DEV Community: Deepak Kumar

China's AI Stock Bubble Just Burst. Here's What Developers Should Actually Take From It

Deepak Kumar — Wed, 28 Oct 2026 07:35:48 +0000

While everyone has been arguing about whether there's an AI bubble, China quietly had one, and it has already popped.

China's STAR50 index of AI and chip companies has fallen about 40% from its July high in under four months, erasing roughly $480 billion in market value, according to Reuters. The broader CSI300 is in bear-market territory. The Nasdaq, meanwhile, is only about 6% off its record.

I'm a developer, not a fund manager. But this story is more relevant to people who build with AI than it looks, so here's my developer's-eye summary.

The 30-second version

The rally: Beijing pushed AI and chip self-sufficiency, and investors bet that "government-backed" meant "can't lose."
The IPO frenzy: GPU maker MetaX closed its first trading day up 693%. Robot maker Unitree's IPO was oversubscribed 8,000+ times by retail investors and rose 629% on day one.
The peak: at its height the STAR50 traded at nearly 250x earnings.
The crash: Unitree, MetaX and Moore Threads have roughly halved. Optical module makers Zhongji Innolight and Eoptolink are down about 60%.
The twist: Beijing actually tried to cool the rally. It tightened margin rules to 100% in January and had state funds sell into rallies. The bubble popped anyway. ## Why developers should care

1. The "boring" hardware got hit hardest

The biggest losers weren't chatbot companies. They were the picks-and-shovels suppliers: optical transceivers, memory chips and GPUs, the parts that physically connect and power AI clusters.

Innolight and Eoptolink make the optical modules that move data between AI servers over fibre. In September, a bipartisan group of US senators introduced a bill to bar the federal government from using those two companies' transceivers in sensitive systems. It hasn't passed, but the market priced in the risk immediately.

If you work on infrastructure, that's a reminder that your AI stack has geopolitical dependencies you probably haven't mapped. Where do your GPUs, memory and optics come from? What happens if one supplier gets restricted?

2. Valuation isn't capability

Here's what I think is the most important line in the whole story: even after a 40% fall, the STAR50 still trades around 100x earnings. The Nasdaq 100 is around 30x.

The stocks fell, but the engineering didn't. Chinese labs are still shipping competitive models and open-source tooling. A falling share price tells you investors overpaid. It doesn't tell you a GPU stopped working or a model got worse.

Developers already know this instinctively. A hyped framework with a million GitHub stars can still be the wrong choice for your project. The hype measures attention, not fit.

3. Funding freezes slow roadmaps

Fund managers expect the crash to slow down new tech IPOs in China. For young Chinese GPU and robotics companies that were planning to raise money by listing, that means less cash for R&D, slower product cycles and possibly consolidation.

If you evaluate hardware or cloud vendors, funding runway is a real procurement question, not just a finance one.

4. It's not (yet) a global AI crash

It's tempting to read this as "the AI bubble is over." The evidence doesn't support that yet. In the same week China's AI stocks kept sliding:

Anthropic filed for its IPO, reporting first-half revenue up about 1,300% year on year
SK hynix reported quarterly operating profit up 632%, driven by AI memory demand
US AI stocks rallied China's crash looks more like extreme valuations + a retail-dominated market + trade restrictions than a collapse in AI demand. A US correction, if it comes, would probably be about something different: whether AI revenue grows fast enough to justify all the data-centre spending.

The lesson I keep coming back to

"Government supports this sector" tells you the sector matters. It doesn't tell you what a share is worth.

Swap "government" for "Big Tech" or "VCs" and you have every hype cycle developers have lived through. The tech can be real, important and world-changing, and the price can still be wrong.

Want the full breakdown?

I wrote a detailed, fully sourced analysis on ByteMuni. It covers:

the complete timeline from the 2024 stimulus to this week's selloff
charts of the drawdown, valuations, and IPO gains vs. later losses
how Beijing's "slow bull" plan worked and why it failed
comparisons with China's 2015 crash and the dot-com bust
the bull and bear arguments from Goldman Sachs, BNP Paribas, HSBC and Chinese fund managers 👉 China's AI Bubble Has Burst: Why $480 Billion Vanished From the STAR50

Your turn: do you think this is a China-only correction, or an early warning for AI stocks everywhere? And has anyone here had to rethink a hardware supplier because of trade restrictions? I'd love to hear real experiences in the comments. 👇

Not financial advice. Figures as reported by Reuters and other outlets between Oct 26 and 28, 2026.

I Read Every Security Advisory This Week So You Don’t Have To. This is the most personal and human-sounding. Use it only if it’s true for you.

