Sheet 2 of 4 · Lab notes · The shop's own paperVol. 01 · Niš, Serbia · Free
Lab notes.
Tutorials on one side, essays on the other, Stoic notes from the shelf, and the weekly Wire on what is moving in AI infrastructure. Written down the week it happened, so it is still true.
⌘K
Lead noteThe Wire · Note 075 · Nov 12, 2026 · 7 min
Sixteen CVEs in the Plumbing: Node.js Patches Its HTTP/2 and TLS Stack
Node.js 26.13.1, 24.22.3 and 22.23.5 shipped November 11 with 16 fixes, seven rated High, led by an HTTPS heap leak and an HTTP/2 crash. Who is exposed, who a proxy shields, and how to upgrade.
Read the noteBy Lazar Stanković · from the shop in Niš
Also this week · The Wire · 7 min
The Commit That Wasn't There: Inside the wfx Raid on GitHub Actions Secrets
Since November 10, hijacked GitHub accounts have pushed a CI secret stealer to default branches and reverted it within seconds. How it hid, where the counts disagree, and what to check today.
Also this week · The Wire · 6 minDeepMind Ships a Factory Robot Brain and a Cell-Aware Genome Model, and Only One Has an API
Gemini Robotics 2.5 (November 10) and AlphaGenome 2 (November 11) arrive with large, Google-run numbers. The genome model is callable today for non-commercial research; the robot model reaches partners only.
Departments · The four series
Build01 · Tutorials
Jun 19 · 3 minPrompt Engineering: Text Summarization
In an era where market-research PDFs land on desks faster than you can finish a ristretto, prompt-engineered text-summarisation lets analysts trade hours of CTRL-F drudgery for instant, five-sentence clarity on how AI adoption and ramped-up privacy regulation are reshaping customer behaviour.
All tutorials →Think02 · Essays
Jun 18 · 2 minYou can ship in weeks, but can you survive the launch?
We had three weeks to build an MVP. No extensions, no excuses. Ambitious? Absolutely. Risky? Of course. But this wasn’t our first rodeo.
Jun 07 · 2 minThe Myth of the Perfect System
All essays →The Wire04 · Weekly
Issue 075 · Nov 12 · 7 minSixteen CVEs in the Plumbing: Node.js Patches Its HTTP/2 and TLS Stack
Node.js 26.13.1, 24.22.3 and 22.23.5 shipped November 11 with 16 fixes, seven rated High, led by an HTTPS heap leak and an HTTP/2 crash. Who is exposed, who a proxy shields, and how to upgrade.
Issue 074 · Nov 12 · 7 minThe Commit That Wasn't There: Inside the wfx Raid on GitHub Actions Secrets
Issue 073 · Nov 12 · 6 minDeepMind Ships a Factory Robot Brain and a Cell-Aware Genome Model, and Only One Has an API
Get it weekly, free →Archive · Every note on file
2026
No.DateNoteSeriesRead
075Nov 12
Sixteen CVEs in the Plumbing: Node.js Patches Its HTTP/2 and TLS Stack
Node.js 26.13.1, 24.22.3 and 22.23.5 shipped November 11 with 16 fixes, seven rated High, led by an HTTPS heap leak and an HTTP/2 crash. Who is exposed, who a proxy shields, and how to upgrade.
The Wire7 min074Nov 12The Commit That Wasn't There: Inside the wfx Raid on GitHub Actions Secrets
Since November 10, hijacked GitHub accounts have pushed a CI secret stealer to default branches and reverted it within seconds. How it hid, where the counts disagree, and what to check today.
The Wire7 min073Nov 12DeepMind Ships a Factory Robot Brain and a Cell-Aware Genome Model, and Only One Has an API
Gemini Robotics 2.5 (November 10) and AlphaGenome 2 (November 11) arrive with large, Google-run numbers. The genome model is callable today for non-commercial research; the robot model reaches partners only.
The Wire6 min072Nov 11Vercel, Netlify, Cloudflare, Coolify, Dokploy: The Limits, the Meters and the Monthly Bill
CPU caps, memory ceilings, build limits and egress rates for five deploy targets, from their own docs as of November 11, 2026, plus two worked monthly bills. The meters differ more than the sticker prices.
The Wire16 min071Nov 11Gemini 4 Carbon Goes on Sale: Frontier Scores at Argon's Price
Google opened Gemini 4 Carbon to paying API developers and AI Ultra subscribers on November 10: $2/$10 per million tokens until November 30, then $4/$20, a photo-finish CursorBench lead, and a Signal proof run.
The Wire7 min070Nov 11CoreWeave Beats, Raises, and Pays $846 Million in Interest
CoreWeave's third-quarter revenue rose 168% to $3.66 billion and guidance beat consensus, lifting a stock down 40% in a month. Underneath: a sixfold larger loss and an interest bill growing faster than sales.
The Wire6 min069Nov 10Node.js 26 'Lithium' Goes LTS: Temporal Ships, and the Deprecation Bills Come Due
Node.js 26.13.0 'Lithium' became Active LTS on October 28, with support to April 2029. Temporal by default, V8 14.6, real removals, and what upgrading a NestJS or Express service actually takes.
The Wire7 min068Nov 10NestJS 12: ESM Packages, Schema-First Validation, and an Upgrade You Can Mostly Script
NestJS 12 shipped August 27 with ESM-only packages, Standard Schema validation on route decorators, Vitest and oxlint defaults, and a hosted observability SDK. What breaks, what does not, and how to move a v11 app.
