1140
News & links about Python programming. https://pythonhub.dev/ Administrator: @rukeba
How I Found a $90,000 Remote Code Execution Vulnerability in Google
A leaked Flask session signing secret let an attacker forge session cookies containing malicious pickled data, turning OAuth state handling into unauthenticated remote code execution on several Google developer sites. The writeup shows how combiningpicklewith client-controlled session data can turn a secret leak into code execution, and why untrusted data should never cross a pickle dese...
https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce
BOOTH
A lightweight, zero-dependency Python checkpoint layer for structured LLM output reliability.
https://github.com/Vedantgitbot/booth
Python Hub Weekly Digest for 2026-10-25
https://pythonhub.dev/digest/2026-10-25/
loopinfo: let your for loop know if it is on the first or last item
Python loops do not know where they are. loopinfo adds loop.first, loop.last, loop.index, loop.count, previous, next and more.
https://pypi.org/project/loopinfo/
Building a small Django app with help from AI
This tutorial demonstrates how to build a basic Django idea-voting application using AI as an interactive assistant rather than an autonomous developer. It emphasizes using targeted prompts to generate boilerplate, explain error messages, write tests, and catch edge cases like database race conditions while keeping architectural decisions in the developer’s hands.
https://codewithstein.com/building-a-small-django-app-with-help-from-ai/
Lifeguard
Lifeguard is a static analyzer to detect Lazy Imports incompatibilities and ease the adoption overhead for Lazy Imports in Python.
https://github.com/Facebook/lifeguard
LongLive
Long video generation and world-action modeling research from NVIDIA. Each project has its own directory, code, documentation and model weights.
https://github.com/NVlabs/LongLive
why .parquet dominates modern data engineering
This video explains why the Parquet file format has become a dominant standard in modern data engineering by using columnar storage to improve speed and reduce file size compared to traditional CSV formats. It details key technical features like compression, encoding, and predicate pushdown that allow for significantly more efficient data retrieval and storage for large-scale analysis.
https://www.youtube.com/watch?v=6Qkzfwk0W58
A Clean Way to Implement Undo in Python
This video explains how to implement the Memento design pattern in Python to handle state restoration and undo functionality without breaking encapsulation. It demonstrates a clean, modern approach using frozen data classes, protocols, and generics to manage state snapshots independently of application logic.
https://www.youtube.com/watch?v=ZXAt8AP3DnY
Python 3.14 vs Python 3.15 – performance testing
Performance benchmarks on AMD and Intel systems reveal that Python 3.15 is overall ~1.45× faster than Python 3.14. While massive speedups in Base32, Ascii85, and Base85 C-rewrite encoding operations heavily skew the average, most other workloads show a more modest performance improvement of around 1.20×.
https://en.lewoniewski.info/2026/python-3-14-vs-python-3-15-performance-testing/
whatsnewt
Python core developer Barry Warsaw text adventure game to test your knowledge of Python 3.15 by solving puzzles.
https://pypi.org/project/whatsnewt/
Automating Django deployments with Deployer
The article demonstrates how to implement a multi-lift scheduling algorithm in Python using LOOK to serve requests in the current direction before reversing. It then explores multi-lift optimization by separating responsibilities between a Dispatcher and a LiftController state machine, with requests assigned using weighted cost functions.
https://codewithstein.com/automating-django-deployments-with-deployer/
google / artemis
ARTEMIS turns natural-language instructions into reliable Android automation. It automates end-to-end workflows, captures logs, and integrates seamlessly with AI coding assistants such as Antigravity, Codex, and Claude Code. It also achieves 99%+ success rate on AndroidWorld Benchmark.
https://github.com/google/artemis
security-suite
Open-source security suite for OSINT, web scanning, API testing, SIEM integration, and AI-powered analysis.
https://github.com/TheSecuredAnalyst/security-suite
Python 3.15 for Data Scientists: Lazy Imports, frozendict, and Tachyon
Python 3.15 adds lazy imports, a built-in frozendict, and the Tachyon profiler. Learn how data scientists can use each, with before-and-after code.
https://codecut.ai/python-3-15-features-data-scientists/
Python 3.15's best new features
Trey Hunner's opinion on which Python 3.15 features will be most exciting for the average Python user.
https://www.pythonmorsels.com/python315/
Python vs Go: A Practical Comparison for Developers
Python offers a huge ecosystem, especially for AI, data, and scripting, while Go trades some flexibility for faster execution, simpler deployment, and built-in concurrency. This post compares where each language fits best today, including performance, typing, tooling, developer adoption, and why many teams end up using both rather than choosing one outright.
