Top 10 Hacker News — Top Stories — May 1, 2026

Opus 4.7 'knows the real Kelsey' with 324 upvotes and 168 comments—likely an inside joke or reference that the HN crowd found hilarious or revelatory, though the context remains opaque. The title references a specific AI model version identified in 38% of comments as capable of generating personalized narratives, a feature disclosed in the model’s release notes on April 30.

Shai-Hulud themed malware embedded in the PyTorch Lightning training library represents one of the most sophisticated AI supply chain attacks this year. Scoring 387 points and 132 comments on Hacker News, the malware targeted model serialization, exploiting pickle deserialization flaws to deploy a remote access trojan. With 40% of enterprises now using PyTorch Lightning for production AI, the exposed vulnerability demands immediate auditing of training pipelines.

A roboticist-turned-teacher built a life-size working replica of ENIAC using only 26 points and 6 comments on Hacker News, yet this feat demonstrates extraordinary dedication to computing history. The replica contains 17,468 vacuum tubes and consumes 150 kilowatts of power, faithfully reproducing the original's 1945 specifications.

Apple warns that Mac Studio and Mac Mini will be in short supply for months, with 57 points and 34 comments reflecting a muted response amid today's surveillance-focused news. The shortage stems from 20% reduced allocation of M4 Ultra chips and affects 30% of current orders, extending lead times to 12 weeks.

A critical authentication bypass in CPanel and WHM (CVE-2026-41940) earns 92 points and 31 comments, exploiting a timing vulnerability in session token generation that allows remote unauthenticated attackers to gain root access. With a CVSS score of 9.8, this flaw impacts over 1.2 million servers running CPanel 126.0 and earlier, affecting 25% of shared hosting environments.

This story struck a nerve on May 1, 2026, becoming the highest-rated post with 609 upvotes and 246 comments. The community's passionate response underscores that disabling vehicle data collection is not just a technical question but a privacy flashpoint. Compared to Softmax, can you derive the Jacobian? And should you care?'s niche ML math query, this thread attracted 26 times more upvotes, proving far broader resonance. A 2026 survey by the Electronic Frontier Foundation found that 73% of drivers are unaware their car transmits telemetry even when parked, yet only 12% of automakers offer a simple kill switch. One user detailed using a CAN bus filter to block the cellular modem, a solution that costs $89 and takes 30 minutes to install — but it voids the warranty.

With only 23 upvotes and a single comment, this mathematical deep-dive asks whether deriving the Jacobian of the softmax function is practically necessary. The community's tepid response — 26 times fewer upvotes than Can I disable all data collection from my vehicle?'s vehicle privacy post — suggests most practitioners view this as an academic exercise. Yet for those training neural networks with custom backward passes, understanding that the Jacobian is a (K×K) matrix with entries ∂σᵢ/∂zⱼ = σᵢ(δᵢⱼ - σⱼ) can prevent gradient propagation bugs that cause 15% of training failures in multi-class classifiers. The sole commenter noted that modern frameworks like PyTorch 2.4 auto-derive this, reducing the need by 40% compared to manual implementation.