Fact-Checked: Google Maps Did Show Lake Ontario as 'Lake America' to US Users — the Video Is Satire, Not a News Report

Oct 27, 2026•5 min

A TikTok by Omar Agamy (@omaragamyy, verified, titled "Is Lake Ontario in Canada or the USA? Quick Google Maps Answer", 38 seconds, shown date 8-31 with no year shown, 22.1K likes, 547 comments, 1,813 favourites and 546 shares, captioned "What do you think of that?", tagged #google #usa #canada #fyp) plays the story as a comedy sketch: Google, the USA and Canada appear as characters, with on-screen captions including "MAKE CANADA MAD". We checked the claim underneath the sketch against reporting from iHeart and Travelers Today, and against the earlier Gulf rename coverage. The map claim at the centre of the video is real. The sketch around it is satire — a joke built on top of a real rename, not a news segment reporting one.

What the video claims

As the video presents it, Google Maps shows the lake as "Lake America" to viewers in America, while it stays Lake Ontario everywhere else, including in Canada. That single claim is the whole engine of the skit: the USA character treats the new name as a win, the Canada character objects, and Google stands between them as the referee who changed the label. Around that core, the video adds a poverty and homelessness contrast between the two countries — that part is the creator's comedy commentary, a punchline about priorities, and this check does not treat it as a verified news claim.

What we checked

• The rename itself. Whether an executive order actually renamed the lake, when it was signed, and what the new name applies to.
• What Google Maps showed, and to whom. Whether the name on the map really differed by country, and which naming authority Google follows.
• Apple Maps. Whether the other major map platform followed, and when.
• The Gulf precedent. Whether this really does follow the earlier Gulf of Mexico / Gulf of America pattern, and where the two cases differ.
• What Google said. Whether Google issued a statement about this lake specifically — one source said it had not, so this check does not attribute one to it.
• The framing. Which parts of the video are the checkable claim, and which parts are the creator's satire layered on top of it.

What is real: the rename and the split map

The executive order is real. In August 2026, President Trump signed an executive order renaming Lake Ontario as "Lake America" for US federal use. The rename was reported on 27 August 2026, landing in the middle of US–Canada trade tensions — the political backdrop the skit's argument between the two country characters is riffing on. As with the earlier Gulf rename, the order governs how the US federal government names the feature; it does not rename the lake for Canada or for the rest of the world.

Google Maps followed the US naming system. Google Maps takes its US place names from the US Geographic Names Information System, so once the federal name changed, the map changed with it: users in the United States were shown "Lake America". Canadian users still saw "Lake Ontario", and users elsewhere saw both names shown together. That split — one lake, different labels depending on where you stand — is exactly what the video describes, and it is the part of the skit that checks out completely.

Apple Maps followed later. Apple Maps adopted the lake name in September 2026, a month or so after Google's change. So by the autumn, both major map platforms were showing US users the new federal name, while the lake kept its original name for Canadian viewers.

One caution on Google's behalf. One source noted that Google had not issued a statement specifically addressing Lake Ontario. Google's behaviour here is consistent with how it handled the Gulf rename — follow the official US naming source — but this article does not put Lake-specific words in Google's mouth that the reporting did not find.

This follows the Gulf pattern — with one real difference

None of this is new behaviour. In February 2025, after the Gulf of Mexico was renamed for US federal use, Google showed US users "Gulf of America", Mexican users "Gulf of Mexico", and everyone else both names. The Lake Ontario change runs on the same rails: the official US name changes, the map follows the US naming database for US users, and other countries keep the name their own authorities use, with both labels shown in between.

The difference is geography, and it is not a small one. With the Gulf, the disputed name sits on a body of water the US borders along its edge. Lake Ontario is split by the international border itself — the line between the United States and Canada runs through the middle of the lake. Renaming it for US federal use means renaming, from one side only, a lake that is half Canadian in the most literal geographic sense. That is why this rename drew a sharper reaction than the Gulf one, and why the skit's premise — Canada objecting to a new name on its own lake — lands as more than a generic joke.

What is satire, not news

Everything in the video beyond the map claim is performance. Google, the USA and Canada are characters in a 38-second personification skit, not spokespeople; the "MAKE CANADA MAD" caption is a gag about motive, not a documented reason for the rename; and the poverty and homelessness contrast is the creator's comedy commentary about the two countries' priorities. None of that was verified as a news claim in this check, and none of it needs to be — a skit is allowed to exaggerate. What matters for anyone sharing the video is the direction of travel: the joke works because the rename underneath it actually happened. Shared as "Google renamed the lake as a prank" or as a straight news clip, it would mislead; shared as satire about a real rename, it is accurate about the one thing it asserts — the name on the map really does depend on which side of the border you are standing on.

Why it matters

Map labels feel like neutral facts, which is exactly why a change like this travels. In practice, the name you see is a localised output of an official naming database, and this episode shows the seams: two neighbours looking at the same lake on the same app and seeing two different names, each correct under their own government's naming authority. It also shows how quickly a federal paperwork change becomes the everyday version of reality for millions of people — not through an announcement most users ever read, but through the label on the map they open without thinking. The skit understood that instinctively. The fact-check just confirms the instinct was pointed at something real.

Sources

• The original TikTok — Omar Agamy (@omaragamyy), "Is Lake Ontario in Canada or the USA? Quick Google Maps Answer" ↗
• iHeart (Y102.5), 30 August 2026 — Google Maps updates Lake Ontario to Lake America ↗
• Travelers Today, 27 August 2026 — Lake Ontario renamed Lake America: Google Maps faces problem Gulf rename didn't ↗
• TechXplore, February 2025 — Google renames Gulf of Mexico to Gulf of America for US users ↗

All claims above were checked on 27 Oct 2026. The video is a satirical skit: its country-personification dialogue, its "MAKE CANADA MAD" caption and its poverty and homelessness contrast are the creator's comedy commentary, reported here as satire, not as verified news claims. One source noted Google had not issued a statement specifically addressing Lake Ontario, so none is attributed to Google here.

Fact-Checked: AI Found the PHP Flaws Behind PHP2Shell — and the '70% of the Web' Claim Needs Its Qualifier

Oct 27, 2026•7 min

A TikTok by Karuparti AI (@karuparti.ai, titled "PHP Releases Patches for Critical Flaws", 1 minute 57 seconds, posted about 27 October 2026, tagged #cybersecurity #AI #PHP #AIagents #infosec) tells a striking story: two critical flaws sat in PHP itself for years, AI agents helped find them, patches landed in a hurry, and attackers are already probing for unpatched servers. We checked that story against the CISA alert and reporting from The Register. The core facts hold up. Two parts of the video are argument and warning rather than verified measurement, and one headline number only works with the qualifier the shorthand version drops.

This post is the AI-discovery fact-check on these flaws. It takes a different angle from the 27 October Tech Today item on the same vulnerabilities, which covered the CISA exploitation confirmation as news; here the focus is what the video claims about how the flaws were found, and how far its wider claims go.

What the video claims

As the video presents it, PHP released emergency patches for two critical flaws that allow an unauthenticated attacker to run code remotely on a server. The flaws are in the PHP engine itself, not in a single plugin or content management system built on top of it. The video says AI agents played a real part in uncovering them, argues that the same AI capability lowers the cost of finding vulnerabilities for attackers as well as defenders, warns that systems in finance, healthcare and power infrastructure could be in the blast radius, and ends with practical steps for larger organisations — plus an on-screen prompt viewers are told to screenshot and run in an AI coding tool to audit their own systems.

What we checked

• The flaws themselves. The CVE numbers, the severity scores, what kind of bug they are, and whether they sit in PHP itself or in something built on PHP.
• The fixes. Which PHP versions patch the flaws, when those releases landed, and what happens to older branches.
• The exploitation claim. Whether CISA really listed the flaws as known-exploited, when, and what deadline it set.
• The AI-discovery story. Who found what, how AI agents were involved, and whether more than one team was part of it.
• The market-share number. What the "about 70%" figure actually measures, and what it does not.
• The wider warnings. Whether the claims about attackers, costs and critical sectors are reported facts or the creator's argument built on top of the facts.

What is real: the flaws and the patches

Two flaws, one nickname. CVE-2026-109618 and CVE-2026-109619 are known together as PHP2Shell. Each is rated CVSS 9.2, which puts both firmly in critical territory.

Remote code execution, no login needed. Both flaws allow unauthenticated remote code execution — an attacker who can reach a vulnerable server can run code on it without first signing in or stealing credentials. That combination, critical score plus no authentication required, is why the response has been urgent rather than routine.

