Kujo MCP is now listed in the official GitHub MCP Directory! Give your AI agents a direct way to discover and understand the Kujo ecosystem. 🔎 Search projects, tools, skills, and workflows 🧩 Get stack recommendations for specific tasks 📦 Find installation commands and setup guidance 🛠️ Explore WebOps capabilities 📚 Retrieve source-linked docs and project details The server exposes 7 deterministic, read-only tools. No arbitrary command execution, filesystem access, or secret retrieval. Built with Kujo, designed for agents, and open source. Connect: mcp.kujolang.ai/mcp GitHub MCP Directory: github.com/mcp/kujolang/kujo… Trust at the speed of AI.

Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.

I would love to see a file upload for remote codex sessions, not only a photo upload option @OpenAIDevs

its time.

Referencing this in an upcoming video and I realized that a lot of people probably haven't seen Bas Rutten's lethal self defense

🚀 Kujo v1.9.0 is officially released! This release brings a substantial round of language improvements, runtime optimizations, and cross-platform verification. What's new: - Added checked nested assignments for arrays, dictionaries, and structs, preserving atomicity when writes fail. - Improved UTF-8 conversion, byte operations, and snapshot-safe iteration. - Added fallible comparator sorting, regex replacement callbacks, and regex_count for scanning without unnecessary allocations. - Expanded language utilities with headerless CSV records, fixed decimal formatting, and explicit wrapping arithmetic. - Reduced unnecessary memory copying through shared bytecode, copy-on-write storage, string caching, and improved VM call frames. - Improved VM/interpreter consistency for indexed operations, invalid writes, and exception handling. - Preserved numeric JIT compilation alongside speculative string-append optimizations. - Verified native installation and upgrades across Linux, macOS, and Windows, including npm distribution without install-time binary downloads. A lot of the work in 1.9 is about making Kujo faster and more predictable without sacrificing correctness or the execution guarantees we've been building around. Full release: github.com/kujolang/kujo

PHP2Shell: 24 Hours Later 24 hours after PHP2Shell dropped, 99.3% of affected PHP instances are still unpatched. Yep, you read that right. 🫣 🤦 After CVE-2026-109618 & CVE-2026-109619 were disclosed, we tracked more than 2.2 million publicly visible PHP instances on Shodan to see how fast the internet actually patches an unauthenticated RCE in PHP itself. • At first: 245 patched instances • After 12 hours: 4,519 • After 24 hours: 14,151, out of ~1.97M measurable affected instances Breaking it down by WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento shows the same picture: roughly 99% still unpatched. AI is making us faster at finding critical vulns, but it isn’t making us faster at removing them from the internet. If that gap keeps growing, patching quickly won’t be enough on its own. You need to know what you actually expose, cut internet-facing surface you don’t need, monitor for exploitation, and fix what’s really exploitable first. If you have a publicly accessible PHP instance and still haven’t patched, assume you’re exposed. Patch now, then check for signs of compromise. Full data and methodology on the OX Security blog: ox.security/php2shell-24-hou…

JUST IN: 🇺🇸 Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo detect unauthorized AI agents accessing customer accounts and attempting to act without user instructions.

Having strong enemies is a blessing.