Today’s Rails World 2026 talk by DHH was special. I think it just became an instant classic. youtube.com/watch?v=V9SxpJpHuus

Highlights:

• WebApps are dead since it is so cheap, easy, and fast to build native apps with agentic coding.

• No need for a framework like Ruby on Rails if you can achieve the same functionality with e.g. Rust on the backend while saving a lot of money by reducing the number of needed servers and having a faster application.

• Your application needs a CLI. Because agents love command-line tools.

So the inventor of a very popular framework uses the keynote of THE main conference for that framework to tell the audience, which consists only of developers who use that framework every day, that his own company stopped using the exact framework for the next version of one of their key products. BOOM!

Helsing’s own Jon Gjengset (also known as the author of Rust for Rustaceans) will be speaking at bcnrust in October! eurorust.eu/activities/…

There’s a Rust supply chain attack going around right now, the arrayref crate got compromised (along with internment and append-only-vec) after apparently getting republished from a hijacked account, pulling in a malicious proc-macro1 dependency that runs a shady build script.

The Rust Security Team has already deleted the bad versions, but if you pulled dependencies in the last few hours, it’s worth double-checking. Malicious versions to watch for:

• arrayref@0.3.10

• internment@0.8.7

• append-only-vec@0.1.9

• proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any version)

  Supply chain attack on arrayref | Rust B…

Quick way to check if you’ve cached any of these locally:

find ~/.cargo/registry/cache -type f \( \
  -name 'append-only-vec-0.1.9.crate' -o \
  -name 'arrayref-0.3.10.crate' -o \
  -name 'internment-0.8.7.crate' -o \
  -name 'proc-macro1-*.crate' -o \
  -name 'proc-macro-en-*.crate' -o \
  -name 'aovine-*.crate' -o \
  -name 'arone-*.crate' -o \
  -name 'aronenao-*.crate' -o \
  -name 'tinymember-*.crate' \) -print

Full writeup from the Rust team here: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref