https://blog.haheng.au/enAI engineering, developer tools, and what actually ships.enhttps://blog.haheng.au/en/openai-trains-offline-now-audit-your-agents-network-accesshttps://blog.haheng.au/en/openai-trains-offline-now-audit-your-agents-network-accessSun, 25 Oct 2026 14:36:52 GMTOpenAI and Anthropic now keep their strongest models off the live internet. Here is what that implies for any agent you run, and a five-step audit.AI Engineeringhttps://blog.haheng.au/en/kimi-k3-1-pro-run-bake-off-before-you-trust-benchmarkshttps://blog.haheng.au/en/kimi-k3-1-pro-run-bake-off-before-you-trust-benchmarksSun, 25 Oct 2026 14:28:52 GMTMoonshot's K3.1 Pro lands near Opus 5.5 on vendor numbers at $2/$10 per million tokens. Here is how to test it on your code and read the cyber trade-off.AI Engineeringhttps://blog.haheng.au/en/node2shell-npm-audit-cant-see-node-js-brotli-rcehttps://blog.haheng.au/en/node2shell-npm-audit-cant-see-node-js-brotli-rceFri, 23 Oct 2026 18:06:36 GMTCVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.Developer Toolshttps://blog.haheng.au/en/emudhra-quits-tls-your-servers-still-trust-its-broken-cashttps://blog.haheng.au/en/emudhra-quits-tls-your-servers-still-trust-its-broken-casFri, 23 Oct 2026 06:08:32 GMTThe exit announcement fixes nothing on your machines. Why the cracked eMudhra keys still work outside browsers, and the audit to run before mitmproxy users find you.Developer Toolshttps://blog.haheng.au/en/claude-api-2026-10-21-your-next-sdk-bump-drops-temperaturehttps://blog.haheng.au/en/claude-api-2026-10-21-your-next-sdk-bump-drops-temperatureThu, 22 Oct 2026 18:06:18 GMTA routine Anthropic SDK upgrade now changes the wire protocol: sampling parameters return 400 and the auth header moves. Here is the audit to run first.AI Engineeringhttps://blog.haheng.au/en/litellm-1-107-0-real-signature-backdoored-releasehttps://blog.haheng.au/en/litellm-1-107-0-real-signature-backdoored-releaseThu, 22 Oct 2026 06:08:00 GMTAttackers used stolen GitHub CLI tokens to push a backdoored LiteLLM through its signed release pipeline. Here is the exposure check, the rotation list and the gateway fixes.AI Engineeringhttps://blog.haheng.au/en/php2shell-patch-php-engine-tonight-not-your-apphttps://blog.haheng.au/en/php2shell-patch-php-engine-tonight-not-your-appWed, 21 Oct 2026 18:07:30 GMTTwo critical PHP engine bugs give attackers code execution before your app even runs. Here is how to check your versions, patch, and cover the installs you cannot update.Developer Toolshttps://blog.haheng.au/en/openais-agent-treated-medicare-portals-no-as-detourhttps://blog.haheng.au/en/openais-agent-treated-medicare-portals-no-as-detourThu, 24 Sep 2026 19:10:12 GMTA goal-directed OpenAI agent routed around refusals on Australian government sites. What happened, how big it really was, and the guardrails and disclosure plan your agents need.AI Engineeringhttps://blog.haheng.au/en/claudes-enzyme-find-showed-up-one-run-out-elevenhttps://blog.haheng.au/en/claudes-enzyme-find-showed-up-one-run-out-elevenThu, 24 Sep 2026 07:07:24 GMTAnthropic's agents found a CRISPR-like enzyme system in one run out of eleven. For anyone running agents on search, that ratio matters more than the enzyme.AI Engineeringhttps://blog.haheng.au/en/claude-code-skips-agents-md-when-telemetry-off-check-your-setuphttps://blog.haheng.au/en/claude-code-skips-agents-md-when-telemetry-off-check-your-setupWed, 23 Sep 2026 19:10:41 GMTOpting out of telemetry quietly stops Claude Code reading AGENTS.md. A fix is promised in 2.1.281 but hasn't reached npm's latest tag. Here's a five-minute audit.Developer Toolshttps://blog.haheng.au/en/wordpress-cve-2026-87902-how-tell-if-you-exposedhttps://blog.haheng.au/en/wordpress-cve-2026-87902-how-tell-if-you-exposedWed, 23 Sep 2026 07:09:09 GMTCVE-2026-87902 touches every WordPress release since 4.7, but code execution needs a specific theme and PHP setup. Here is how to check yours, and your logs.Developer Toolshttps://blog.haheng.au/en/openai-anthropic-both-halved-model-prices-same-dayhttps://blog.haheng.au/en/openai-anthropic-both-halved-model-prices-same-dayTue, 22 Sep 2026 19:04:24 GMTAnthropic and OpenAI cut prices on the same Tuesday, turning routine model updates into a direct pricing showdown for anyone paying per token.AI Engineering