Gustavo Bordoni

(he/him) Sr Director of Engineering @nexcess | FakerPress | Proud dad | Enjoys Olympic Weightlifting

[Gustavo Bordoni @webord]

How many update cycles a day? Haha

Also, are they in order of usage? Left to right or right to left?

[shadcn @shadcn]

Send help.

[Gustavo Bordoni @webord]

@GravityView Looking forward to testing! Where does the codebase live? Maybe it’s something worth extending in our codebase In Nexcess.

[Gustavo Bordoni @webord]

@GijoVarghese_ Hoping to have more features soon! Rebuilding the UI In react and with CLI support

[Shaban @shabanhr]

Introducing Dashboard Blocks! 🖤

The most demanded @shadcn blocks, engineered to help you ship beautiful analytics interfaces in seconds.

• Registry ready
• Native light & dark mode support
• Fully compatible with @base_ui + @radix_ui
• Agnostic to any icon library (@lucide_icons, @huge_icons, @tabler_io ... more)

Stop spending days aligning charts.

Grab them below 👇

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[Gustavo Bordoni @webord]

@andrewhoyer @KatieKeithBarn2 There are loads of misinformation out there on what happened with the our products. They have not been deprioritized in any way. Quite the opposite, we believe in their future. But yes, the umbrella is not StellarWP anymore.

[Gustavo Bordoni @webord]

@mikemcalister @KadenceWP @LiquidWeb Hi @mikemcalister I can safely say that we in @nexcess are not divesting from our Products, specially @KadenceWP we are actually concentrating more efforts on it.

[BOOTOSHI 👑 @KingBootoshi]

USE THE PROMPT BELOW IN CODEX/CC TO PROTECT YOUR SYSTEM AND CODEBASE FROM NPM SUPPLY CHAIN ATTACKS (LIKE TANSTACK TODAY):

"""
set up npm supply-chain protection on this
machine. do all four steps.

1. edit ~/.npmrc. keep every existing line (auth
tokens etc), append:
min-release-age=7
minimum-release-age=10080
save-exact=true

2. edit ~/.bunfig.toml (create if missing). keep
existing content, append:

[install]
minimumReleaseAge = 604800

3. in this project, open package.json and pin
every dependency:

strip ^ and ~ from every version under dependencies, devDependencies, and peerDependencies. exact versions only.

4. commit the lockfile (bun.lock /
package-lock.json / pnpm-lock.yaml)

so the resolved tree is locked in git. then report: files changed, deps pinned, anything unexpected.
"""

the cooldown makes every package manager refuse any version published in the last 7 days. attack chains usually only last a couple hours, but this protects you long term and for any future attacks... which at this rate will keep happening

[Aikido Security @AikidoSecurity]

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral.

373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more.

The malware propagates by stealing your CI credentials and using them to publish new compromised versions.

Full IOCs, affected package list, and detection steps: https://t.co/jWG9DUCu3x

[Gustavo Bordoni @webord]

This is huge.

[Hayden Bleasel @haydenbleasel]

Introducing Files SDK

A unified storage SDK for object and blob backends. One small, honest API. Web-standards I/O. An escape hatch when you need the native client.

→ 18 providers - S3, R2, Vercel Blob, Google Drive, etc.
→ upload, download, head, delete, copy, list, url
→ Works everywhere - Node, Bun, Deno, edge runtimes, browsers
→ Tools for OpenAI, Vercel AI and Claude Agents SDKs

[Aiden Bai @aidenybai]

React Doctor v2 is here

Your agent writes bad React code, this catches it

Works with Next.js, Vite, React Native. Fix your app in minutes

npx react-doctor@latest

[Matt Pocock @mattpocockuk]

4 of the most confusing terms in AI, defined:

Model: a blob of parameters, written during training. Does next-token prediction and nothing else. Stateless.

Harness: everything around the model that turns it into an agent: tools, system prompt, context window management, etc.

Environment: the world the agent acts on. Anything outside the harness that the agent perceives and acts on via tools.

Agent: a model, harnessed, in an environment.

---

Opus is a model.

Claude Code and Claude Web are different agents, because their harnesses differ - even though the models are the same.

The file system is an environment. MCP servers add tools to the environment.

[Gustavo Bordoni @webord]

WordPress Integration WorkOS v1.0.1 is out.

Fixed some problems with saving Production and Staging environments was being saved in two diff spots and some problems with Settings pages not submitting properly.

GH: https://t.co/W0ZmXeRpvD
WP: https://t.co/fnMfYwUUzF

[derek @derekmeegan]

Introducing the /browser-trace skill,

Give your agent 100% observability into its browser: dump network requests, DOM content, screenshots, and CDP logs into a searchable filesystem.

Great for reverse engineering, autoresearch loops, and monitoring the situation ™️.

[Gustavo Bordoni @webord]

Add a user to your WorkOS directory → they show up in WordPress.
Promote them in WorkOS → their WP role updates.
Deprovision them → they're removed from WordPress.

Integration with WorkOS does it via SCIM Directory Sync + signed webhooks.

https://t.co/6YEh5QczQU
https://t.co/hvVliqARHH

@WorkOS

[Gustavo Bordoni @webord]

@AdamFard_ Would love to get that.

[Gustavo Bordoni @webord]

@steipete @useblacksmith I am looking forward to using the testboxes. But truly waiting for https://t.co/iKZ9u0tBgH

[Matt Pocock @mattpocockuk]

Nearly 23K stars for a collection of markdown files I wrote

I guess they must be pretty good

I want to invest more time in this repo. So, folks who starred it, what can I do to make these skills more obvious to you?

- A docs site for the skills?
- Send them to plugin marketplaces?

Help me help you

https://t.co/64UuxC8V0T

[Gustavo Bordoni @webord]

Shipped v1.0.0 of Integration with WorkOS for WordPress today.

SSO, SCIM, MFA, passkeys, audit logs — and a fully WP-hosted login shell or redirect to a third-party login page.

https://t.co/GJ4NlTFeGT
https://t.co/RZgJ3iTkSp

@WorkOS