code review

Cloudflare has published an open-source coding-agent skill for carrying out multi-phase security audits. The tool produces independently verified, machine-readable findings, letting AI coding agents run structured security reviews of codebases. Its release is drawing attention from developers interested in integrating automated security auditing into AI-assisted development workflows.

A developer reports that an AI agent acting as team lead wrote a blog post describing how 27 AI agents and just 2 humans built maity.team, a hub letting coding agents from different vendors work as one team with a shared board, inbox and source of truth. The build took 14 days and produced roughly 692,000 lines of code across 1,269 pull requests, each reviewed by three reviewers.

A discussion is circulating on how engineering organizations can be built around AI from the ground up, treating AI tools and agents as core to how teams write, review and ship code rather than as an add-on. Commenters are weighing in on what this means for team structure, hiring and day-to-day developer workflows, as companies race to reorganize their engineering practices around AI capabilities.

PR Agent, an open-source AI pull request reviewer written in Python, is trending on GitHub. The project describes itself as the original open-source PR reviewer, adding the unusual clarification that it is not the Qodo free tier, pointing to a split between the open-source codebase and its commercial counterpart.

The next major release of the PostgreSQL database is reportedly running late, with maintainers attributing delays to the volume of AI- and LLM-generated contributions that require extra review and cleanup. Developers say vetting low-quality or machine-written patches is consuming time normally spent on the release itself.

PostgreSQL 19's release is running late, with developer Robert Haas attributing the delay to an unusually high number of bugs being found in the codebase. In a blog post he connects the bug surge to AI-assisted development generating more testing and code scrutiny. The PostgreSQL community is debating whether this reflects healthier testing or AI-produced low-quality contributions straining maintainers.

Reports claim OpenAI has made a discovery described as a shortcut to fundamental physics, with the suggestion being that its AI systems uncovered something akin to a cheat code governing the universe. Details of the alleged breakthrough remain vague, and no formal publication or peer-reviewed result has been clearly cited. Commentary is circulating mainly through tech and science commentators reacting to the claim.

Amazon has overhauled its internal software engineering guidelines to reflect a shift toward AI-generated code. As reported by GeekWire, the company is updating how its developers design, review and maintain software now that AI tools can write much of the code themselves. The move signals how one of the world's largest engineering organizations is adapting its practices and expectations for developers in an AI-first development environment.

Developer Paul Bakaus released Impeccable, an open-source project described as a design vocabulary for AI coding agents. The tool aims to guide agents toward more polished output, steering them with terms like "polish" and "bolder," supporting reviews through "critique" and "audit," and catching low-quality AI-generated code before it ships. It is written in Rust and has been drawing attention on GitHub since launch.

Linus Torvalds says the Linux kernel is out of its stabilization phase and that AI-related contributions now follow a 'much healthier model'. He acknowledged machine-made patches still 'often get rewritten', suggesting AI-assisted code is entering the kernel process under closer human review rather than being accepted wholesale.

GitHub is reporting an ongoing incident affecting Pull Requests, Git Operations and Issues, according to its official status page. Developers are sharing the incident report and discussing the disruption on Hacker News, where the story has drawn dozens of comments. Teams relying on GitHub for code review and collaboration may face degraded service while engineers work on a fix.

A developer describes a small experiment using three pull requests on a public test repository with a human reviewer. One change to covered files was approved and merged; an identical change was rejected with a stated reason; a third touched an area marked for post-merge checks and was merged immediately, with an issue surfacing seconds later.

A playlist of ten lo-fi trance tracks from the album "We All Burn Out EP" is being shared as background music for working through pull requests, code reviews and long comment threads. The recommendation is aimed at developers, sysadmins and security people, tying hacker-adjacent electronic music to slow, focused programming work.

A workflow approach called 'Tasks as Code' is gaining attention, arguing that task tickets should live directly in the code repository alongside the source they relate to, rather than in a separate project management tool. Supporters say it keeps work items versioned, reviewable and close to the changes they describe, while critics question whether it scales for larger teams.