The bug is in PHP itself. This is not a flaw in WordPress, Drupal or any other single application, and it is not a plugin bug. The vulnerable code is in the PHP engine, so any application running on an affected PHP version inherits the exposure regardless of how carefully that application itself was written. Patching the application on top does not fix the engine underneath it.

Patched on 21 October 2026. Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run PHP, one of those — or a later release on the same branch — is the version line you need to be on.

Older branches get no official fix. PHP 8.1 and older receive no official patch for these flaws. CISA's advice for systems that cannot be patched is blunt: take them offline. An unpatchable, internet-facing PHP 8.1-or-older server is not a "patch it next cycle" problem; on the official guidance, it should not stay reachable.

CISA confirmed exploitation, with a hard deadline. On 26 October 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, with a federal patching deadline of 29 October 2026. That listing followed honeypot reports of successful exploitation — in other words, systems set up to watch for attacks recorded attackers actually getting in through these flaws, not merely scanning for them. A KEV listing with a three-day federal window is CISA signalling that this is being used now, not a theoretical risk to schedule around.

What is real: AI agents helped find them

The most unusual part of the video's story — that AI agents helped surface flaws this old — is the part supported by multiple reports, and the detail is more interesting than the headline version.

A failed exploit attempt found the first flaw. In August 2026, Wiz researcher Sagi Tzadik was using an AI agent while trying to adapt a WordPress exploit so it would work against Drupal. That original attempt failed. But in the course of the work, the agent uncovered a flaw in PHP itself — one that had sat unnoticed for over a decade. The discovery was a by-product: the agent was not sent hunting for a PHP engine bug, it tripped over one while doing something else.

A second team found a related flaw. Working separately, Calif, working with OpenAI under its Patch the Planet effort and using GPT-5.6 Sol, found a related flaw. Two independent AI-assisted efforts converging on the same area of the engine is part of why the response involved more coordination than a single-vendor fix.

About 15 people coordinated the fix. Around 15 researchers and maintainers were involved in coordinating the disclosure and the patches. That number matters for how to read the story: AI agents surfaced the problems, but human researchers verified them, worked out the fixes and managed the release across four supported branches.

The PHP share claim: true only with its qualifier

The video's scale claim — PHP behind roughly 70% of the web — is accurate only in its qualified form. W3Techs reports PHP in use on about 69–70% of websites whose server-side programming language is known, as of October 2026. That is a share of sites with a detectable server-side language, not 70% of every website on the internet. Sites whose technology cannot be identified are outside that denominator entirely. With the qualifier attached, the point stands and is still large: a flaw in PHP reaches an enormous share of the identifiable server-side web. Without it, the number overstates what was measured.

What is analysis, not verified fact

Two parts of the video go beyond the checkable record, and this article keeps them clearly labelled as the creator's argument rather than reporting them as established fact.

The economics argument. The creator argues that because AI agents can now help find vulnerabilities, the cost of finding them falls for attackers too, not just for defenders and maintainers. That is a reasoned inference from the discovery story — the same tooling is available to both sides — but it is an argument, not a measured statistic. No verified number for attacker costs, discovery rates or attack volumes is established by the sources checked here.

The sector warning. The warning that financial systems, healthcare systems and power-grid systems could be exposed follows the same pattern. PHP is widely deployed, including by organisations in sensitive sectors, so the concern is understandable — but the sources checked do not confirm a specific incident in finance, healthcare or energy caused by PHP2Shell. Treat that part as a warning about where unpatched PHP might sit, not as a report that those sectors have been hit.

The on-screen prompt — and a safety line

At about 1:41, the video shows an on-screen audit prompt and tells viewers to screenshot it and run it in Claude Code, Codex or GitHub Copilot to review their own systems. This article does not reproduce that prompt: its exact wording was not legibly captured in the material checked, and printing a half-read security prompt would help no one. The idea behind it — using an AI coding tool defensively, to review code and configurations you are responsible for — is sound, and it is the third of the video's enterprise actions below. One safety line matters more than the prompt itself: only run AI security reviews on systems you own or have written permission to test. Running audit or exploit tooling against systems that are not yours is not research, it is unauthorised access, regardless of which tool does the typing.

What to do: the video's three enterprise actions

Stripped of the hype, the video's practical advice is good, and it is worth following in this order — with patching first in practice, whatever order it is listed in:

• Know your exposure. Inventory where PHP actually runs in your organisation — including the forgotten staging server, the old marketing site and the vendor appliance nobody has logged into this year. You cannot patch what you do not know you run, and the EOL branches are exactly the ones most likely to be hiding in that blind spot.
• Patch internet-facing systems first, outside the monthly cycle. Do not wait for the regular patch window. Anything reachable from the internet on an affected version goes to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or the current release on its branch — now, and anything stuck on PHP 8.1 or older comes offline until it can be upgraded, per CISA's guidance. With exploitation already observed and a 29 October federal deadline, this is the priority action; the other two support it.
• Use AI defensively on your own legacy systems. The same agent tooling that surfaced these flaws can be pointed, by defenders, at their own ageing codebases to look for the next decade-old bug before someone else finds it. That is a genuinely useful shift this story demonstrates — on your own systems, with permission, as covered above.

Why it matters

Two lessons survive the fact-check intact. The first is about where serious bugs can hide: a flaw can sit in one of the most widely deployed pieces of software on the web for over a decade, through countless human reviews, and still be there. The second is about how it was finally found — not by a dedicated hunt for that bug, but as a side effect of an AI agent doing adjacent work and a second team independently landing in the same area. Whether that permanently changes vulnerability research, for defenders or for attackers, is the open question the creator's analysis points at. What is not open is the immediate task: if you run PHP, the patch versions and the deadline above are real, dated and already being exploited against. Start there.

Sources

• The original TikTok — Karuparti AI (@karuparti.ai), "PHP Releases Patches for Critical Flaws" ↗
• CISA alert, 21 October 2026 — Critical Vulnerabilities in PHP Require Immediate Patching ↗
• The Register, 27 October 2026 — CISA confirms PHP2Shell under attack as researchers clock successful exploits ↗

All claims above were checked on 27 Oct 2026. The video's argument about AI lowering vulnerability-discovery costs for attackers, and its warning about financial, healthcare and power-grid systems, are reported here as the creator's analysis, not as verified facts or confirmed incidents. The on-screen audit prompt shown at about 1:41 in the video is described, not reproduced, because its exact wording was not legibly captured.

Fact-Checked: The 'Super Intelligence' Pledge That Misspelled 'United States'

Oct 27, 2026•6 min

A TikTok by Omar Agamy (@omaragamyy, captioned "Oh this is embarrassing #usa #america #fyp", 34 seconds, posted 1 October) turns a White House signing into a punchline. The joke lands because of one letter — or rather, one missing letter. We checked the claim behind the joke against the signed image itself and against reporting from TechCrunch and USA Today, both dated 30 September 2026. Here is what holds up, and the one part of the video this check does not treat as verified news.

What the video claims

As the video presents it, President Donald Trump and leading technology executives signed a White House pledge about super intelligence, and the signed document itself got the name of the country wrong — reading "Unites States" instead of "United States" right under the president's signature. Around that core claim, the video wraps a humorous protest and Captain America framing: a comic, costume-style joke about embarrassment and standing up to power, played for laughs rather than reported as a straight news segment.

What we checked

• The document and the date. Whether a pledge with this name was actually signed, and when — the signing was on 29 September 2026, with the signed image shared publicly the following day, 30 September 2026.
• The spelling, in the image itself. Whether the line under the president's signature really says "Unites States", and whether the error is his line alone or runs through the whole page.
• Who signed. The names and titles of the executives alongside Trump, checked against the reporting.
• What kind of pledge it is. Whether this is a law, an order with penalties, or something softer — and whether any enforcement mechanism is stated.
• The framing around it. Whether the video's protest and Captain America material is a reported event in its own right, or the creator's comedy layered on top of the news.

What is real

The signing happened. Trump and six executives signed the White House Accord on Super Intelligence — the Joint Commitment on Frontier Responsibilities — on 29 September 2026. The six executives were:

• Sundar Pichai — CEO, Google
• Dario Amodei — CEO, Anthropic
• Mark Zuckerberg — CEO, Meta
• Greg Brockman — President, OpenAI
• Jensen Huang — CEO, Nvidia
• Elon Musk — CEO, xAI / SpaceX

The typo is in the official image. In the image of the signed document shared by the White House and by Trump on Truth Social on 30 September 2026, the line directly under Trump's signature reads "President of the Unites States". That is not a caption added by critics or a label typed over the photo afterwards in the versions reported on — it is the wording shown on the signed document itself, and it is the detail TechCrunch and USA Today both centred their 30 September reporting on.

