Every week a script of mine scans four sources and posts a ranking to Telegram. This week I re-read all the raw data and split it into separate posts — because one board that merges four sources cannot answer any single question properly.
Four sources, four different windows
- GitHub: 615 repos created after 19 October 2026 that already passed 40 stars — 95,350 stars in total.
- Show HN: 38 posts at 20 points or more, 1,970 comments in total.
- Lobsters: the 25 hottest links, which actually span 2.3 days — not 7.
- Product Hunt: the 50 newest launches, spanning up to 36.9 days; only 36 of 50 fall inside this week, and the feed carries no vote counts.
Four stories, split into four posts
- php2shell took over all three boards — one PHP vulnerability appearing on Show HN, Lobsters and in 33 new repos; 9,172 stars. Two sides argued opposite conclusions, and the bug was then used to take real money.
- A site left $2,021 for whoever could hack it — taken after 19.28 hours, but nobody managed it in the first 20. That is a better measurement than any argument.
- 21% of commits written by AI — counting co-authors across 246 commits in the 12 most-starred repos. The leader is 28 of 30. But 8 of the 12 are zero.
- wordexp(3) runs shell commands — a small API, an old bug, and an obvious fix (WRDE_NOCMD) that is still not enough on musl and macOS.
- Vim Classic does not use AI — a long-term-support fork of Vim 8.x, and one line in the announcement that matters more than the release itself.
Top six repos by stars, with real measurements
The original board carried only stars and velocity. Here are the same six repos with commit count, contributor count and licence — the things that decide whether a repo is usable:
- pengchujin/aerial-tv — 5,226★ · 293 commits · 22 contributors · MIT · ad-free Android TV launcher for China-market TVs.
- JustAResearcher/gpu-unlock-ada — 2,931★ · 103 commits · 20 contributors · GPL-2.0 · kernel module unlocking RTX 4090 tensor throughput, measured 165.6 → 331.6 TF/s FP16.
- xevrion/hatchzip — 1,955★ · 142 commits · 3 contributors · Apache-2.0 · extracts in place, the archive shrinks as it goes, so you need space only for the output.
- wesbos/3d-model-anything — 1,947★ · 5 commits · 1 contributor · scans a room with iPhone LiDAR and rebuilds an editable Three.js scene.
- ikow/php2shell-poc — 1,797★ · 13 commits · 1 contributor · MIT · 5 RCE chains plus detection rules for CVE-2026-109618/109619.
- Jakeschincariol/day-trader-skill — 1,697★ · 1 commit · 1 contributor · MIT · 11 Claude skills to scan charts, paper trading by default.
The last two lines are why I added the commit column: day-trader-skill has 1,697 stars but exactly one commit, while 3d-model-anything has 5 commits from one person. Stars measure reaction; commits measure work.
A defect in this very board
The script ranks by stars divided by repo age, and that formula rewards being new. An 811-star repo at 0.82 days displays 985 stars/day, ranking above a 5,226-star repo at 5.79 days (902 stars/day). The same formula pushes a 24-point, one-hour-old Show HN post above a 938-point post at 130 hours. If you read the original board on Telegram, read the star column before the velocity column.
Sources: GitHub Search API (`created:>2026-10-19 stars:>40`), HN Algolia API, Lobsters `/hottest.json`, the Product Hunt Atom feed, plus GitHub's `commits` and `contributors` endpoints. Data as of 26 October 2026, 11:12 Vietnam time.