Stack Info

Stack Info allows you to discover tech stacks used by hundreds of startups and corporates in EMEA. #WeAreStackInfo

[Stack Info @stackinfoio]

We have finally released the first MVP.

Stack Info now will serve the Egyptian tech community by showing tech stacks of more than 150 companies here in Egypt.

Brought to you from Cairo.
https://t.co/nqFNp4QdTQ

#WeAreStackInfo

[Chaitanya @chaaai]

Today I'm announcing Workers IO to solve the slowest part of engineering, verification!

AI agents can now write years’ worth of code in days, but it still takes significant engineering effort to verify what’s being built.

It’s impossible to predict all scenarios that could lead to a failure and that’s why most expensive failures are found in production.

Workers IO runs millions of simulated production scenarios on your entire system, including dependencies. These simulations run inside a deterministic hypervisor which injects faults like network delays, disk errors, clock skew, and process failures to verify how your system handles these conditions.

Deterministic execution allows us to systematically explore the state space of the system and perfectly reproduce failures.

We are already helping customers do years worth of production hardening in days and build confidence in what they’re shipping.

If you are working on systems that you can never afford to break, DM me and we can help you battle test them!

[shehab @shehabirl]

surprising my 2 users side project with 100 commits in a single session

[tobi lutke @tobi]

What a disaster https://t.co/t0gGtjCIWJ

[Ali Yahya @alive_]

Hard to overstate how big of a deal this is.

tl;dr — ANY unpatched Linux server with even a single TCP port exposed to the internet (say for HTTP or SSH) and MPTCP active (default for many Go web servers) is vulnerable to complete takeover.

[siddharth @buildwithsid]

October in a nutshell:

- PHP got hacked
- Railway got hacked
- OpenCode got hacked
- Binance got hacked
- Polymarket got hacked
- GitHub Actions got hacked
- SoftBank got hacked
- Cursor marketplace got hacked
- Coinbase vendor got hacked
- Fireworks AI got hacked
- LiteLLM got hacked
- Capcom got hacked
- npm packages got hacked
- TiDB Cloud got hacked
- Warp's vendor got hacked

happy cybersecurity awareness month

[Aly Moursy @alymoursy]

all i can say is: what a month.

[mrs. robot @keyserfaty]

today we are announcing openrouter for commerce: https://t.co/qLbYqziMtG

a single endpoint that integrates 5k stores, including Doordash, Amazon and most shopify stores, with payments using Agentcard (Stripe Link and Shop coming soon).

we built opencommerce to solve 3 problems:
* coverage: one endpoint to integrate 5k stores. agentic purchasing is a core feature for most personal assistants, but not their main business. searching for products and buying on behalf of users shouldn’t be as painful as it is today (e.g. it shouldn’t involve browser automations or dealing with PSPs). opencommerce solves that: 1 tool, every online store.

* reliability: 100% uptime. the challenge with browser automations is that they fail (e.g. captchas, bot-detection, etc). we run thousands of tests every couple of hours on every one of the stores to guarantee that the integration works when your user tries to buy something.

* speed: responses in under 10s. consumers are used to Amazon speed, and agentic purchases have so far felt like a downgrade. most agents spend minutes finding products before they come back with results. we monitor speed and improve it constantly.

[Ayush Agarwal @ayushagarwal]

ok update on the deleted repo thing, since it kind of blew up

first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst.

we figured out what happened. nobody hacked us, and it wasn't a github bug.

that repo was a private fork of a repo owned by @StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it.

Stainless got acquired by @AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo.

turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something.

no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs.

github support walked us through all of it within a day, which, genuinely, thank you.

one ask though @github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached.

we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again.

if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.

[International Cyber Digest @IntCyberDigest]

‼️ A GitHub user with no membership, invite or role at Dodo Payments deleted one of its private repos, co-founder Ayush Agarwal says.

The audit log he shared shows a single repo.destroy from the GitHub CLI.

It is missing from deleted repositories, so he cannot restore it.

[Peter Sellis @petersellis]

I’m joining the team at @X to lead Product.

I am a huge believer in @SpaceX's mission to extend human consciousness to the stars, so it’s time to make shitposting multiplanetary.

X is the best way to find out what’s happening in the world right now and talk about it. The team has been working tirelessly to make X a better place and product for the people who love it, and many have noticed the recent momentum. My goal is to help accelerate that momentum for our community, new users, and businesses globally by continuing to make this product beautiful and useful.

We are twenty years in, but it truly feels like X’s next chapter will be our greatest. I look forward to your ideas and feedback; I’m sure the replies will be measured and magnanimous.

[Aly Moursy @alymoursy]

thank you @tecxbro for the amazing gift bro

he made a @VeezaAI game. check it out here: https://t.co/I8TAfXK5Ed

[Stack Info @stackinfoio]

🔥🔥🔥🔥

[Aly Moursy @alymoursy]

today's my birthday, and usually people should be giving me a gift, but instead I want to give everybody a gift 😁

another @VeezaAI launch video!!!

[The Hacker News @TheHackersNews]

🛑 ALERT - Node2Shell RCE exploit works on an official Node.js build.

Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.

Here's how the exploit works: https://t.co/ffJvHDqRXj

[Juampi @juampitech]

October has been an absolute nightmare for software

> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident

At this point, the biggest security risk might not be the code we write, but the code we trust...

[Jake @JustJake]

Today, we were alerted of malicious activity that compromised Railway's servers

We are sharing this with you broadly and swiftly. We recommend folks rotate their keys out of an abundance of caution.

[Α Ω Programmer @OmegaNekoSimp]

WHAT THE FUCK IS HAPPENING TODAY

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Daniel Lockyer @DanielLockyer]

Node.js security releases for this are coming out tomorrow (Wednesday 21st)

[Dane Knecht 🦭 @dok2001]

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show up.

This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.