Deepak Kumar — Sat, 24 Oct 2026 07:53:27 +0000

I spent most of this week reading security advisories so you don't have to. It was not a quiet week.

Node.js, PHP and Python's favourite image library all shipped fixes for bugs where untrusted input could end up running code on your server. CISA added two more actively exploited flaws to its must-patch list. And somewhere in the middle of all that, a volunteer in Czechia quietly kept a large chunk of the internet running.

If you run a backend in any of these languages, here's the short version of each one. For every bug I've included the one command that tells you whether you're affected, plus a link to the full write-up I did on ByteMuni if you want the details.

1. Node.js: your `fetch()` decodes Brotli whether you asked or not

CVE-2026-111497, nicknamed Node2Shell. It's an out-of-bounds write in the Brotli decoder that ships inside the node binary.

The part that got me: you don't have to "use Brotli" to be exposed. Built-in fetch() decompresses any response with Content-Encoding: br, no matter what your request asked for. Express 5's body parsers also decode Brotli request bodies by default. So a link-preview service, a webhook sender or an AI agent that fetches URLs is a target, even if nobody on the team has ever typed the word Brotli.

Check it:

node -v
# need v22.23.4+, v24.22.1+ or v26.12.1+

node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'missing'"
# -17 = patched build, missing = not patched

Node 20 and older get no fix at all.

I wrote up who's exposed, the pm2 and Docker traps, and stopgaps if you can't upgrade today.

2. PHP2Shell: millions of attempts, (so far) zero confirmed breaches

CVE-2026-109618 and CVE-2026-109619. These are memory bugs in the PHP engine itself, so a perfectly clean WordPress or Laravel app is still exposed if the PHP underneath is old.

Details leaked before the patch was ready. Cloudflare saw tens of thousands of exploit attempts within 45 minutes of the announcement, and millions by the next day. A Mirai botnet tried to jump on it too. The interesting bit is that nobody has confirmed a successful break-in yet, because reliable exploitation turned out to be hard. VulnCheck has since shown that the main obstacle can be beaten, so I wouldn't count on that luck lasting.

Check it (and be careful which PHP you're checking):

php -v
# need 8.5.12, 8.4.27, 8.3.36 or 8.2.35+
# BUT this is the CLI. Your web server might run a different PHP-FPM build.

The PHP2Shell explainer covers the bugs themselves, and the server patching guide walks through actually rolling it out.

3. The volunteer who patched PHP for everyone

This is the story from the week I liked most.

PHP's fix arrived as source code. Most servers don't compile PHP; they apt install it. On Debian and Ubuntu, a lot of those packages come from one person: Ondřej Surý, who has maintained ppa:ondrej/php and packages.sury.org in his spare time for over 20 years. He shipped patched builds the same day, and then backported the fix all the way to PHP 5.6, versions PHP itself no longer supports.

He doesn't even run PHP himself. His words: "I feel a responsibility toward the users of the internet."

If you've ever typed add-apt-repository ppa:ondrej/php, you've relied on his work. Check whether you still do:

apt policy php8.3   # swap in your version

Who Ondřej Surý is and what his week looked like. It's also a pretty good argument for funding the open-source people your stack depends on.

4. Pillow: one crafted image, code on your server

Pillow 13.0.0 fixes a pile of bugs. The two that worry me most:

CVE-2026-112398: a crafted FlashPix file can run code from a single Image.open() call if olefile is installed. Pillow detects formats by content, so renaming the upload to .png doesn't save you.
CVE-2026-96639: multi-frame images (PSD, MPO, DCX, MIC) can make Pillow write past a buffer when you seek() through frames.

And here's a trap I think a lot of people will fall into:

python -c "import PIL; print(PIL.__version__)"

# On Python 3.10 this "succeeds" but quietly installs a vulnerable 12.x:
pip install -U pillow

# This fails loudly instead, which is what you actually want:
pip install -U "Pillow>=13.0.0"

Pillow 13 needs Python 3.11+. pip won't warn you; it just picks the newest version that runs on your Python.

The full write-up has a cheat sheet mapping risky Pillow calls to each CVE, plus hardening code for when you can't upgrade yet.

5. CISA KEV: Nextcloud web shells and a VeloCloud takeover

On Friday CISA added two flaws to its Known Exploited Vulnerabilities list, which means people are already using them.

CVE-2026-110447 in Collabora Online's built-in server for Nextcloud (richdocumentscode). Attackers planted PHP web shells and went looking for KeePass files and crypto wallets. Disabling the app doesn't fix it; you have to update to 26.4.303+ or remove it.
CVE-2026-114625 in Arista VeloCloud Orchestrator. SQL injection that lets the lowest read-only user become a full operator.

