Thoughts on AI, the tech stack, and the indie hacker journey.
PixelSmash (CVE-2026-8461) is a heap overflow in FFmpeg's MagicYUV decoder that fires on automatic thumbnailing and metadata scans — no one opens the file. If your app takes uploads or you run a media server, the vulnerable code is already in your path. Upgrade to 8.1.2.
GPT-5.5-Cyber went GA on June 22 with state-of-the-art exploit and patch benchmarks. You can't use it unless you're a vetted security company. The best defensive AI of the month is one you can't buy — so stop treating 'an AI will patch it' as your security plan.
The real pattern in 2026's solo-founder data isn't the one-person unicorn. It's an operational ceiling somewhere between $50K and $150K MRR, where support, ops, and multi-product upkeep outrun what you and your agents can run. Then it's a three-way fork.
Supabase closed a $500M Series F at a $10.5B valuation, named Claude Code its biggest source of new projects, and said agents now spin up the majority of databases on the platform. Here's what that does to your roadmap priority and your exit cost.
Vercel's eve treats every agent as a directory of files and ships the infra to run it in production: pitched as 'Next.js for agents.' It's a clean abstraction and the Nth agent framework in 18 months. Here's the solo-dev read on agent-framework churn.
Apple auto-adjusts one-time purchase prices across storefronts for currency and tax. Auto-renewable subscriptions are excluded. Set one base price and it ships flat to 175 storefronts: US-priced everywhere and unaffordable in most of them, or cheap everywhere and underpriced where people can pay. This is the boring operations work that decides whether an app earns.
Deno 2.9 shipped June 25 with `deno desktop` — build a native desktop app from the web stack, no Electron boilerplate, single binary. It also reads npm, pnpm, yarn, and Bun lockfiles directly and runs on Node 26. The headline feature is the one you should adopt slowest. The plumbing is the part worth your Saturday.
Security firm AIR shipped a malicious agent skill, every scanner marked it safe, and it spread to about 26,000 agents. The trick was simple: the external page a skill points to can be rewritten after the scan. If you install agent skills on stars and a green checkmark, read this.
A model OpenAI has never officially announced had close to a million dollars riding on its release date — then the June window collapsed and the odds cratered. The whole episode is a clean case study in why building your roadmap around a leak is a tax you don't have to pay.