The Wire8 min067Nov 10.NET 11 and C# 15 Ship: Unions, In-Box Zstandard, and a Support Clock That Stops With .NET 10's
.NET 11 went GA on November 10 with C# 15 union types, Zstandard in System.IO.Compression and opt-in runtime async. It is an STS release whose support ends the same day as .NET 10 LTS.
The Wire8 min066Nov 10SoftBank's ¥1.1 Trillion Quarter: The Write-Off Was Made of Turbines, Not Models
SoftBank swung to a ¥1.12 trillion loss in its fiscal second quarter. The damage came from US data-center power equipment, financing costs and Intel hedges, while its OpenAI stake stayed marked at $99.6 billion.
The Wire7 min065Nov 10Five objections to gating AI-written code, and how Deslopping answers them
The approve button no longer proves anyone read the diff. I'm building Deslopping to fix that, and these are the five objections I hear most, answered with the screens.
The Wire6 min064Nov 10Claude Fable 5.2 and Mythos 5.2: One Model, Two Doors, and a 20% Cheaper Ticket
Anthropic shipped Fable 5.2 and Mythos 5.2 on November 9: one model behind two access tiers, a 20% price cut to $8/$40, and benchmark, security and Fermat claims that are, for now, Anthropic's own.
The Wire6 min063Nov 09Nvidia's Board Opens an Independent Investigation Nine Days Before Earnings
Nvidia's board will investigate reports that Jensen Huang was the target of a foreign intelligence effort. It sees no sign secrets were compromised; the stock slipped, and results land November 17.
The Wire7 min062Nov 09The Frontier Gets Repriced: OpenAI Takes $1.25 Trillion, Anthropic's IPO Buyers Talk Lower
OpenAI closed an $11 billion first slice of its round at $1.25 trillion, below its $1.4 trillion ask, while Anthropic's IPO buyers reportedly talk $1.2 to 1.3 trillion. The sell-off has set the price.
The Wire7 min061Nov 08Inkling 2 Small: 594 Billion Parameters, 17 Billion at Work, Weights Promised Next Week
Thinking Machines launched Inkling 2 Small on November 5, a 594B-parameter MoE with 17B active, on Tinker only. Its self-reported scores are solid, not dominant; the real test is the Apache 2.0 weights promised for next week.
The Wire6 min058Nov 07Google's $17 Billion Wyoming Campus Brings Its Own Power Plant
Google confirmed a $17 billion data center near Cheyenne on November 5, fed largely by a gas-fired private microgrid that includes AEP's 702 MW Bloom fuel-cell plant. The grid queue is what it routes around.
The Wire7 min057Nov 07The AI Trade Meets the Ballot Box: a $2.3 Trillion Thursday and a Cautious Friday
On November 5 the Nasdaq 100 fell more than 6% and chip stocks 12% as markets repriced the AI buildout after the midterms. Friday's bounce was partial; the open question is now electricity, not models.
The Wire7 min060Nov 06The Freezer Aisle Is an Attack Surface Now: US Agencies Warn on Refrigeration Controllers
On November 5, CISA, the FBI and three other US agencies warned that hackers are targeting refrigeration controllers worldwide, after supermarkets in at least nine European countries binned food from freezers set to 50°C.
The Wire6 min059Nov 06Atlassian Beat the Quarter and Got Punished for the Slope
Atlassian topped Q1 FY27 estimates, then guided cloud growth from 31% to about 27% and the stock gave back much of its autumn rally. The numbers, the Data Center hangover, and what agents mean for seat-priced Jira.
The Wire6 min056Nov 06GPT-6 Cyber: A 'Critical' Model, a Guest List, and a Longer Patch Queue
OpenAI released GPT-6 Cyber on November 5 to vetted Daybreak Red customers, rating it Critical under its own framework. The vendor numbers are striking; the real bill lands on everyone's patch queue.
The Wire7 min055Nov 06How Deslopping works: one AI-written pull request, from risk score to merge
A step-by-step walk through Deslopping: how a pull request is scored, how its questions are written and tested, what happens after a wrong answer, and what a team learns about its AI without ever seeing a person.
The Wire9 min054Nov 05I built an app that puts engineers back behind the wheel of AI-written code
AI writes more of our code every month, and the approve button has quietly become a rubber stamp. Why I built Deslopping, a GitHub check that asks engineers to show they understand a change, and never ranks them.
The Wire9 min053Nov 04How to run SaaS product marketing in 2026: win the answer before the buyer calls
Half of B2B software buyers now start in an AI chatbot, Google answers before anyone clicks, and the shortlist is set before sales says hello. What the 2026 data says product marketing should do.
The Wire7 min050Oct 29Mistral Opens Large 4: A European Trillion-Parameter Model, With One Condition for Hosts
Mistral published the weights of Mistral Large 4, a 1.05T-parameter model trained on 3,800 GPUs in Europe. It closes a month of giant open releases in which licenses, not parameter counts, decide who can serve them.
The Wire8 minSheet 1 of 4 · 24 notes per sheet · Older years: 2025Older notes →
Index · Tags
The Wire · Weekly · Free
One letter a week on AI infrastructure, shipping on a deadline, and the craft.