Siddharth Manjul

Building @giksnresearch ( ) from Nomadic Garage || Veni Vidi Vici

[Siddharth Manjul @siddharthmanjul]

21 days. That's how long OpenAI took to ship into the decision-model category TypeSafe opened with Jev. Labs knock down domains in the order a machine can check its own output: code, video via code, decisions, world models. The gaps keep shrinking. https://t.co/VPKdK6g4ok

[Siddharth Manjul @siddharthmanjul]

@ahmedgagan11 Nicely done. For the frontend, the theme switch is not working, I am unable to switch the theme to dark mode. Just a feedback

[Siddharth Manjul @siddharthmanjul]

Hospitals and universities in Belgium pulled their websites offline this week because of one PHP bug. Attacks started before the patch existed.

If you run PHP, Node or anything from npm, here’s the checklist I’d run today.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Unauthenticated remote code execution, CVSS 9.2. PHP shipped fixes on Oct 21. Every PHP install serving web requests is in scope: PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed.

Check the runtime, not your app. Updating WordPress or Laravel does nothing here. Run php -v. Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
On Debian or Ubuntu packages the version number may not change, because fixes get backported. Check the package changelog for the CVE instead.
Restart PHP-FPM or Apache after updating. The old code keeps running until you do.
Running Docker? Rebuild from a patched base image. Your app deploy doesn’t touch the PHP underneath.
On PHP 8.1 or older you only get source backports, no regular updates. Plan the upgrade now.
Can’t patch tonight? Set session.upload_progress.enabled=0 and put the site behind a WAF. Both are stopgaps. PHP’s own people say ini settings won’t save you.
Check your servers from Oct 20 onward for the web server process spawning shells, curl or wget.

Node and npm

In July, attackers used stolen npm credentials to publish malicious versions of five jscrambler packages. The later versions ran on import, so ignore-scripts didn’t help. The payload went after cloud keys, crypto wallets and AI coding tools. It was flagged within minutes and fixed within 2 hours.

Add a release cooldown. Most malicious versions are dead within a day, so don’t install anything younger than that.
npm 11.10+: min-release-age=1 in .npmrc (days)
pnpm 10.16+: minimumReleaseAge: 1440 (minutes)
Yarn 4.10+: npmMinimalAgeGate: 1440
Use npm ci in CI, never npm install. The lockfile pins exact hashes.
Keep ignore-scripts=true anyway. It blocks most install-time payloads, just not all.
Stay on a supported Node LTS. Node shipped security releases in March and June this year.
If you installed a bad version, rotate every secret that machine could read: cloud keys, CI tokens, .env files. Deleting the package is not enough.
The pattern
The bug is never the whole story. The damage happens in the gap between disclosure and your patch. Know which runtime you actually run, patch it in hours, not weeks, and never install code that’s younger than a day.

[Kunal Gandhi @kunalvg]

I’m LONG India.

> We will build world-class cities
> We will solve our pollution crisis
> Manufacturing will scale, and we will build indigenous solar cells, batteries, jet engines, and smartphones
> UP, Bihar, and MP will wake up and unlock their potential
> There will be reverse brain drain
> We will double per capita income in the next 10 years
> We will have 20 startup unicorns every year

No cynicism. No WhatsApp/Instagram/YouTube doomerism. No anarchy.

The world is underestimating us again.

I’m long India.

[Siddharth Manjul @siddharthmanjul]

Give 2 months no study vacation & ₹10k to each and every 18+ college student before election.

Winning is inevitable

[Siddharth Manjul @siddharthmanjul]

@Vi_kram92 This is really good but I’m happy I was able to do it back in 2018

[Siddharth Manjul @siddharthmanjul]

@iamjasonlevin Hope you guys find a way out, if nothing works I think going to one of the SEA countries would be best

[Siddharth Manjul @siddharthmanjul]

@kunalvg Smuggle the metal??

[Siddharth Manjul @siddharthmanjul]

This is absurdly wrong. I regularly build projects in rust and go

[HITESH @Iam_HITESH__]

Never met a vibe coder using MySQL.
Never met a vibe coder using MongoDB.
Never met a vibe coder using SQLite.
Never met a vibe coder using C++.
Never met a vibe coder using Go.
Never met a vibe coder using Java.

Vibe coding is literally just:

Next.js + Tailwind + Supabase + Claude

[Siddharth Manjul @siddharthmanjul]

@pareen I wanna join in

[Siddharth Manjul @siddharthmanjul]

@officially__adi Yup and it’s ironic too

[Siddharth Manjul @siddharthmanjul]

not only claude but chatgpt and grok too. I asked some questions related to REA and according to these models, it's shady and illegal stuff I should not do

[abhinav @AbhinavXJ]

anthropic just killed the REA

it stops claude from doing it

that’s why local models are important

[Siddharth Manjul @siddharthmanjul]

@officially__adi Because reverse engineering and copying is creating problems for all the products 😂

[Siddharth Manjul @siddharthmanjul]

Never expected this on the first article!!

[Siddharth Manjul @siddharthmanjul]

I rebuilt Meta FAIR’s token-to-byte distillation (arXiv 2609.12303) on a 4-core CPU.

The approximate method has a blind spot: after “there was a”, the teacher is 97.6% sure the word is over, but its byte target says the next letter is ’n’ with 99.99%.

The exact fix looked clearly better, until I matched the compute.

At equal FLOPs, the approximate one won.

Paper - https://t.co/Iq4I4bXlVd

Full write-up with code - https://t.co/PnFjFnve5e

[Siddharth Manjul @siddharthmanjul]

@akhilnanavati Happy birthday brother 🥳

[Siddharth Manjul @siddharthmanjul]

@zeeshan_utd og look is still unmatched

[Siddharth Manjul @siddharthmanjul]

kpi stats with delta, this component is a necessity working with multiple agents

[Siddharth Manjul @siddharthmanjul]

@kalashvasaniya Bro safegaurded himself against ai 😭

[Siddharth Manjul @siddharthmanjul]

I rebuilt Meta FAIR’s token-to-byte distillation (arXiv 2609.12303) on a 4-core CPU.

The approximate method has a blind spot: after “there was a”, the teacher is 97.6% sure the word is over, but its byte target says the next letter is ’n’ with 99.99%.

The exact fix looked clearly better, until I matched the compute.

At equal FLOPs, the approximate one won.

Paper - https://t.co/Iq4I4bXlVd

Full write-up with code - https://t.co/PnFjFnve5e

[Siddharth Manjul @siddharthmanjul]

@kunalvg great, we should meet somewhere near AI & privacy things will happen