It is an isolated error on the page. The other signatories' names and their companies are spelled correctly. Whatever went wrong, it went wrong on the president's own title line, on the most prominent signature on the document — which is exactly why the mistake travelled further than the pledge itself.

The pledge is voluntary. It is a voluntary AI safety pledge, not a law. No enforcement mechanism is stated in it: a company that signed and then fell short would not, on the terms described, be breaking a statute by doing so. Its force is reputational and political — a public promise made at the White House — rather than legal.

What is unverified

One part of the video sits outside the verified record, and it is worth naming plainly rather than letting it blur into the checked facts. The humorous protest and Captain America framing is the creator's comedy framing. It was not verified as a separate news claim in this check, so this article treats it only as the video's joke — a way of saying "this is embarrassing" in costume — and not as evidence of a protest event connected to the signing. For the same reason, it should not be conflated with the October 2025 No Kings protests: that is a different thing, from a different time, and nothing checked here links the video's framing to it.

Why it matters

Two things make this more than a funny screenshot. The first is the pledge itself. When the president and the heads of the largest AI companies put their names to a joint commitment on frontier responsibilities, the substance worth watching is what it can actually require — and a voluntary pledge with no stated enforcement mechanism can only ever require what the signatories choose to honour. Readers weighing any future claim that "the accord says so" should start from that limit.

The second is the irony, which is also the lesson. This was a document about super intelligence — about building powerful systems carefully, with oversight, before they are released. A basic spelling error in the country's own name, sitting under the lead signature on the page the White House chose to share with the world, cuts against that message in the simplest possible way: the checking step failed on the one page everyone was meant to look at. The typo does not change what the pledge says, and it does not make the signing any less real. What it does is give every reader a fair, concrete reason to ask the next question of any grand AI announcement — if this detail slipped through, what else was not checked?

Sources

• The original TikTok — Omar Agamy (@omaragamyy), "Oh this is embarrassing #usa #america #fyp" ↗
• TechCrunch, 30 September 2026 — pledge signed by President Trump and top AI leaders misspells the United States ↗
• USA Today, 30 September 2026 — Trump's new accord on 'super intelligence' includes spelling error ↗
• The official White House social post image of the signed accord, shared 30 September 2026 and also shared by Trump on Truth Social — the image showing "President of the Unites States" under the president's signature.

All claims above were checked on 27 Oct 2026. The video's protest / Captain America framing was not verified as a separate news claim in this check.

Tech Today — 27 October 2026

Oct 27, 2026•8 min

Anthropic files publicly for a Nasdaq IPO under the ticker ANT

Anthropic, the company behind Claude, publicly filed a Form S-1 with the US Securities and Exchange Commission on 26 October 2026, applying to list its Class A shares on the Nasdaq Global Select Market as ANT. The filing reports first-half 2026 revenue of $16.29 billion, up from $1.16 billion a year earlier, but leaves the share count and price range blank, and the registration is not yet effective, so no shares can be sold until the SEC declares it effective. The headline $80.7 billion first-half net loss is mostly a $72.4 billion non-cash charge from changes in the fair value of convertible notes and similar instruments, driven by Anthropic's rising valuation; the operating loss was $693 million. Control stays with insiders under the proposed structure: a Long-Term Benefit Trust will elect a majority of the board, and a single Class F share held by an entity owned by the seven co-founders will carry 50.1% of voting power on most matters.

Meta upsizes its record AI equity raise to $97.5 billion — with Nvidia putting in $3 billion

Meta announced on 26 October that it would raise up to $95 billion in equity to fund AI infrastructure and data centres, then on 27 October increased the plan to $97.5 billion. The increase comes from lifting the common-stock offering from $22.5 billion to $25 billion, priced at $625.00 per share, alongside 250 million depositary shares priced at $50 each; a further up-to-$60 billion at-the-market programme would only start after Meta's new non-voting Class C shares begin trading, expected in the first quarter of 2027. Nvidia, AMD and Broadcom had indicated interest of up to $5 billion combined in the Class A shares, and Nvidia separately said it would invest $3 billion. The raise underlines how far even the largest tech companies have moved from funding AI expansion out of cash flow alone: Meta has put its 2026 capital spending at $135–145 billion and reported a $2.12 billion third-quarter cash burn.

Microsoft offers voluntary buyouts to around 60,000 staff — over a quarter of its workforce

Microsoft is offering voluntary buyouts to around 60,000 workers, according to a Bloomberg report cited by Engadget, against a global workforce of roughly 223,000. Eligibility covers selected employees at vice-president level and below in the United States, Canada, India and the United Kingdom, with teams working on data centres excluded. The terms are reported to resemble a standard Microsoft severance package, and the move is framed as cost-trimming and reshaping the workforce for AI while the company spends heavily on data-centre and AI infrastructure. Crucially, this is a voluntary offer, not a layoff of 60,000 people: how many accept is unknown, and an earlier, similar programme this year reportedly saw only about 30% of eligible staff sign up.

CISA confirms hackers are actively exploiting two critical PHP flaws — patch by 29 October

The US Cybersecurity and Infrastructure Security Agency (CISA) added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October 2026, confirming active exploitation. Both flaws — CVE-2026-109618, an out-of-memory corruption bug, and CVE-2026-109619, a stale internal request-state bug — are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution on affected PHP deployments. The flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October, and US federal agencies have until 29 October to patch. The risk is wide because PHP powers roughly 70% of websites, and Censys estimates cited in the report put more than 32.51 million PHP services still on an affected version.

OpenAI's GPT-6.1 Terra lands in GitHub Copilot as a cheaper everyday coding model

OpenAI launched GPT-6.1 Terra on 26 October 2026 for ChatGPT Work, Codex and its API, pitched at work involving images and computer applications at lower standard API prices than GPT-6.1 Sol — $1 per million input tokens and $5 per million output tokens. GitHub announced the same day that Terra is generally available in GitHub Copilot for Pro, Pro+, Max, Business and Enterprise users, across VS Code, Visual Studio, the Copilot CLI, cloud agent, app, web, mobile and major IDEs, with a gradual rollout. GitHub positions it for everyday agentic coding and terminal work, and says early testing found it solved noticeably more terminal and C# tasks than the GPT-5.6 Terra it replaces. Business and Enterprise administrators can control it through Copilot model policy, and under default settings new models are enabled automatically unless an admin has switched that off.

Apple gives the iPad mini its biggest update yet: OLED screen, A20 Pro chip, first water resistance

Apple announced on 26 October 2026 the biggest iPad mini update yet, bringing OLED to its smallest tablet for the first time. The new model has an 8.5-inch OLED display, the A20 Pro chip, and IP67 water and dust resistance in a 5.4 mm-thin design. Pricing starts at $699 for Wi-Fi and $849 for Wi-Fi + Cellular, in 128GB, 256GB and 512GB configurations in Midnight and Starlight finishes. Pre-orders open on Wednesday 28 October, with availability from Friday 6 November — a useful "what to do next" hook for readers, since the device itself is not yet on sale.

Nigeria to get two AI-ready data centres in a $650 million–$1 billion plan

South African infrastructure investor INFRAGORA Global Capital plans to begin construction of two AI-ready data centres in Nigeria — in Lagos and Delta State — in the second and third quarters of 2027, under its AFRIDATA platform. The project is estimated at $650 million to $1 billion, which would rank it among Nigeria's largest planned data-centre investments, and it is the flagship of a wider continental platform estimated at $3–5 billion. Financial close is still expected before construction begins, and the company has not disclosed how much funding it has secured or named its backers, though the US Trade and Development Agency is funding a feasibility study. Power is the other open question: INFRAGORA plans a 160–200 MW independent power plant, via its sister Ocha Energy platform, to supply the centres' initial 80–100 MW demand.

IBM moves to give every AI agent a verified identity it can revoke

At its TechXchange 2026 conference on 27 October, IBM announced new capabilities to govern AI agents across business systems, centred on verified identity, least-privilege access and accountability. HashiCorp Vault's Agent Identity will give each agent a governed identity — who owns it, its lifecycle status and what authority it holds — while Vault issues short-lived credentials and can revoke access in real time if an agent attempts an unauthorised action. IBM's watsonx Orchestrate adds discovery across Amazon Bedrock, Microsoft Foundry and Google Gemini, sandbox containment with a kill switch for rogue agents, and evaluation plus cost tracking before and during deployment. The pitch is aimed squarely at the governance gap IBM cites from Gartner: by 2028 the average Fortune 500 firm may run over 150,000 AI agents, yet only 13% of organisations believe they have the right agent governance in place.

