.5/1M characters, Eleven v4 Turbo at $40/1M characters and Simba 3.2 at $6.6/1M characters.

See more details and listen to samples below ⬇️

[Miguel Ángel Durán @midudev]

¡Vulnerabilidad crítica histórica de PHP!
Prepárate para actualizar tus servidores HOY mismo.

A las 16:00 (hora de España) sale parche urgente para dos fallos muy graves.

Se podría ejecutar código remoto en cualquier servidor.

Lo peor: afecta a versiones de PHP 5 hasta la 8.

Y ya está circulando un posible exploit del problema, por lo que no me extrañaría que se adelante el lanzamiento del parche.

Si tienes un servidor propio o de terceros con PHP, WordPress o similares es IMPORTANTE que actualices.

[deezzex @deezzex]

a broke student from California just used REA (Reverse Engineering) to replicate Microsoft 365 and has already made $30,000 in donations from its users.

her campus dropped its free Office licences. she didn't pay. she didn't pirate it either. she took it apart.

six weeks later, 41,000 students use her free rebuild.

here's how she did it, step by step.

1 · OBSERVE: watch what it does, don't assume
She never opened a line of Microsoft's code. For two weeks she just logged what she actually used: which features, how often, and what made her stop and wait.
→ 80% of her time went to 6 features out of more than 2,000.

2 · GUESS: name each part you think is there
She listed what she thought made Office "Office": the editor, file sync, real-time co-editing, templates, the "it just opens .docx" magic.
And one decoy belief: "you need a giant team to build this."

3 · TEST: change one input, watch what changes
- She sent 30 classmates a .docx with no Word installed. 27 only needed to read it and add comments.
- She disabled every feature except the 6 she'd logged. Nobody noticed for 9 days.
  → The decoy failed. The moat was never features. It was file compatibility and habit.

4 · MAP: keep only what the tests proved
Her drawing ended up with 4 blocks: open-format import/export, a fast editor, shared folders, and offline mode. Everything else came off it.

5 · REBUILD: build your own, then compare
She built it with open-source document libraries, open file formats, her own UI and her own name on it. She shipped no logos, no copied code and no pretending to be anyone else.
Then came the real test: could a classmate finish an assignment without noticing the difference? 92% did.

then the part nobody plans for. She added a "this saved me $99" button that went nowhere, just a thank-you page. students turned it into a donation link themselves.

what the story shows
→ you don't beat a giant by copying it. You beat it by finding the 6 features that matter to your people and doing those better.
→ most moats are habits, not technology.
→ the real skill isn't coding. It's knowing which guesses to throw out.

I'm taking one well-known product apart like this every week, using the same 5 steps, and I share the blueprint with anyone who follows along.

somebody in your feed is sitting on the next her idea and just needs the method.

so here's my question: which "untouchable" product do you pay for every month that's really just 6 features and a habit, and why haven't you rebuilt it yet?