WEBVTT NOTE The Rundown — nextbig.dev daily audio edition, 2026-05-16 1 00:00:00.000 --> 00:00:06.763 Good morning and welcome to the Builder's Briefing for May sixteenth, twenty twenty-six. I'm Alex, joined as always by Sam, and we have a packed show today — a huge runtime rewrite, a wild day in security disclosures, and some real signals on where AI tooling is heading. 2 00:00:06.763 --> 00:00:10.256 Yeah, honestly, today's news lineup reads like someone set off fireworks in every corner of the ecosystem simultaneously. Let's get into it. 3 00:00:10.256 --> 00:00:14.823 So the big story — Bun has rewritten its core runtime from Zig to Rust. The PR merged, six hundred and fifty-eight comments on Hacker News, and the Zig era for Bun is officially over. 4 00:00:14.823 --> 00:00:19.639 Okay, I'll be honest — when I first saw the PR I thought it was a joke. Bun was the poster child for Zig in production. Like, the single highest-profile project keeping Zig on everyone's radar. 5 00:00:19.639 --> 00:00:26.751 Right, and the rationale is surprisingly pragmatic. It's not that Zig is bad — it's that Rust's ecosystem, the tooling maturity, and critically the hiring pipeline just outscale what Zig can offer today. You can find Rust engineers. Finding Zig engineers at scale is a different story. 6 00:00:26.751 --> 00:00:33.813 That's the part that hits hardest. For anyone building production infrastructure, this is the signal — Deno chose Rust from day one, and now Bun concedes. If you're starting a new CLI tool or runtime today and you pick anything other than Rust, you really need a specific reason why. 7 00:00:33.813 --> 00:00:41.074 For teams already shipping on Bun, expect a transition period. They're targeting performance parity first, but the move to Rust's memory model should actually reduce a class of edge-case crashes that Zig's manual memory management occasionally surfaced. So longer term, this should be a win. 8 00:00:41.074 --> 00:00:43.869 And if you've been writing Bun native plugins — yeah, your workflow just changed. Time to brush up on that Rust. 9 00:00:43.869 --> 00:00:48.311 Alright, shifting to AI news. Anthropic open-sourced what they're calling Agent Skills — basically a composable, reusable format for teaching Claude agents specific capabilities. 10 00:00:48.311 --> 00:00:54.974 This is interesting because it's the closest thing we've seen to a standard plugin interface for agents. Build a skill once, share it across deployments. There's already a project out there that turns any content source into NotebookLM-ready output using this format. 11 00:00:54.974 --> 00:00:59.390 Meanwhile, OpenAI shipped Codex into the ChatGPT mobile app. So now you can kick off code generation tasks from your phone — reviewing PRs on the go, prototyping from the couch. 12 00:00:59.390 --> 00:01:04.381 The real play there is making Codex the default coding surface outside of your IDE. I think this changes how product managers and founders prototype more than it changes how engineers work day to day. 13 00:01:04.381 --> 00:01:09.946 And one more AI item I want to flag — OpenAI is wiring ChatGPT directly into bank accounts through Plaid integration. If you're building in fintech, the general-purpose AI assistant is coming for personal finance workflows. 14 00:01:09.946 --> 00:01:15.186 Yeah, that's a competitive signal for sure. If you're a fintech startup, you need to differentiate on trust, compliance, and domain depth — or risk being commoditized by a chat window. That's a real threat now. 15 00:01:15.186 --> 00:01:20.102 On the launches side, Supertone dropped an ONNX-based text-to-speech engine that runs fully on-device with multilingual support. Three and a half thousand engagement — builders are hungry for this. 16 00:01:20.102 --> 00:01:24.694 If you're currently paying per-request for cloud TTS, this is your path to zero marginal cost. Run it on the edge, own your inference. That's the dream, and it's actually shipping now. 17 00:01:24.694 --> 00:01:30.009 Also worth mentioning — the Rust compiler project is formalizing an official policy for LLM-generated contributions. This is going to become the template for how major open-source projects handle AI-authored code. 18 00:01:30.009 --> 00:01:34.550 That one's quiet but important. Expect provenance and review requirements to tighten across the whole ecosystem. If you contribute to big projects, pay attention to how this evolves. 19 00:01:34.550 --> 00:01:40.739 Okay, security. Buckle up because today was intense. A new Nginx vulnerability called Nginx-Rift is public with exploit code already on GitHub. If you're running Nginx in production — and let's be honest, you probably are — check your exposure now. 20 00:01:40.739 --> 00:01:45.530 And that's not even the wildest one. There's now a public kernel memory corruption exploit targeting Apple's M5 silicon. First real proof that M-series chips aren't immune at the kernel level. 21 00:01:45.530 --> 00:01:51.918 On top of that, Google's Project Zero documented a full zero-click exploit chain for the Pixel ten. And research dropped showing Mullvad VPN exit IPs are surprisingly fingerprintable — which kind of undermines the whole commercial VPN anonymity assumption. 22 00:01:51.918 --> 00:01:58.631 All of this in one day. If you're not running automated vulnerability scanning against your stack — something like Nuclei with its community-driven YAML templates — today is literally your wake-up call. Pair Nuclei with that Nginx-Rift disclosure for immediate testing. 23 00:01:58.631 --> 00:02:04.495 Quick fun ones before we wrap — OCaml is running on a satellite as part of the Borealis mission. Functional programming in orbit. The type system's formal verification properties doing real work where failure literally isn't an option. 24 00:02:04.495 --> 00:02:10.709 I love that so much. Also, Start9 shipped a RISC-V-based consumer router — open hardware networking is finally becoming real. And apparently Amazon workers are making up tasks just to hit their internal AI usage quotas, which is… painfully on brand. 25 00:02:10.709 --> 00:02:19.143 Ha! Alright, three patterns to act on. One — on-device inference is production-ready. If you're still paying per-request for TTS or translation, prototype a local alternative this weekend. Two — Rust's gravity in developer tooling is undeniable after Bun's migration. The ecosystem advantages compound faster than anything else out there. 26 00:02:19.143 --> 00:02:24.159 And three — the security surface is widening fast. Nginx, M5 kernel, Pixel zero-clicks, all in one day. Automated scanning isn't optional anymore. Get your tooling in place now, not after the incident. 27 00:02:24.159 --> 00:02:27.877 That's the briefing for May sixteenth. Links to everything we mentioned are in the show notes. Stay sharp, keep building, and we'll see you tomorrow. 28 00:02:27.877 --> 00:02:28.1000 See you tomorrow, folks. Go patch your Nginx.