Calls, puts & mise en place

Appel & Mise

Vol. IThursday, September 10, 2026 · 70° & overcast on the UWSThe daily, for Jeremy Ettlinger

BTC$77,944-1.3%ETH$2,467-1.0%S&P 5007,636.36+0.1%

The lede

WeWorm, a zero-click WeChat worm that AI mostly wrote

Calif Research

Calif's team found a memory-corruption bug in WeChat's VoIP stack and had a working remote-code-execution exploit about two days later, then a self-propagating worm a week after that — a target the size of a billion accounts, compromised by a call the victim never has to answer. The line to sit with is their own account of the division of labor: the humans supplied judgment about what to target and how to test it safely, and AI did the rest. Tencent patched it on August 21 and this went public on the 8th, so the news is not the hole but the schedule.

AI & Agents

Simon Willison

On the Navier–Stokes Millennium Prize Problem

Here is the concrete incident that the abstract worry about research secrecy was built on: Tristan Buckmaster and Levent Alpöge spent roughly a year on the problem using Claude and GPT models, reached their breakthrough on August 15, and OpenAI — having caught the rumor — finished its own version on September 5 and announced first. The detail worth flinching at is OpenAI's own hedge that it cannot rule out de-identified data from that work having improved its models, which is the training-data question everyone waves off right up until it is their year in the corpus.

Engineering & Leadership

Vaidehi Joshi, LeadDev · made the Sunday

Returning to the IC track in the age of AI

A third of the engineering leaders in LeadDev's own survey say they are considering a move back to individual contributor work, and Joshi's case for it is less romantic than missing the keyboard — the manager role has been compressed and redefined faster than anyone bothered to rewrite the job description. The market half of the argument is the useful half: orgs are flattening management layers while bidding up ICs who pair real technical judgment with AI fluency, which is a signal about where leverage is moving rather than a confession about what anyone enjoys.

Web & Product Craft

Cloudflare · made the Sunday

How we rebuilt Cloudflare Workers' module registry for Node.js compatibility

The old registry resolved import specifiers as filesystem paths rather than URLs, which is why `import.meta.url` never worked cleanly and `node:` protocol imports were awkward, and it compiled the whole bundle upfront in every isolate. The rewrite in workerd makes resolution URL-compliant, compiles modules lazily on first import, and shares compiled modules across isolates — and the visible payoff is a 64 MiB limit on every plan with the compressed-bundle ceiling gone entirely. If you have ever fought a bundler to get a fat npm dependency onto Workers, that ceiling is the sentence that matters.

New York & the Table

West Side Rag

Openings & Closings: Brasserie Boulud, Szechuan Gourmet, Velvet Cowboy

Boulud is folding Boulud Sud, Bar Boulud and Epicerie Boulud into one 10,000-square-foot brasserie at 1900 Broadway on September 17, two floors by Rockwell with a pre-theater menu and a very large central bar — a consolidation dressed as an opening, and the closest thing the neighborhood has to an event restaurant. Further uptown the ledger is less cheerful: Purple Waves has gone dark on 110th, Szechuan Gourmet is taking the old Szechuan Garden space on 105th, and a Wild West bar is moving into the former Jacob's Pickles.

Diversions

Isaiah Colbert and Chris Person, Aftermath

Science Saru's The Ghost in the Shell exceeded our expectations

Ten episodes adapting Shirow's manga rather than reinterpreting it the way Oshii's film did, which means the weird lumps survive intact and the technology stays pointedly analog. Colbert and Person single out episode nine, the Major's encounter with the Puppet Master, and Bahi JD's action work; it is all on Prime Video, so the barrier to finding out is a remote.

Loose Change

industrystandard.tools

Industry Standard Tools

A register of the one product that quietly became the default in each trade — not the best, not the most sold, the one nearly everyone in that line of work already owns and assumes you own too. It runs on one member one vote, entries sit under review until they reach a score of ten and graduate to Recognized Standard, and the founders' own seed entries have to earn recognition on the same terms as everyone else's. No sponsorship, no affiliate links, which for a list of products is the whole trick.

The Back Page

Jacob Steinberg, The Guardian

Cole Palmer powers Chelsea to comeback win over Leeds in nine-goal epic

Nine changes, 2-0 down, a 16-year-old debutant overrun in midfield, a quadruple substitution at half-time and then four goals in twelve minutes on the way to 6-3. Alonso took the blame for the rotation and the credit for the fixes, which is roughly the correct split; Chelsea have now scored sixteen in his first five games and conceded ten, and nobody watching that has any idea which number is the real one yet.

Around town

Through Sun Sep 13

Late Fame

Film Forum, 209 W Houston St, West Village

Willem Dafoe as a postal worker whose 1970s downtown poetry gets rediscovered by twenty-somethings who form an Enthusiasm Society around him. Kent Jones directs, and it leaves this weekend.

casual

Mon Sep 14 · 6:00pm

LeadDev Meetup

620 8th Ave, Midtown West

The room where engineering managers talk about the job rather than the tooling, which is the rarer conversation right now. Free evening, walkable from the Times Square trains.

professional

Tue Sep 15 · 7:30pm

The Incident

Film Forum, 209 W Houston St, West Village

A 1967 thriller shot partly with hidden cameras in real subway stations, with Martin Sheen and Tony Musante both making their debuts as the two men terrorizing a late-night Bronx express. Worth it for the location footage alone.

casual

Wed Sep 16 · 9:00am

UN Blockchain Week

Times Square

The institutional end of crypto talking to the multilateral end, which is a conversation his day job sits inside whether or not he attends. A day pass rather than an evening, so budget accordingly.

professional

Wed Sep 16 · 6:00pm

Postgres Tuning in the Age of AI: Context Is Everything

7 W 34th St, Midtown

A database talk premised on the idea that the hard part of tuning is now handing a model the right context, not knowing the knobs. Narrow enough that the people who show up will actually have run the query.

professional

Quote of the day

“A crazy nuts game.”

— Daniel Farke, after Leeds lost 6-3 at Stamford Bridge

On this day

1846: Elias Howe patents the lockstitch sewing machine, the machine that turned tailoring from a trade you learned into an industry you clocked into.

The puzzle corner

The Mini · Wordle · Connections

Two stories today about work getting done in days that used to take months, and neither of them is a product announcement.