Quick Hits

• The eMudhra mystery may be solved. @Austen argues that instead of generating a random 256-bit number, the certificate authority generated a random number between 0 and 256, which neatly explains the weak keys people observed: 4, 66, 155, 156, 230 and 237.
• Quest Diagnostics disclosed a breach of its Quanum lab portal. @kimmonismus frames it as a worst-case scenario in which up to 100 million US patient records could be exposed, on top of @AndrewCurran_'s note that Quest serves roughly half of US hospitals and physicians.
• @superalesha claims NVIDIA sold millions of RTX 3090s with half their tensor throughput switched off, and that one kernel module took his cards from 82 to 155 TFLOPS BF16 with byte-identical outputs. Nobody has independently reproduced this yet.
• Firecrawl launched a free Government & Legal Index plugin for ChatGPT and Claude, per @ericciarla, pointing agents at 30M+ primary government pages instead of the blog posts they usually learn regulations from.
• @IntCyberDigest reports "Node2Shell," a critical Node.js code-execution bug found by OpenAI's Codex Security and demonstrated on the official Node 24.22.0 image. End-of-life releases 20, 23 and 25 get no fix.

The Entropy Bug That Ends a CA

The most satisfying detective work of the day belongs to @Austen, who proposed that eMudhra's weak private keys come from a single misread: a random number in the range 0 to 256 instead of a random 256-bit number. Every suspicious key that surfaced, including the infamous 4, fits inside that range. Credit @flowirin for calling it first in the quoted thread: "They misread 256 bit as 0-256, I bet."

@kunchenguid landed the day's darkest joke about the same story, quipping that if eMudhra were Chinese they would never have picked number 4 as a private key, a nod to the number's unlucky connotations.

The business fallout is unpacked by @GergelyOrosz, who suspects the real reason eMudhra is exiting the SSL business is that Google signaled it would most likely drop eMudhra from Chrome's trusted roots entirely after what he calls "inexplicable incompetence" in how the CA key was generated. He was quoting @EggMasonValue's report that eMudhra is leaving the certificate market and blaming social media rather than its own practices. Whether Chrome distrust was formally communicated or inferred, the sequence of a broken key followed by a hasty exit is hard to read any other way.

Agents Earned Their Keep Today

The strongest AI thread was agents doing specific, verifiable work rather than demos of demos.

@Steve_Yegge has been running agents over his networks again, and when he mentioned the eMudhra certificate vulnerability, his Fable agent went straight to @TheHackersNews to read the coverage. That is how Yegge discovered the outlet, which is a tidy illustration of agents doing useful research discovery on their own initiative.

@Teknium handed a dithering JS library to Hermes Agent and asked for a demo page of lesser-known web component libraries. The result, which he kept expanding through the day, now holds 462 demos covering 425 libraries across 23 sections, a genuinely useful inspiration resource built in about twenty minutes of agent time.

On the reliability side, @pidotdev shared @superlinear_fm's deep dive on building with Pi Durable and Cloudflare Durable Objects. The standout pattern is durable agents for high-stakes workflows: Pi Durable checkpoints each step and records whether a tool call actually completed, so an agent that crashes mid-refund does not blindly retry and charge the customer twice. The post also sketches shared multiplayer agents, agents running on phones with local state, and debugging dashboards built directly on persisted agent state.

For anyone vibecoding, @Voxyz_ai begs you to add two lines to AGENTS.md: cut taglines, helper text and secondary labels, and fix the layout if a screen needs them; and always make the decision that elevates UX, DX and agent experience together without breaking anything. @GoogleCloudTech points in the same direction with "3 markdown architecture patterns that boost agentic productivity," leaning into the running joke that Markdown is now the hottest programming language.

Breach Day: Hospitals, TVs, and Chatty Agents

@AndrewCurran_ broke the Quest Diagnostics story: the company was hacked, patient data was exposed, and the investigation is ongoing. @kimmonismus adds the scale framing, arguing this is close to the worst case imaginable because Quest's Quanum lab portal serves roughly half of US hospitals, putting as many as 100 million patient records potentially in attackers' hands. The 100 million figure is his extrapolation, not a confirmed count, so treat the magnitude as provisional until Quest discloses numbers.

@log4j took a more hands-on route to privacy concerns. After noticing weirdly targeted ads on a 2025 Samsung TV, failing to reverse the AES-encrypted firmware without UART or JTAG work, he went the zero-day route and got a root shell on current Samsung TVs. He describes finding "PRIVACY HORROR" and says a write-up is coming.

The AI-adjacent vulnerability came from @This_Liss, who found Claude Code exposing personal data in HTTP headers because the sites it curled politely asked agents to identify their users. @chrislakin says he asked his own Claude about it and it reported sharing his email more than 10 times this month, including to the SEC. A model's self-report is not an audit log, so verify before panicking, but the header-leak mechanism itself is worth checking on any machine running coding agents.

Extraordinary Claims, Pending Receipts

@BowTiedCrocodil flagged the 3090 story as "crazy news," and the underlying claim from @superalesha is certainly extraordinary: NVIDIA shipped millions of 3090s with 50 percent of tensor speed switched off, not missing, allegedly to protect workstation card sales. He says a single kernel module took his BF16 tensor pipe from 82 to 155 TFLOPS with byte-for-byte identical outputs, that his int8 LLM engine still gained 10 percent on prefill, and that the real winners would be BF16-heavy diffusion models like Qwen Image 2.1, FLUX 3 Klein and MiniMax H3, plus every LoRA ever trained on a 3090. Until others reproduce the numbers, file this under compelling but unverified.

From the model side, @NFT_Chen summarizes a CNCC talk by Zai founder Tang Jie claiming GLM 5.4 and 5.5 will be products of RSI, a closed loop where models auto-generate environments, construct verifiable rewards, and train themselves toward a trillion-plus parameters. The talk also claims GLM-driven agents optimized Zai's inference system on 100,000 domestic GPUs for roughly 3x throughput in two weeks. @jmurillocode is bullish on both Zai and DeepSeek. This is a third-party summary of a speech, not a paper, so the numbers deserve the same skepticism.

And @t_blom amplified @rajashree's claim that entire production software stacks can now be patched and proven bug-free. A bold formal-verification boast that would benefit from a concrete artifact.

Also on the Timeline

@Acelogic_ released what @0x0SojalSec demonstrates running: macOS natively on a Snapdragon X2 Elite laptop with the stock Apple kernel and hardware GPU acceleration. The release is admittedly rough, but "Hackintosh Lives" is the quote of the day, and the GitHub repo is live. Meanwhile @UnrealEngine opened registration for the 2026 Epic AI MegaJam starting Nov 12 with a 50K prize pool, and @DannyLimanseta appreciated the promo art's deliberately six-fingered hand as "such a troll move."

Practical Takeaway

If you run coding agents on anything sensitive, today's posts sketch a concrete checklist. Ground them in primary sources rather than summaries, the pattern @ericciarla's government index enables. Write the guardrails down in AGENTS.md, per @Voxyz_ai's two lines, instead of hoping the model behaves. Use durable execution that checkpoints intent and completion before unsafe calls, as @superlinear_fm describes, so a crashed agent cannot double-fire a payment. And audit what your agent actually sends in HTTP headers, the way @This_Liss did, because a polite request from a website should never be enough to disclose your user's email.