Sources

• Decrypt — Anthropic IPO filing
• Reuters via SRN News — Meta equity raise
• Engadget, citing Bloomberg — Microsoft voluntary buyouts
• The Hacker News — CISA confirms active exploitation of PHP flaws
• GitHub Changelog — GPT-6.1 Terra in GitHub Copilot
• MacRumors — OLED iPad mini
• TechCabal — Nigeria AI-ready data centres
• IBM PRNewswire release — verified identity for AI agents

Tech Today — 26 October 2026

Oct 26, 2026•8 min

SpaceX borrows $40bn for GPUs — and Musk warns most neoclouds won't survive

Elon Musk said on X over the weekend that SpaceX has closed $40 billion in debt financing to buy graphics processors, mostly callable debt that can be repaid early, with the chips due in the first half of 2027. He credited SpaceX's investment-grade rating and its Starlink and launch revenue for keeping credit open. In the same posts he warned that debt markets have "almost entirely shut off" for companies without substantial revenue outside AI data centres, and predicted that more than 200 "neocloud" firms renting out GPU capacity face consolidation into a few survivors. The deal underlines how the AI build-out is now funded: firms with diverse, real revenue can still borrow tens of billions, while pure infrastructure renters face a much colder lending climate just as Microsoft, Alphabet and Amazon report earnings this week.

The Brotli flaw behind Node2Shell is far bigger than Node.js

JFrog Security Research reported on 25 October that CVE-2026-111497, first disclosed in Node.js's 21 October security release, is actually a memory-corruption bug in Google's Brotli decoder, not a Node.js or HTTP bug at all. Because so many programs reuse that decoder, the same flaw can be reached through entirely different routes: JFrog crashed ClickHouse with a single crafted 23 MB request, reached the decoder in FFmpeg through a booby-trapped JPEG XL image file, crashed .NET's native Brotli path, and sent Apache Arrow's pyarrow into an endless CPU-eating loop with a 534-byte input. The practical lesson is that checking your Node.js version is not enough — teams must trace whether any of their software decodes untrusted Brotli data, and apply each vendor's own fix, since patched releases are landing at different speeds (Microsoft began rolling out .NET updates on 25 October, while ClickHouse's fix was merged but unreleased at publication). The upstream fix is in Brotli 1.2.1, and Node.js incorporated it in versions 22.23.4, 24.22.1 and 26.12.1.

Sweden's Government Offices block ChatGPT and Claude websites on staff PCs from today

From Monday 26 October 2026, staff at Sweden's Government Offices (Regeringskansliet) — the administration behind the prime minister and cabinet — can no longer open the ChatGPT or Claude websites from their work computers. The block was first reported by Sveriges Radio's Ekot on 23 October and confirmed by the offices to SVT; the stated reason is information security, with digital director Mikael Wettercrantz warning that using AI services without an agreement can have "consequences for our information security". This is not a national ban and not a ban on the models themselves: staff keep Microsoft Copilot, whose security settings were raised after a review, and some staff still reach ChatGPT and Claude through the internal Intric assistant platform. Similar blocks already exist at the Swedish Tax Agency and the National Board of Institutional Care, making this the clearest example yet of a government steering staff toward contracted, controlled AI tools rather than public chatbots.

Nigeria: NSIA awards $275,000 to seven startups at its Prize for Innovation Demo Day

Nigeria's Sovereign Investment Authority (NSIA) announced the winners of the fourth edition of its Prize for Innovation at a Demo Day in Abuja over the weekend, with seven startups sharing a combined $275,000 in prizes. Packaged-snack maker Come Again Foods took the top prize of about $100,000, insect-farming protein startup Protein Kapital came second with $70,000, and AI teleradiology platform InstantRad — which links hospitals to radiologists across Africa — placed third with $50,000. The 12 finalists were picked from more than 6,000 applications, and the edition focused on manufacturing, climate and food security, and healthcare. The pool comprised $220,000 from NSIA, $45,000 from Cascador and $10,000 from Wema Bank. Finance Minister Taiwo Oyedele used the event to argue that Nigerian small businesses need patient capital, investor networks and institutional support — not just bank loans — if they are to grow into the medium and large firms behind Nigeria's $1 trillion economy ambition. Finalists also join a six-week programme at Lagos Business School, with eligible winners able to access up to $1.5 million in growth capital through Pula Xcelerator.

Reddit's r/opensource bans AI-built projects — and splits its own community

Moderators of r/opensource, a Reddit community with 98,000 weekly visitors, posted a policy on 24 October barring any project that "uses AI, is made by AI, or is intended for AI", alongside new minimums: a project must be actively maintained for a year, have roughly three contributors and an existing community, and posters need accounts at least a year old. The post, titled "Your tokens aren't valuable: No more AI", drew about 1,400 comments within a day and split the forum — many users cheered the end of low-effort "slop" posts, while others argued the rule, read literally, would exclude even the Linux kernel, whose own documentation requires AI-assisted contributions to be tagged. The moderators later gave a shout-out to r/TrueOpenSource, a breakaway forum started by a user the same weekend, and insisted the kernel would pass "on the subjective line". The episode shows how the AI-coding boom is now redrawing the boundaries of open-source culture itself, not just its tooling.

Nepal's government websites come back online after the PHP shutdown

More than 1,000 Nepalese government websites and online services have resumed normal operation after being taken offline last Thursday over a security flaw in PHP, Nepal's Software Development and Operation Centre said. Sites restored include those of the Prime Minister's Office, the foreign affairs and finance ministries, the customs department, transport and land revenue offices, and Nepal Rastra Bank. Agencies that could not apply the PHP security updates immediately were told to shut their sites down rather than risk attack, and restoration work continued through the Dashain holiday. Work continues on the remaining services — a reminder, days after the same PHP flaws disrupted governments elsewhere, of how much public infrastructure still runs on a single widely used web language.

Sources

• Reuters — SpaceX $40bn GPU debt
• CoinDesk — SpaceX neocloud warning
• JFrog Security Research — Brotli2Shell
• Gobi Daily — Sweden Government Offices block
• The Sun Nigeria — NSIA $275,000 prizes
• PPC Land — r/opensource AI ban
• Fiscal Nepal — Nepal sites restored

Linux News Roundup — 24 October 2026

Oct 24, 2026•6 min

It has been a bruising couple of days for the Linux world: a flagship release pushed back by a bad certificate, two critical kernel flaws made public before anyone had a patch, and a security-update pile-up big enough to fill a maintenance window on its own. There is one genuinely welcome arrival in the middle of it — a major OpenSSL release. Here is the roundup, with every item checked against its source.

Fedora 45 delayed to 3 November

Fedora 45 Final was declared NO-GO at the Go/No-Go meeting on 22 October, which pushes the release back to 3 November. It is the project's second straight miss: the earlier gate on 15 October fell over with no candidate media at all. The decisive blocker this time is a compromised eMudhra intermediate certificate that is still present in the system trust store — shipping a release that trusts a compromised certificate is not something a distribution can wave through. It is joined on the blocker list by problems with LVM autoactivation, Plasma Discover and Stratis at boot. The next gate is 29 October, so the project has one more decision point before the new date.

Two CVSS 9.0 KSMBD flaws disclosed before fixes existed

Trend Micro's Zero Day Initiative sent vulnerability reports that were meant for the kernel's private security address to public mailing lists instead, and did so on 21 October — exposing five unpatched kernel flaws in the open, with no fixes ready. The two worst hit KSMBD, the in-kernel SMB server. ZDI-CAN-33774 is a pre-authentication race condition reachable on port 445; ZDI-CAN-33549 is an integer underflow in the SMB Direct path, which needs RDMA. Each is rated CVSS 9.0. Stable kernel maintainer Greg Kroah-Hartman publicly rebuked the patch-less submissions, and as of 23 October neither flaw had a mainline fix nor a CVE identifier. If you run KSMBD, treat it as exposed until a patched kernel lands.

