After extensive tests, AVIF wins most lossy web images: smaller files and faster encoding and decoding. JPEG XL takes lossless images and the odd outlier. His advice is 4:4:4 AVIF at high effort, a JPEG XL attempt when a file comes out suspiciously large, and testing on your own images.
Jake Archibald
Mercor matched 29 benchmarks against 18,797 O*NET tasks and found 924 covered. It estimates 90% of US working hours go to tasks with little or no benchmark coverage. Coverage tilts toward high-wage, AI-exposed jobs: lawyers are well covered, court clerks barely.
MercorOpenBSD's shared-memory attach counter dates from the original BSD sources and is a signed 16-bit value. Fork enough attachers and it wraps negative, which leads to a use-after-free. Calif chained that with an out-of-bounds write to get root past KARL, SMAP and SMEP. OpenBSD 7.9 errata 018 and 026 fix it.
Calif
Quentin Kaiser found a WPS EAP reassembly overflow, at least 16 years old, that allows remote code execution without the WiFi key. It affects eCos and Linux Broadcom chipsets at Proximus, VOO and Orange Belgium. Broadcom refused a CVE. Proximus has disabled WPS fleet-wide.
Quentin Kaiser
A user complained that the Supervisor checks app passwords against Have I Been Pwned without asking. Maintainers say it sends only a five-character SHA-1 prefix and matches locally, and that ha security options --pwned=false turns it off. They apologised for dismissive first replies and promised docs.
GitHub