On January 1, 2026, GitHub will reduce the price of GitHub-hosted runners by up to 39% depending on the machine type used. The free usage minute quotas will remain the same.

On March 1, 2026, GitHub will introduce a new $0.002 per minute GitHub Actions cloud platform charge that will apply to self-hosted runner usage. Any usage subject to this charge will count toward the minutes included in your plan, as explained in our GitHub Actions billing documentation.

Runner usage in public repositories will remain free. There will be no changes in price structure for GitHub Enterprise Server customers.

We are increasing our investment into our self-hosted experience to ensure that we can provide autoscaling for scenarios beyond just Linux containers.

Historically, self-hosted runner customers were able to leverage much of GitHub Actions’ infrastructure and services at no cost.

Over the past week, we've identified and tracked an unprecedented 23 extensions which copy other popular extensions, update after publishing with malware, manipulate download counts, and use KNOWN attack signatures which have been in use for months. Many of these relate to Glassworm malware, but there could be mulitple campaigns at work also.

During OpenAI’s GPT-5 launch event, they demoed the model’s ability to fix real bugs in production code. Live on stage. In their own repository. The kind of demo that makes CTOs reach for their credit cards and engineers nervously update their resumes. There’s just one small problem: the fix they promised to merge “right after the show” is still sitting there, unmerged, three and a half months later.

Wanna hear a joke about construction? I am still working on it🤣

Why did the developer go broke? Because he ran out of cache 🤣

A good overview of their tests and findings surrounding Flock cameras. Goes through some approaches on manipulating and monitoring the cameras themselves, but also the hosted Flock platform, police, shared data, and politics.

What's new in .NET 10

.NET 10 is a LTS (long term support) release.

With C# 14, F# 10, .NET Libraries, ASP.NET Core, Blazor, .NET MAUI, Entity Framework Core 10, Visual Studio 2026, SDK releases.

binfmt_misc (short for Binary Format Miscellaneous) is a Linux kernel feature that allows the system to recognize and execute files based on custom binary formats. It’s part of the Binary Format (binfmt) subsystem, which determines how the kernel runs an executable file.

In 2019, SentinelOne published a two-part analysis describing a persistence technique called Shadow SUID (Part 1, Part 2): Shadow SUID is the same as a regular suid file, only it doesn’t have the setuid bit, which makes it very hard to find or notice. The way shadow SUID works is by inheriting the setuid bit from an existing setuid binary using the binfmt_misc mechanism, which is part of the Linux kernel.

Interestingly, this technique seems to have fallen into oblivion again, as neither MITRE ATT&CK nor the five-part Elastic Security “Linux Persistence Detection Engineering” series mentioned it (the last part here with links to all other parts). As of 2025, however, the technique works wonderfully and would probably be very difficult to detect (see the hunting section later).

Alternative press article: https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/

Identified extensions are mainly on OpenVSX - an alternative VS Code Extension Marketplace.

Update (Oct 19, 2025): A new infected extension detected in Microsoft's VSCode marketplace - still active.

Bleepingcomputer:

Microsoft has removed the malicious extension frrom its marketplace following the researchers' alert.

About Bun:

Bun is a fast, incrementally adoptable all-in-one JavaScript, TypeScript & JSX toolkit. Use individual tools like bun test or bun install in Node.js projects, or adopt the complete stack with a fast JavaScript runtime, bundler, test runner, and package manager built in. Bun aims for 100% Node.js compatibility.

1.3 release:

The highlights:

• Full‑stack dev server (with hot reloading, browser -> terminal console logs) built into Bun.serve()
• Builtin MySQL client, alongside our existing Postgres and SQLite clients
• Builtin Redis client
• Better routing, cookies, WebSockets, and HTTP ergonomics
• Isolated installs, catalogs, minimumRelease, and more for workspaces
• Many, many Node.js compatibility improvements

Interop 2025 is a cross-browser effort to improve the interoperability of the web — to reach a state where each technology works exactly the same in every browser.

The WPT Dashboard, wpt.fyi, displays results for the web-platform-tests, or WPT, which are a group of test suites for many web platform specifications.

• WPT GitHub Repository
• interop project - GitHub repository

I linked to the stable view. Experimental has much higher scores. (Hopefully stable soon? :))

Pijul is a free and open source (GPL2) distributed version control system. Its distinctive feature is to be based on a theory of patches, while still being fast and scalable. This makes it easy to learn and use, without any compromise on power or features.

Why Pijul

Pijul is the first distributed version control system to be based on a sound mathematical theory of changes. It is inspired by Darcs, but aims at solving the soundness and perfor>mance issues of Darcs.

Pijul has a number of features that allow it to scale to very large repositories and fast-paced workflows. In particular, change commutation means that changes written independently can be applied in any order, without changing the result. This property simplifies workflows, allowing Pijul to:

• clone sub-parts of repositories
• solve conflicts reliably
• easily combine different versions.

The main difference between Pijul and Git (and related systems) is that Pijul stores changes (or patches), whereas Git deals only with snapshots (or versions).