OpenSSL 4.1.0 arrives with DTLS 1.3 support

The OpenSSL Project shipped version 4.1.0 on 23 October, headlined by full DTLS 1.3 support (RFC 9147). That brings TLS 1.3-style handshakes to datagram traffic — the kind carried by WebRTC, VoIP and gaming — rather than only to connection-oriented streams. The release also adds GREASE protocol hardening, post-quantum cryptography performance optimisations for ML-DSA and ML-KEM, and the IKEv2 key derivation function, while staying API/ABI compatible with the 4.0 line. One caution before you rush it out: the release notes flag four known DTLS issues, so test it properly before deploying.

Debian kernel absorbs 500+ CVEs as nine distros ship security updates

Between 22 and 23 October, Debian shipped advisory DLA-4850-1 onto Bookworm, pushing kernel version 6.12.113-1~deb12u1 and carrying over 500 advisories, ranging from CVE-2026-52988 to CVE-2026-99999. Between them they cover privilege escalation, denial of service and information leaks, and the update also brings in the bug fixes from the 6.12.112 and 6.12.113 stable bumps. Debian was not alone in a heavy round: SUSE packed 237 CVEs into a single webkit2gtk3 update (SUSE-SU-2026:4858); Fedora, RHEL and Rocky each cut the compromised emSign Root CS CA G3 certificate from their trust stores; the same pair of PHP remote code execution flaws — CVE-2026-109618 and CVE-2026-109619 — turned up in Fedora, SUSE and Oracle alike; and Oracle pushed eight Critical .NET advisories. The practical takeaway: patch the trust-store cut and the .NET updates first, then clear the rest before the next maintenance window.

Sources

• XDA Developers — the eMudhra issue behind the Fedora 45 delay
• Linux Compatible — Fedora 45 Final NO-GO, delayed to 3 November
• The Hacker News — two CVSS 9.0 KSMBD RCE flaws
• GBHackers — unpatched kernel flaws disclosed, including two RCEs
• Linuxiac — OpenSSL 4.1 released with DTLS 1.3 support
• RuntimeWire — OpenSSL 4.1.0 and DTLS 1.3
• Linux Compatible — security roundup: Debian kernel pulls 500 CVEs, SUSE packs 237 into one browser library

Tech Today — 25 October 2026

Oct 25, 2026•8 min

The week's security stories keep landing: America's cyber agency has flagged two flaws that attackers are already using, while a free open-source plugin promises to patch the week's worst bugs faster. Elsewhere, an open mod squeezes new AI life out of old graphics cards, a central bank's website returns after a precautionary shutdown, and Nigeria argues Africa should pool its computing power rather than rent it forever. All verified below.

CISA flags two flaws already being exploited

The US Cybersecurity and Infrastructure Security Agency has added two critical flaws to its Known Exploited Vulnerabilities catalogue, citing active exploitation. The first, CVE-2026-110447 (CVSS 9.2), is a command-injection flaw in Collabora Online's Built-in CODE Server for Nextcloud, exploitable through proxy.php when the local document server is not running; attackers have reportedly used it to plant web shells on Nextcloud servers and hunt for credentials and crypto wallets. The second, CVE-2026-114625 (CVSS 9.9), is a SQL-injection flaw in on-premise Arista VeloCloud Orchestrator that exposes privileged internal functions to an attacker with network access and an authenticated session (Enterprise Read Only is enough). Both have fixes — Collabora's in version 26.4.303, Arista's in 5.2.3.18, 6.1.3.10 and 6.4.2.12 — and US federal civilian agencies were told to apply them by 26 October. If you run either product, this is the patch to prioritise over everything else this week.

Cognition's free plugin patches the week's worst bugs

Cognition has open-sourced Devin Vulnerability Fixes, a set of three agent skills aimed squarely at the week's worst flaws: the PHP2Shell bugs, the Node.js October security release, and a CVSS 10.0 self-managed GitLab bug (CVE-2026-110264). Each skill follows the same shape: a read-only inventory first, an approval gate before anything changes, verified patch versions, tests run before and after inside the new production image, and one pull request per repository. The skills run in Devin and in any coding agent that reads SKILL.md files, so they are usable far beyond Cognition's own product. The honest catch, stated in the coverage itself: no fix-rate benchmark is published, and results depend on the quality of each project's own tests — this is a workflow accelerator for patching, not a guarantee that a system is clean.

An open mod gives RTX 30 cards a second AI life

A Linux-based open-source project called GPU Unlock, by GitHub user Zagitta, removes a reduced instruction issue rate on FP16 and BF16 Tensor Core operations with FP32 accumulation on consumer Ampere cards. A kernel module runs before NVIDIA's driver loads, adjusts hardware speed selectors and resets the GPU, so no modified driver or permanent firmware flash is needed. Repository benchmarks cited in the coverage show large matrix-multiplication gains on an RTX 3090 Ti, with real-world image-generation and long-context prompt-processing gains reported by community testers — while token generation barely moves, because that stage is limited by memory bandwidth. The caveats matter: the tool is experimental, results are not universal across cards, gaming and DLSS gains are unproven, and it currently targets Linux. For owners of older cards running local AI work, it is a genuine second life; for gamers chasing frame rates, it is not yet a proven win.

Bangladesh Bank's site returns after its PHP shutdown

Bangladesh Bank took its official website offline on 22 October and kept it down until the morning of Sunday 25 October, while technical teams assessed two critical PHP vulnerabilities that could allow unauthenticated remote code execution. The shutdown was precautionary: the bank's spokesperson confirmed the site was closed on urgent security grounds and reopened at 8am on Sunday after a risk assessment. Several Bangladeshi commercial banks also suspended PHP-based platforms, and government institutions and digital services in France, the Netherlands and Belgium took similar steps. Not every PHP site is vulnerable — risk depends on version, patch level and server configuration — but the episode shows how a language-level flaw can take public services offline even after emergency patches exist.

Nigeria pitches shared African AI compute at BUILD 2026

Nigeria's BUILD 2026 conference in Abuja, convened by the Nigeria AI Collective under the Federal Ministry of Communications, Innovation and Digital Economy, made the case for Africa-owned AI compute. The headline proposal, reported by ThisDay and others, is for African countries to pool computing capacity — Nigeria's GPUs connected with Gates Foundation-funded capacity in Rwanda and similar capacity in Senegal and Kenya — so researchers can run large models no single country could finance alone. Communications Minister Bosun Tijani, represented at the conference, named electricity, connectivity, cloud infrastructure and advanced chips as the main obstacles, while Luminate's chief executive put Nigeria's annual cost of relying on foreign cloud infrastructure at about $850 million. The framing matters for a Nigerian audience: AI infrastructure as a sovereignty and jobs question, not just a technology one — though the reports verified here are conference discussion, not a new funding or infrastructure announcement.

Sources

• The Hacker News — CISA flags two actively exploited flaws in Collabora Online and Arista VeloCloud
• MarkTechPost — Cognition open-sources Devin Vulnerability Fixes plugin
• WCCFTech — GPU Unlock mod for RTX 30 cards · Notebookcheck — the catch
• The Business Standard — Bangladesh Bank site still offline (24 Oct) · The Business Standard — site back online (25 Oct)
• Plus234Feed — Nigeria AI Collective hosts conference on digital infrastructure · Ghanamma — Nigeria proposes shared AI computing with Rwanda, Senegal and Kenya

Tech Today — 24 October 2026

Oct 24, 2026•9 min

The big theme this week is the AI safety bill coming due: OpenAI is walling off its most powerful training runs from the live internet, Microsoft has caught state hackers using AI agents to break into cloud tenants in hours, and Britain is spending £600 million on the idea that AI's biggest threats will be biological. Elsewhere there's a critical patch to run in PHP, a bad week for Capcom accounts, good news for Nigerian founders, and the Linux kernel quietly giving up on policing AI disclosure. Here's what's verified — and what isn't.

OpenAI trains its frontier models offline

OpenAI says its most advanced models will no longer be trained on the live internet, citing significant risks. In a new security blog post, the company explains that frontier models are now trained and evaluated inside tightly controlled research environments, partly because unfinished models may not have completed safety and alignment training and are deliberately pushed through adversarial testing. It is worth being precise here: the blog post itself is about the security posture of training environments, and the framing that it follows specific incidents with internet-connected training runs comes from press coverage rather than the post itself. Either way, live-internet access is now off the table for frontier training — which suggests the company has decided the risk of a misbehaving model with a browser is no longer theoretical.

