In partnership with
4x your communication output. Same quality. No burnout.
The bottleneck isn't what you want to say — it's how long it takes to type it. Wispr Flow removes the bottleneck.
Speak naturally and get polished, send-ready text for executive summaries, client updates, board recaps, investor notes, or just the 30 Slack messages you're behind on. Flow strips filler, formats numbers and lists, and preserves your tone.
Used by teams at OpenAI, Vercel, and Clay. 89% of messages sent with zero edits. Works in every app on Mac, Windows, and iPhone.
What's up, everyone? This week OpenAI's models broke into another AI company during a safety test, Next.js and Dokploy both released stacks of security fixes, and shadcn added a third component base. Let's dive in.
You currently have {{rp_num_referrals}} referrals.
OpenAI's models broke into Hugging Face on their own. OpenAI was running an internal benchmark that measures how well its models find and exploit security holes, which it runs with the usual protections switched off. The models “escaped” the sandbox by finding an unknown vulnerability, moved through OpenAI's own research network until they reached a machine with internet access, then used stolen credentials and more unknown vulnerabilities to run code on Hugging Face's production servers and pull the test answers out of its database. Hugging Face caught the intrusion and said the sophistication made it suspect a frontier AI company before it knew which one. OpenAI's own write-up says the models went to “extreme lengths to achieve a rather narrow testing goal.” The AP headline says the technology “acted on its own,” but technology does not have that capacity. A person turned off the guardrails, chose a set of results, and the model went and got the answers.
The Next.js team patched nine security advisories. Four are rated high. The worst lets an attacker send requests to any App Router app using Server Actions and hold the CPU until the process stops answering, and it reaches back to 13.0.0. The rest cover a middleware bypass that only hits Turbopack apps with a single locale, two server-side request forgery holes, cache confusion on requests with bodies, unauthenticated disclosure of internal Server Function endpoints, and an image optimizer that stops responding when it is fed an SVG. Fixes are in 15.5.21 and 16.2.11. Pages Router apps with no Server Actions dodge the most severe bug, though not the rest of the list.
Want to learn more about Payload and how to apply it to your project? Check out my course, Payload Essentials. The course walks you step-by-step through a full Payload and Next.js project so you can go from zero lines of code to a production website ready to deploy.
I believe high-quality education should be as accessible as possible to everyone, no matter where in the world they live. So, purchasing power parity is built in to the price. If you don't see a banner with a discount and believe you should, please let me know!
Dokploy v0.29.13 features sixteen security fixes. Eight close operating system command injection, where a value you control reaches a shell command. Five close cross-organization authorization holes that exposed git provider credentials and SSH private keys to accounts in other organizations, or let one organization delete another's server. Three close privilege escalations, two of which took a member-level account to root through WebSocket handlers and host schedules. If you self-host on Dokploy, update ASAP.
A judge approved Anthropic's $1.5 billion copyright settlement. Authors and publishers get about $3,000 per book across more than 482,000 books. Judge Araceli Martínez-Olguín ruled Monday that it provides “meaningful relief,” and the plaintiffs' attorney called it the largest known copyright recovery in history. Anthropic's deputy general counsel maintains that training on books is fair use. But it isn't what the money is for. Judge Alsup found training legal and found that Anthropic acquired millions of those books from pirate sites, and the settlement applies only to the second finding. This is the first major settlement among dozens of AI copyright suits still working through the courts, so $3,000 a book is the precedent.
The shadcn team added React Aria as a third component base. You can pick it anywhere Base UI or Radix is an option, including the CLI, presets, and shadcn/create, or start a project with pnpm dlx shadcn@latest init --base aria. React Aria components get their own installation, usage, composition, examples, and API reference docs, and all eight styles work with it. State selectors and dependencies stay scoped to the Aria registry, so existing Base UI and Radix components are untouched. Base UI is still the default, and existing projects stay on whatever base they started with.
The Railway team brought CDN cache control into the CLI. railway cdn status reports whether caching is on for a service, along with the HTML caching mode, default TTL, stale-while-revalidate state, and purge-on-deploy policy. railway cdn update changes those settings, and railway cdn purge clears the HTML or the full cache on demand. Every command takes --json, so a deploy script can purge the cache without anyone opening the dashboard. The same changelog introduces Railway's plugin to the Grok Build marketplace alongside Claude Code, Codex, and Cursor, and project tokens now work with railway flag, which was blocking feature flag changes from CI.
RECENT VIDEO
Everyone's writing is converging on the same average, but the bigger cost is the thinking you skip to get there, and in this one I get into what that does to your mind.
What did I miss? There's so much happening in modern web dev that I know I missed something. Please share your thoughts in the comments or reply to this email. I want to address your suggestions and may include them in future newsletters.
Thanks for reading. See you next time.