The New York Times reports that Silicon Valley companies are struggling to handle a surge of software bugs discovered by artificial intelligence tools. As AI systems increasingly scan code for vulnerabilities, they are flagging far more defects than engineering teams can review and fix, straining development workflows and security processes across the industry.

Security researchers at Cyfirma report that a vulnerability dubbed PHP2Shell is being actively exploited in the wild. The flaw reportedly allows attackers to turn PHP-based web applications into remote code execution targets, though specific affected software versions and patch details have not yet been widely published. Administrators of PHP-based websites and servers are being urged to check for updates and review exposure as details continue to emerge.

A new vulnerability, EUVD-2026-116619, has been documented in MLflow, an open-source machine learning platform. The flaw, rated 7.8 out of 10 on the CVSS v3.1 scale, involves insecure deserialization of PickleEvaluationArtifact data, which could let remote attackers execute arbitrary code on affected systems. The advisory was updated on November 4, 2026, and security teams monitoring MLflow deployments are being urged to review their exposure and apply mitigations.

French cybersecurity firm Sekoia has uncovered a web-based campaign dubbed Poisoned Source, tracked since mid-October and attributed to the Russian-linked threat group APT29. The operation targeted iOS and Android users by compromising legitimate websites and injecting malicious code, a technique observers note as an evolution toward mobile-focused espionage. Security researchers are sharing technical indicators and warning organizations to review exposed sites.

A developer says they have begun running AI models locally on their own PC for everyday coding tasks, even though Claude Code already handles most of their development work. Their approach: reserve the paid subscription for demanding work like building new features, while a local model handles repetitive tasks such as repeatedly reviewing their own codebase. The split reflects a wider debate about balancing subscription costs, privacy, and control over AI coding tools.

Alpine Linux has rebuilt its GitLab infrastructure following an attempted remote code execution attack on its systems. The lightweight Linux distribution said the incident prompted a full rebuild of the GitLab instance as a precaution, with maintainers reviewing the environment for signs of compromise before restoring service. The attempted attack has drawn attention within the open source community to security practices around developer infrastructure.

A new blog post titled 'I Read the Clankers' Code' is circulating on Hacker News, describing an in-depth review of the source code behind a robotics or automation project. The write-up has drawn modest engagement from technically minded readers, who typically discuss such code walkthroughs for what they reveal about engineering quality and design choices.

Security researchers are warning about http2shell, a remote code execution vulnerability affecting applications built with Node.js, Python, and other common runtimes. The flaw highlights how widely used language toolchains can share exposure to the same exploit, prompting developers to review dependencies and apply patches as details of the threat continue to evolve.

AI-generated contributions are making it harder to trust open source code, as low-effort automated submissions flood maintainers. Bloomberg and the OpenTelemetry project have adopted measures to verify contributor identity and intent, restoring some confidence in the review process. The debate reflects wider concern in the open source community about maintaining quality and accountability as AI tools reshape how code gets contributed.

A/SIDE has launched a private photo sharing service that pairs encrypted chat functionality with openly published source code. Users can share images in private conversations protected by end-to-end encryption, while the open-source approach allows independent review of how the platform handles data. The move taps into ongoing demand for privacy-focused alternatives to mainstream social media and photo sharing apps.

The Linux 7.4 merge window has become the largest in the kernel's history, with 19,671 commits merged since Linux 7.3, according to Phoronix's analysis of Git data. Much of the surge is attributed to AI-assisted development, with automated tooling helping developers generate and clean up code changes faster. Kernel watchers are debating what the record volume means for review quality and long-term maintenance of the codebase.

A discussion is under way in security circles about whether Proton's zero-access encryption could be weakened as AI-generated code takes up a growing share of software development. The concern is that human security reviews may struggle to keep pace, allowing subtle flaws into code that supports even strong cryptographic systems. Commenters point out that robust encryption can still fail because of implementation mistakes, making code quality and auditability central to privacy guarantees.

TAKT, a TypeScript command-line tool, has been listed in an open-source repository catalog. It lets developers define repeatable AI coding workflows in YAML, covering planning, implementation, review and fix loops for coordinating multiple AI coding agents. The listing highlights growing interest in structured orchestration tools as teams increasingly use AI agents in day-to-day software development.