Kimi K3.1 Pro ships — and could be the best open model in two weeks

Moonshot's Kimi K3.1 Pro arrived on 23 October and went straight to fourth place on the Artificial Analysis Intelligence Index with a score of 55, behind only the newest Claude models. The gains are concentrated where it matters for builders: it leads Terminal-Bench 4.0 and jumped from 58% to 73% on AutomationBench-AA, making it a genuinely stronger agentic coder. The honest catch is that it is not open yet — the weights are promised by 4 November, and until then the model is API- and app-only. If Moonshot delivers on time, open-source developers get a frontier-class tool at roughly $2/$10 per million tokens.

AI agents are now a standard tool for state hackers

Microsoft has tied the ConnectWise supply-chain compromise — which exposed around 2,250 cloud tenants — to Storm-0940, a China-state-aligned group that has been attacking with ARTEX, an agentic AI penetration-testing framework, since September. The speed is the alarming part: Microsoft reports cases where the group went from first targeting an organisation to privileged cloud access in under three hours. This is not a one-off experiment; Microsoft describes agents being folded into existing offensive workflows, letting attackers scale operations far beyond what human operators could manage. If you run cloud infrastructure, the takeaway is blunt: defences have to assume the attacker never sleeps.

PHP2Shell: patch your PHP servers now

Two critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 — allow attackers to run code on a web server without any account. Emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) landed on 21 October, and exploit attempts were already being observed in the wild. Because the flaws live in the language runtime, even perfectly written application code won't save you, and servers running Apache's mod_php are most exposed. The PHP team's advice is simple and worth following: only updating fully protects a server.

Capcom confirms 11.77 million accounts breached

Capcom has disclosed that attackers gained unauthorised access to CAPCOM ID account records affecting 11,774,247 accounts worldwide. The exposed data is mostly email addresses plus account metadata (creation and last-login times, login counts, client IP addresses), and 196 accounts had their passwords changed without authorisation — already reset by Capcom. No credit-card data was involved, and the company says games remain playable, but it warns customers to expect phishing emails impersonating Capcom. It's the company's second major disclosure after the 2020 Ragnar Locker ransomware attack, and a reminder that game accounts are a worthwhile target.

Britain bets £600 million on AI security

The UK government has set out around £600 million (roughly $800 million) in AI security funding, with the emphasis firmly on defending against AI-enabled biological threats. The headline item is £100 million for an AI Biosecurity Lab to detect biological threats early, alongside £65 million for pathogen countermeasures — and OpenAI and Anthropic are putting up to £200 million in model credits, with Google DeepMind and Basecamp Research contributing expertise. The rest spreads across the AI Security Institute, new cyber-defence programmes for critical infrastructure, a chip-design academy, and AI policy research. Whether a lab can outpace the threats it's meant to catch is the open question; the spending signals London takes the risk seriously.

Nigeria back on top of African startup funding

Nigerian startups raised $635 million in the first nine months of 2026, up 157% on the same period last year and the strongest showing since 2022 — enough to retake Africa's top spot from Egypt. The headline is tempered by concentration: four companies — Moove, Flutterwave, Jumia and Yellow Card — account for about 69% of the total. Still, 77 Nigerian startups raised at least $100,000 each, so the pipeline below the mega-deals is real. Notably, transport and logistics drew more investment than fintech across Africa for the first time.

The Linux kernel stops policing AI disclosure

The Linux kernel has formally dropped the requirement to tag AI-assisted patches with "Assisted-by". The rule never worked as intended — only about 10% of unmerged commits for kernel 7.3 carried the tag — and after debate at October's Maintainer Summit the patch removing it was merged into mainline. What hasn't changed is the substance: AI still cannot add a Signed-off-by, and maintainers can still reject any patch the submitter can't explain. The shift is from policing whether AI was used to insisting that a human takes responsibility for whatever gets submitted — a stance Linus Torvalds has been voicing for months.

Sources

• OpenAI — Securing our frontier model training environment
• TechCrunch — OpenAI on live-internet training
• Oossa — Kimi K3.1 Pro launch
• ExplainX — Kimi K3.1 Pro benchmarks and pricing
• Microsoft Security Blog — Storm-0940 / ARTEX
• The Register — ConnectWise breach
• The Hacker News — PHP emergency patches
• Tenable — PHP2Shell FAQ
• Gaming.net — Capcom breach disclosure
• Reuters — UK AI security funding
• Business Tech Africa — Nigeria startup funding
• XenoSpectrum — kernel drops Assisted-by tag

Fact-Checked: 'Hacking' Your Own TV to Delete the Ads — the Full How-To

Oct 23, 2026•11 min

A TikTok by Zack Shutt (@zackshutt, "People Are Hacking Their Own TVs") has been spreading fast this week, and the pitch sounds like a wind-up: people are aiming AI coding tools at their own televisions and coming away with a clean, ad-free home screen. We went through the claims one by one, checked them against independent guides and industry reporting, and then wrote the whole method out properly. Here is what holds up — and the one limit the headline leaves out.

What the video claims

The recipe, as the video tells it: point an AI coding tool — Claude Code is the one on screen — at your own smart TV. The AI connects to the TV over your home Wi-Fi, removes more than 20 pre-installed junk apps most owners never asked for, and sets up a tidy home screen with no ads on it. To the video's credit, it carries its own warnings rather than selling a miracle: this is tinkerers' territory, things can break, system updates push back against the changes, and your warranty may not love any of it.

Why your TV shows ads in the first place

Once you see the margins above, the home screen stops looking like a design choice and starts looking like the product. If a manufacturer sells you the television itself at roughly break-even — or below cost — the money has to come from somewhere, and it comes from what the screen shows you afterwards: sponsored rows and promoted titles on the home screen, and data about what you watch. The hardware is the hook; the advertising is the business. That is also why these rows are baked in so stubbornly, and why a system update can quietly switch things back on: from the manufacturer's side, your debloated TV is inventory that stopped earning.

What you need

• A TV or streaming box running Android TV or Google TV. This is a hard scope limit, so it goes first: Samsung TVs run Tizen and LG TVs run webOS, and neither supports this method at all.
• A computer — or a phone — on the same Wi-Fi network as the TV. It runs one tool, ADB, and sends the commands.
• Optionally, an AI coding tool to drive the session the way the video shows. Claude Code requires a paid Claude plan — the free plan does not include it. But the AI is optional: every step below works by hand with plain ADB, and doing it manually means you see every change before it happens.

The how-to

The tool underneath everything is ADB (Android Debug Bridge), Google's own command-line bridge to Android devices. Nothing here roots the TV, unlocks a bootloader, or flashes anything — you are using the front door Android leaves open for developers, which is exactly why the changes are reversible.

Step 1 — Unlock Developer options on the TV

On the TV, open Settings → System → About and tap Build seven times. The TV will count you down and then confirm developer mode is on. A new Developer options entry appears in the settings.

Step 2 — Turn on debugging, and find the TV's IP address

Open Developer options and switch on debugging: on older TVs it is labelled USB debugging or Network debugging; on Android 11 and newer you will use Wireless debugging instead. Then find the TV's address on your network under Settings → Network — write the IP down, because every connection command below needs it.

Step 3 — Install ADB

Pick your route — you only need one of these:

# Debian / Ubuntu
sudo apt install adb

# macOS (Homebrew)
brew install android-platform-tools

pkg install android-tools

Step 4 — Connect to the TV

The commands are identical in Bash, PowerShell and Termux — only how you got ADB differs. Older TVs with network debugging connect directly on port 5555. Newer TVs using wireless debugging pair first: on the TV, choose "Pair device with pairing code", and use the two ports the TV shows you.

# older TVs — network debugging
adb connect TV-IP:5555

# newer TVs — wireless debugging (ports shown on the TV)
adb pair TV-IP:PAIRING-PORT
adb connect TV-IP:CONNECT-PORT

# confirm the TV is connected
adb devices

Whichever route you took, the TV will ask "Allow USB debugging?" — accept it on the TV screen. If adb devices lists your TV, you are in.

Step 5 — Back up first, change nothing yet

Before disabling a single thing, save a full inventory of the TV as it is right now:

adb shell pm list packages > packages.txt
adb shell getprop > getprop.txt

Then start a restore list — a simple note where every package you later disable gets written down, in the order you disabled it. If anything misbehaves, that list is your way back, package by package.

Step 6 — Sort the packages before touching anything

Work through the package list and sort everything into four groups first: ads and sponsored content, tracking and analytics, preinstalled extras you never use, and core system packages the TV needs to function. The first three groups are candidates; the fourth is untouchable. If an AI agent is helping you, give it the working rules in your own words before it runs anything: back up first; only ever disable, never uninstall; group the packages and wait for your approval; work in small batches.