https://blog.jetbrains.com/go/2026/10/13/python-vs-go/
Quicksand
Quicksand is an async Python API for launching, controlling, snapshotting, and rolling back QEMU virtual machines to provide isolated sandboxes for AI agents without requiring Docker or root privileges.
https://github.com/microsoft/quicksand
Speculative Decoding: The Art of Guessing Well
Speculative decoding lets smaller models guess several tokens ahead while the larger model verifies them in parallel, reducing LLM inference latency without changing the final sampling distribution. From the acceptance math to Gumbel coupling, EAGLE-3, and multi-token prediction, the piece shows how increasingly sophisticated drafters make those guesses accurate enough to deliver real sp...
https://astralord.github.io/posts/speculative-decoding-the-art-of-guessing-well/
python-date-parser
A Rust-backed Python library for fast fuzzy parsing of heterogeneous date strings, with bulk-list and Polars APIs that avoid Python-level iteration and can outperform pure-Python alternatives by orders of magnitude.
https://github.com/SEIU-Tech/python-date-parser
CacheCanary
CacheCanary is a Python CLI and GitHub Action that detects why Claude prompt caching silently stops working on Amazon Bedrock, checks saved requests in CI, and analyzes Bedrock logs to show cache hit rates and the cost of misses.
https://github.com/Haarris/cachecanary
fastapi-stream-lease
Distributed stream and SSE concurrency lease manager for FastAPI and Starlette backed by atomic Redis Lua scripts.
https://github.com/agustin18/fastapi-stream-lease
Parsing JSON at tens of gigabytes per second… in Python
Free-threaded Python 3.14 can push JSON parsing into the tens of gigabytes per second when fastsimdjson spreads work across many cores and avoids eagerly materializing Python objects. On a 64-core machine, Lemire reports throughput around 66 GB/s, showing how dramatically multithreaded parsing can scale when Python’s GIL is no longer the limiting factor.
https://lemire.me/blog/2026/10/12/parsing-json-at-tens-of-gigabytes-per-second-in-python/
AirLLM
AirLLM is a Python library for running very large language models on consumer GPUs with limited memory by loading model layers sequentially instead of keeping the entire model in VRAM.
https://github.com/lyogavin/airllm
Jumper
Jumper is an open-source Python toolkit for a 22-DoF crab robot that lets AI coding agents design appearances and scenes, train motions with reinforcement learning, and package them for deployment to the real robot.
https://github.com/KingKongRobotics/jumper
Stop one person claiming your Python free tier twice
Fold Gmail dots, plus tags and googlemail.com into one key, then grant the trial in one transaction. Django and SQLAlchemy.
https://elijahbrown.hashnode.dev/stop-one-person-claiming-your-python-free-tier-twice-gmail-dots-plus-tags-and-googlemail-com
Polars Query Optimization: Lazy vs. Eager Mode
Learn how Polars' lazy mode improves memory efficiency and performance compared to eager mode by building an optimized query plan before execution. By utilizing predicate and projection pushdown, lazy mode significantly reduces resource usage when working with large datasets, making it the preferred approach for most data analysis tasks.
https://www.youtube.com/watch?v=ux7MlXxFDQY
Building a GPU Compiler from Scratch
Progressive multi-level IR lowering systematically transforms high-level PyTorch graphs into optimized CUDA code through six explicit compiler stages. By separating graph fusion, hardware scheduling, and autotuning, the architecture makes GPU optimization easier to reason about, measure, and improve.
https://kernelspace.substack.com/p/building-a-gpu-compiler-from-scratch
Build your own decision model
Nish Tahir shows how to turn a small Qwen model into a fixed-choice decision model by masking outputs to allowed tokens, then evaluates and fine-tunes it on CommonsenseQA. Because the raw token probabilities are overconfident, he applies temperature scaling so the reported confidence better matches actual accuracy.
https://nishtahir.com/build-your-own-decision-model/
Building a lift scheduling algorithm in Python
The post demonstrates how to implement a multi-elevator scheduling algorithm in Python using the LOOK algorithm to prevent out-of-order directional stops. It further explores multi-lift optimization by separating system concerns between a Dispatcher and a LiftController state machine to assign requests based on weighted cost functions.
https://www.yellowduck.be/posts/building-a-lift-scheduling-algorithm-in-python