Today's thread
All four stories today are about the ground your work stands on. Conductor, an app for managing several coding AIs from one screen, is joining Meta and will close its cloud version within two weeks. Node.js, which runs countless web services, has announced another security patch just three weeks after the last one, and payment processor PayHub only noticed an intrusion after settlement money had left.
This week it pays more to ask what happens to your work if a tool stops or gets breached than to hunt for new features. The last story, psmux, sits on the other side: a small tool that keeps your work alive when a connection drops. Each item ends with something to check today, and they are gathered at the end.
Conductor joins Meta — its cloud shuts down Nov 20
Conductor is a Mac app for running and managing several coding AIs, such as Claude Code and Codex, side by side. On November 4 the company announced that its team is joining Meta, and Conductor's Charlie Holtz said on his X account that they will build the next interface with Meta Superintelligence Labs (MSL). The same day, new sign-ups and app downloads stopped, and existing free users can no longer upgrade. Existing Pro users keep Pro features at no extra cost, and active subscribers will be refunded.
The schedule is tight. On November 13 the cloud version becomes read-only: you can read and export old chats but cannot send new messages. On November 20 the cloud version shuts down and deletion of cloud user data begins. The local Mac app will receive new models and critical bug fixes until early 2027, when it starts winding down, and all user data will be deleted when the app closes.
If you kept workspaces in the cloud, right-click a workspace and choose 'Transfer to local' to move it, chats included, to your Mac. You can download all your data under Settings, Account → Export data. Tools that put several coding AIs in one window, like herdr which we covered on November 2, keep multiplying, but a small company's tool can close within weeks like this. A habit of regularly exporting your chat history and settings matters more than which tool you pick.
The announcement does not mention the deal price or what Meta's new product will look like or when it will arrive. The company says it has never sold user data or trained on it, and will not start.
Node.js security patch on Nov 11 — HIGH on all three lines
On November 3 the Node.js project announced it will release new versions of its three supported lines, 26.x, 24.x and 22.x, on or shortly after Wednesday, November 11. Node.js is the engine that runs web services and automation programs written in JavaScript on servers and on your own PC. For all three lines, the most serious issue being fixed is rated HIGH. Which flaws, and how many, will be disclosed when the patches ship.
Node.js also shipped security patches for the same three lines on October 21, so this is a follow-up three weeks later. There were security releases in March, June and July this year as well. The project states plainly that end-of-life versions are always affected when a security release happens. Versions outside 22, 24 and 26, such as 20.x and older, will not be fixed.
Many web apps and in-house automations built through vibe coding run on Node.js. Type node -v in a terminal (the black window where you type commands) to see your current version. If it does not start with 22, 24 or 26, use this chance to move to a supported line; if it does, set a date now to upgrade after the 11th.
Until the 11th, there is no way to know what the flaws are or whether they touch features your service uses. Upgrading is safer even for tools not exposed to the internet, but keep a step to confirm your existing features still work afterwards.
PayHub loses about KRW 200M — 22 financial firms breached
On November 3 it was reported that about KRW 200 million was transferred without authorization at PayHub, a payment gateway (PG) that accepts card payments and settles them on behalf of online shops. PayHub found that merchant settlement funds had been moved out while checking on its own whether IP addresses (internet addresses) linked to recent financial-sector hacks had accessed its systems. Korea's Financial Supervisory Service had been inspecting the company on site since October 28 and extended the inspection, saying more checks were needed.
According to reports, 22 financial companies have now suffered breaches, including PayHub and Zoompund, an online investment-linked lender. When regulators announced the tally on October 14, it was 16. After cases in which money, not just data, was taken, regulators held an emergency review meeting on November 4 and a financial-sector meeting on responding to AI security threats on the 5th. The FSS said it will inspect every external touchpoint, including sectors not covered by the Electronic Financial Transactions Act.
If your shop takes payments through a PG, comparing settlement deposits against sales records every week, and checking that they arrived on the expected date, is the fastest alarm you have. Also check who holds accounts that can send money from your company and whether one person can complete a transfer alone. PayHub, too, found the incident by tracing suspicious access records backwards.
The attack route and whether AI was involved have not been disclosed. The Financial Security Institute's interim investigation reportedly found no trace of AI use so far, and it has not been made public whether affected merchants' settlement schedules are impacted.
psmux — keep Claude Code sessions alive on Windows, tmux-style
psmux is a terminal tool you use like tmux on Windows. tmux is a Linux and Mac tool that splits one terminal window into several panes and keeps the work inside running even after you close the window. psmux is written in Rust, runs directly in PowerShell and Command Prompt without WSL (a Windows feature that runs a separate Linux inside it), and is published under the MIT license. On Windows 10 and 11 you install it with one line: winget install psmux.
It reads existing tmux config files (.tmux.conf) as they are and installs commands under three names, psmux, pmux and tmux, so typing tmux works on Windows too. A named work session survives closing the window, and you reattach with psmux attach -t session-name. According to the public repository, when you use Claude Code's agent teams feature (several AIs splitting roles and working together), each teammate AI opens in its own pane.
If you SSH (a way to log in to another computer remotely) from a laptop at home into a Windows PC at work to run Claude Code, closing the laptop lid tends to cut the connection and the work with it. Run it inside a psmux session and you return to where you were just by reconnecting and attaching. Being able to use the same config and commands with tmux on the Mac and psmux on Windows is a big plus too.
The features listed here are based on the public repository's description. How the mouse and scrolling behave over a remote connection varies enough by setup that there is a separate guide for it. The project does not claim to support every tmux feature, so first check that the commands you use most actually work.
Things to try today
If you used Conductor's cloud, move your workspaces to your Mac with 'Transfer to local' before November 13 and download your history under Settings, Account → Export data. Even if you did not, find where the chat export menu is in the AI tools you use now.
On every PC and server that uses Node.js, run node -v and write down the version. If it is outside 22, 24 and 26, plan a move to a supported line; if it is inside, set an update date after November 11.
If you take payments through a PG, compare last month's settlement deposits against your sales records once, and write the list of accounts that can send money, along with their approval steps, on a single sheet of paper.
If you run coding AIs for long stretches on a Windows PC, install psmux with winget install psmux, create one session, close the window, and test whether psmux attach -t brings you back.