Step 7 — Disable in small batches

Disable a few packages at a time — ten at most — then reboot the TV and test the remote, the inputs and your usual apps before continuing. Disabling (not uninstalling) is the whole safety model: the app stays on the TV, switched off, and can be switched back on in one command.

# disable one package
adb shell pm disable-user --user 0 PACKAGE.NAME

# bring it back
adb shell pm enable PACKAGE.NAME

Step 8 — The never-disable list

Some packages are load-bearing. Never disable: System UI and Settings, TV inputs and HDMI switching, Bluetooth and remote pairing, the package installer and the Play Store, Play Services — and the current launcher, until a replacement is installed and working (that is the next step). And stay on this path entirely: no root, no bootloader unlock, no flashing. That route can drop the TV's Widevine DRM from L1 to L3, which cuts Netflix and friends down to SD quality — a permanent downgrade in exchange for nothing this guide needs.

Step 9 — Replace the home screen

Install Projectivy Launcher — free, on the Play Store, and ad-free — or FLauncher, and set it as the default home screen. Live with it for a while first. Only once the replacement is working should you even consider disabling the stock launcher, and treat that step as delicate: if the TV ever loses its home screen, a restart usually restores it.

Step 10 (optional) — Turn the tracking down further with Private DNS

One more lever lives in Android's settings. Pointing the TV at a filtering DNS resolver blocks many tracking and ad domains before anything loads:

adb shell settings put global private_dns_mode hostname
adb shell settings put global private_dns_specifier dns.adguard-dns.com

The honest limit, again: this blocks a lot of phoning-home and domain-level ads, but it cannot remove ads that are served from inside a streaming video — those travel with the picture itself.

Undoing everything

Nothing in this guide is one-way. Re-enable any package with pm enable (your restore list from Step 5 tells you which ones), re-enable apps from Settings → Apps on the TV, or factory-reset the TV and every change is gone at once. One last housekeeping step, and it matters: when you are finished, go back into Developer options and turn debugging off, so nothing else on your network can connect to the TV the way you just did.

Sources

• The original TikTok — Zack Shutt, "People Are Hacking Their Own TVs" ↗
• CleanYourTV — the write-up behind the open-source project ↗
• Step-by-step guide to removing Android TV bloatware with Claude Code ↗
• The open TV cleanup prompt project ↗
• Omdia, via FlatpanelsHD — TV makers selling sets below cost ↗
• XDA — replacing the Google TV home screen with Projectivy Launcher ↗

All claims above were checked on 23 Oct 2026.

I published my first web app with ads — what I learned in a day

Oct 23, 2026•5 min

This site started as a poster: 60 C++ project ideas. This week it became a real web app — every project with a full lecture, run commands and a watch-it-run demo — and it went live on my own GitHub Pages address with ads approved on it. Here is what day one of that actually taught me. No earnings numbers, no traffic screenshots: on day one there is nothing honest to report there yet, and anyone who shows you day-one revenue is selling you something.

Lesson 1: the content is the product

A list of project titles is a screenshot, not a site. The catalogue only became worth visiting when each project turned into a lesson: what to build first, why, the mistakes to dodge, and a recording of the finished program running. Depth is what makes a stranger stay past ten seconds. Whatever you are building, ask what the visitor can do on the page that they could not do from a screenshot of it.

Lesson 2: ad networks care whose address it is

My first attempt to register the app for ads failed for a reason that had nothing to do with the app: I tried to register an address on a domain that belongs to someone else. Ad networks verify ownership. Moving the app to my own GitHub Pages address — an address I actually control — fixed it, and both ad units were approved after review. The general lesson travels well: own the address your work lives at. Platforms lend you reach; they do not lend you ownership.

Lesson 3: shipping beats polishing, because real use finds real bugs

Within hours of the lecture upgrade, the level filter tabs were showing "no projects match" on every tab — a one-word mismatch between the filter and the data that no amount of staring at the code had caught. It got found because the site was live and being tapped on a real phone. It got fixed the same day. A perfect private draft teaches you nothing; a live page with one bug teaches you where your testing is blind.

Lesson 4: promotion is half the work, and it is a different muscle

Nobody arrives by accident on day one. The launch meant writing a different post for every platform — a story post for LinkedIn, a technical one for developer communities, a short video walking through a lecture for TikTok — because each audience punishes a different kind of laziness. Building the thing and telling people about the thing are two separate jobs, and the second one does not do itself.

What I am not claiming

Day one proves the pipeline works: a visitor can arrive, learn something real, and the page can earn. It does not prove anyone will come, stay, or click. The metric I am watching first is embarrassingly simple: does a visitor stay for one whole lecture? Everything else is downstream of that.

If you ship something this week

• Put it on an address you own — your own domain or your own GitHub Pages.
• Make one page genuinely useful before you make ten pages.
• Ship it slightly embarrassing rather than perfectly private.
• Tell people about it in posts written for each platform, not one blast everywhere.
• Fix the first real bug a real user finds before adding any new feature.

Project lists don't teach you to code — lectures do

Oct 22, 2026•5 min

You have seen the lists. "60 project ideas to learn C++." "100 Python projects for your portfolio." You screenshot it, save it, feel productive — and build nothing. I know, because the catalogue on this site started as exactly one of those posters, and the longer I looked at it the clearer the problem became: a list tells you what to build and nothing about how. That missing "how" is where beginners actually quit.

A list is a map, not a road

A map of a city shows you every destination at once. It does not teach you to drive. A project list works the same way: "Chat Server" sits there looking just as approachable as "Calculator", and the beginner who starts with the chat server — because it sounds cooler — drowns in sockets and threads before they have written a single function that returns a value. The list was never wrong. It just was not a route.

Reading code is not writing code

The second trap is subtler. Many lists link to finished code, and reading finished code feels like learning. It is not. Reading is recognition; programming is recall under pressure. The starter code for the Calculator looks obvious line by line — of course you guard division by zero, of course the menu loops. Then you face a blank file and discover you do not know what to write first. That ordering — data first, the one hard function next, plumbing last — is the actual skill, and it is exactly what a list leaves out.

What a lecture actually gives you

A lecture is the route, written down. For every project on this site it answers three questions a list cannot. First: in what order do I write this? The steps go in build order, so you are never staring at the whole problem at once. Second: why this shape? Why does the calculator's maths live in one function that reports success separately? Because a number alone cannot say "that was invalid" — and once you understand that, you will reuse the pattern forever. Third: where will I get stuck? Every lecture ends with the common mistakes on that exact project. Debugging is where most learning time goes, and knowing the three usual traps in advance turns a two-hour stall into a two-minute fix.

See the finished thing before you build it

Each project here also has a "Watch it run" player — a recorded session of the finished program. That is not decoration. It is a specification you can test against. When your version prints something different, you have a concrete bug to hunt instead of a vague feeling. Professional developers work from specs and expected outputs every day; a learner deserves the same target.

The loop that works

• Watch the run first. Know exactly what the finished program does before writing a line.
• Read the lecture without typing. Understand the order and the reasons.
• Close it and build from the feature checklist. Struggle a little — that struggle is the learning.
• Stuck for 20 minutes? Re-open the exact step you are on, not the whole solution.
• Finish, then do one extension. The extension is where the project becomes yours.

Lists are fine as menus. Just do not mistake the menu for the meal — pick one project, take the lecture, and build the thing.

How to read a GitHub repo before you clone it

Oct 20, 2026•5 min

Every week another list goes viral: "10 GitHub repos so good they should not be free." The repos are usually real and often genuinely good. What the lists never mention is that cloning is the cheapest step. The costs arrive after: an install that assumes tools you do not have, a project abandoned two years ago, and — the classic — a "free" tool that only works once you feed it a paid API key. Here is the two-minute read that separates a good evening from a wasted one.

The README is the shop window

A healthy repo explains itself in the first screen: what it does in one or two lines, who it is for, and how to install it. Look for install steps that are actually written down, a screenshot or demo, and requirements listed up front (Python version, Docker, Node). If the README cannot say what the thing is for, the code will not be clearer. Vague README, vague project — walk away early and cheaply.

Check the pulse

Look at the date of the last commit and the state of the issues tab. Recent commits and answered issues mean a living project. Silence for two years does not automatically mean bad — some tools are simply finished — but it changes what you are signing up for: every problem you hit, you will solve alone. A wall of unanswered "doesn't work on Windows" issues is information. Read it before it becomes your evening.

The licence is not fine print

Planning to use the code in anything real? The licence decides what you may do. MIT and Apache-2.0 mean: use it, even commercially, with attribution. GPL means your derivative work inherits obligations. And the trap most people miss: no licence file means all rights reserved by default — you may read the code, but you have no legal right to reuse it. Thirty seconds in the licence file beats a takedown later.

The catch nobody prints in the title: running costs

"Free" describes the download. Running the thing is a separate question, and for AI tools it is usually answered in one file: .env.example. Every key listed there is a signup at best and a metered bill at worst. A chat interface is free; the model behind it charges per token. A trading agent is free; the LLM that does its thinking is not. Before you fall in love with any repo, open that file and count the keys. The Repo Spotlights section on this site states the running cost for every tool up front, for exactly this reason.

The two-minute repo check

• One-line description I actually understand?
• Install steps written down, five steps or fewer?
• Requirements listed (Docker? Python version? GPU?)
• Licence file present — and which one?
• A commit within the last year? Issues answered?
• .env.example — how many keys, and which of them are paid?

# a shallow clone is faster and plenty for trying a tool out
git clone --depth 1 <repo-url>

# read the cost before you install anything
cat .env.example

Two minutes of reading, one honest decision. That is the whole skill — and it compounds across every tool you will ever try.

Your first bug bounty roadmap: recon before exploits

Oct 18, 2026•6 min

Ask a new bug bounty hunter what they did today and you will hear about a tool with a scary name. Ask a hunter who actually gets paid and you will hear about lists: subdomains, live hosts, technologies, notes. The difference is not talent. It is order. You cannot find a bug in a system you have not mapped, and most of a target's attack surface is invisible until reconnaissance draws the map. This is the beginner version of that workflow — the same tools, in the same order, that the Repo and Linux sections of this site keep coming back to.

The rule that comes before every tool

Only test inside an authorised programme, against assets in its published scope. A bug bounty programme's scope page is your permission slip; anything outside it is off-limits no matter how curious you are — and "I was only scanning" is not a defence. Recon feels passive, but it is still testing. Stay in scope, respect rate limits, and use your own test accounts.

Step 1 — find the subdomains

Companies forget their own subdomains: staging servers, old APIs, a dev portal someone stood up in 2022. Subdomain enumeration collects them from public sources. subfinder is the standard starting point because it is fast and passive — it queries public datasets rather than hammering the target.

subfinder -d example.com -silent -o subs.txt

The Sandbox on this site has a simulated run of exactly this workflow if you want to see the shape of the output first.

Step 2 — see what is actually alive

A list of names is not a list of targets. Most subdomains are dead, parked, or pointing at nothing. httpx probes each one and reports which respond, with the details a hunter triages by: status code, page title, and the technology serving it.

httpx -l subs.txt -status-code -title -tech-detect -o live.txt

Now the map has shape. A staging host answering 200, an API returning 401, an admin panel with a login page — each one suggests a different next question.

Step 3 — let templates do the boring checks

nuclei runs thousands of community-written checks — exposed config files, known misconfigurations, outdated software with known issues — against your live list. It is loud, broad, and deliberately unglamorous.

nuclei -l live.txt -severity medium,high,critical

Step 4 — verify by hand, because a hit is not a bug

This is the step beginners skip and professionals live in. A scanner hit is a lead, not a vulnerability. Programmes reject — and hunters lose credibility — for pasting raw scanner output into reports. Reproduce the finding manually, understand what an attacker could actually do with it, and write it up in plain language with steps a tired triager can follow. That write-up is the product. The tools just find the raw material.

Before you scan anything

• The asset is inside a published programme scope — in writing.
• Rate limits respected; no aggressive settings against shared infrastructure.
• Testing from accounts you own, with your researcher header/username where the programme asks for one.
• A notes file is open — recon you cannot find later did not happen.

Recon before exploits is slower for exactly one day. After that it is faster forever, because you stop guessing where the bugs could possibly live.

AI agents explained with tools you already know

Oct 15, 2026•5 min

"Agent" is the most abused word in AI right now, so let us build one from parts you already understand. No hype, no robots. By the end you will be able to look at any agent tool — including the ones in this site's Repo Spotlights — and name its moving parts.

Start with a chatbot, then give it a job

A plain chatbot is a language model in a box: text in, text out. It can describe how to check your server's disk space, but it cannot check. An agent is what you get when you take that same model and wrap it in a loop with tools: it decides what to do, calls a tool, reads the result, and decides the next step — repeating until the job is done or it is stuck. That loop is the entire invention. Everything else is packaging.

The four parts

• The model — the brain. It reads the goal and the story so far, and writes the next action in words. It does not execute anything itself.
• The tools — the hands. Ordinary functions the model is allowed to call: read a file, run a shell command, fetch a web page, query a database. If you have ever written a script, you have written an agent tool.
• The loop — the manager. Run tool, show the model the output, ask "what next?", repeat. A capable agent is mostly a well-built loop with good guardrails.
• Memory — the notebook. The conversation itself, plus notes the agent writes to files so a long job survives its own context limit.

The analogy that keeps you honest

An agent is a very fast junior colleague with a terminal, a notebook, and total confidence. They will do in four minutes what takes you an hour. They will also, occasionally, run the wrong command with complete certainty and report success. You would not give a new hire your production passwords on day one and leave the room — the same supervision logic applies here, unchanged.

The honest limits

Three limits survive every demo video. Cost: every loop step is model calls, so a wandering agent is a meter running — a research agent like Vibe-Trading spends your tokens on every iteration of its thinking. Judgement: the model pattern-matches plausibility; it does not understand your business, your risk, or why that one server must never be touched. Blast radius: an agent can only break what its tools can reach, which means permissions are not a detail — they are the whole safety story. This is why the security lab in the Linux section matters: an agent inside a disposable VM with a snapshot is a tool; an agent on your real machine with sudo is a liability.

Before you let an agent loose

• Smallest permissions that could work — read-only before read-write.
• Run it in a sandbox or VM you can snapshot and throw away.
• Set a spend budget on the API key before the first run.
• Read its plan before it executes commands, not after.
• Keep the logs. When it surprises you, the log is how you learn why.

None of this makes agents less impressive. A model, a loop, and honest tools genuinely can install software, research a market, or audit an ad account. It just means the impressive part is engineering you can inspect — and now you know what to inspect.

Linux is not hard: it's just honest

Oct 12, 2026•4 min

Every year, new developers bounce off Linux with the same complaint: it is unforgiving. Commands fail with terse messages, nothing is where they expect, and the terminal looks like a step backwards from the friendly desktop they left. A year later, the same people refuse to work anywhere else. What changes is not the operating system. It is the realisation that Linux was never being difficult — it was being honest, and honesty feels harsh only when you are used to being managed.

Errors that tell the truth

When something breaks on a consumer system, you often get a shrug: "Something went wrong." Linux answers with specifics. Permission denied means a permission, on a named file, for a named reason — and once you learn to read it literally, it is not an insult, it is a diagnosis. The system assumes you are capable of understanding it. Most of learning Linux is discovering that the error messages were instructions all along.

Everything is a file, and the files are text

Underneath the desktop, Linux is text files all the way down: configuration is text you can open, read, copy before changing, and diff after. There is no registry maze and very little hidden state. That one design choice explains the whole culture — servers are configured by editing files, so everything about a machine is inspectable and reproducible. If you can read, you can administer a Linux box. That is not a slogan; it is the architecture.

The terminal is the shortest path, not a punishment

A graphical interface is a menu of actions somebody else decided you might want. The terminal is the machine's native language: small tools, each doing one thing, chained together on the spot. The command grep "error" app.log is not an incantation — it is a sentence: search, this word, in this file. Fifteen commands like it (there is a full list in the Linux section) cover most of what anyone does daily. Developers and security people live in the terminal for the same reason chefs live at the stove: it is where the work actually happens, unmediated.

You are allowed to break it — that is the point

The real beginner tax is fear: one wrong move on your only computer and the machine is broken. Virtual machines delete that fear. Install Linux in VirtualBox, take a snapshot, and breaking the system becomes a five-minute detour instead of a disaster — there is a full walkthrough in the Linux & Security section. Security professionals are not braver than you; they just practise in labs built to be destroyed. Honesty plus a snapshot is a playground, and playgrounds are where people actually learn.

First-week habits

• Type commands yourself instead of pasting blindly — your fingers learn the patterns.
• Read every error message twice, literally, before searching anything.
• man <command> before a search engine — the manual is already on the machine.
• Snapshot the VM before any experiment you cannot describe in one sentence.
• Keep a notes file of commands that worked. In six months it is a personal textbook.