If you run Nextcloud, look for leftover shells even if you've patched:

find /path/to/nextcloud -name 'shx*.php'

I covered both KEV additions, with log checks and fix versions.

The pattern I can't stop noticing

Three of these five are the same bug wearing different clothes: native code decoding untrusted bytes. A Brotli stream, a PHP request body, an image file. Your code can be clean TypeScript or Python and still hand attacker-controlled data to C code you've never looked at.

The other two are a reminder that "patched" and "safe" aren't the same thing. The Collabora fix shipped a month before anyone called it a security fix, and patching doesn't remove a web shell someone planted before you updated.

So my takeaways for the week:

Know what's actually decoding your inputs, not just what's in package.json or requirements.txt.
Check the runtime that serves traffic, not the one in your terminal.
After you patch, look for anything that got in before you did.
Throw a few dollars at the maintainers your stack quietly depends on.

I post this kind of breakdown regularly on ByteMuni, mostly security, plus some dev tools and AI stuff. If one of these bit you this week, I'd genuinely like to hear how you found out. Drop it in the comments.

How I’m Building an AI-Powered Event & Wedding Planning Platform

Deepak Kumar — Thu, 01 Oct 2026 16:08:37 +0000

Planning a wedding or event looks simple from the outside.

But once you start planning, you quickly realize how many things need to be managed:

Venue
Photography & Videography
Catering
Decoration
Makeup & Bridal
DJ & Music
Invitations
Guest management
Budget
Vendors
Timelines

Today, people often manage all of this through Google searches, Instagram, WhatsApp, phone calls, spreadsheets, and personal recommendations.

I wanted to explore whether we could bring these pieces together into one platform.

That's how PlanToday started.

👉

Wedding Planners & Event Vendors in India | PlanToday

Find wedding planners, venues, photographers, decorators, makeup artists, caterers and event vendors in India. Search by city, service and event type - Plantoday.

plantoday.in

The idea

The basic idea is simple:

«Tell us what you're planning, where you're planning it, your guest count and your approximate budget — and the platform should help you organize the rest.»

For example:

"I am planning a wedding in Delhi
for 300 guests with a budget of ₹15 lakh."

Instead of starting with dozens of searches, the platform can turn this requirement into a structured event plan.

Wedding
│
├── Venue
├── Photography
├── Catering
├── Decoration
├── Makeup
├── DJ & Music
├── Invitations
└── Guest Management

Where AI comes in

One of the interesting parts I'm exploring is using AI to understand natural-language event requirements.

For example:

{
"eventType": "wedding",
"location": "Delhi",
"guestCount": 300,
"budget": 1500000
}

Once we have structured information, the application can use it for recommendations, checklists, budget planning and vendor discovery.

The goal isn't just to add a chatbot.

The goal is to make AI part of the actual planning workflow.

Vendor marketplace

The other side of the platform is the vendor ecosystem.

A user might need:

Wedding
├── Photographer
├── Caterer
├── Decorator
├── Makeup Artist
├── DJ
└── Venue

Each vendor can have a profile containing services, portfolio, location, pricing information, reviews and enquiry options.

This creates two sides of the ecosystem:

         PlanToday
             │
    ┌────────┴────────┐
    │                 │
  Users             Vendors
    │                 │
 Discover          Get Leads
    │                 │
    └────────┬────────┘
             │
          Enquiries

The engineering challenge

Building a marketplace isn't just about creating CRUD APIs.

There are several interesting technical problems:

Users need to find relevant vendors based on:

Location
Category
Event type
Budget
Services
Availability

SEO

Event planning is highly location-driven.

For example:

Wedding photographers in Delhi
Wedding decorators in Noida
Birthday venues in Gurgaon
Catering services in Dehradun

The challenge is creating useful, unique pages instead of simply generating thousands of similar SEO pages.

The AI layer needs to transform unstructured requirements into structured data that the rest of the application can actually use.

Marketplace

The platform has to provide value to both sides:

Users → discover and plan their events.

Vendors → receive relevant enquiries and grow their business.

The bigger vision

I don't want PlanToday to become just another vendor directory.

The larger vision is an event-planning ecosystem:

User
↓
Choose Event
↓
Set Location & Budget
↓
AI Planning
↓
Discover Vendors
↓
Compare Options
↓
Send Enquiries
↓
Book Vendors
↓
Manage Event

Eventually, AI can assist throughout this entire journey.

What's next?

There are many interesting areas I'm continuing to explore:

AI-powered event planning
Vendor recommendations
Search & personalization
Marketplace architecture
Lead generation
Event analytics
Payments & subscriptions
Guest management
Budget management
Large-scale SEO

Building this has been a good reminder that the hardest part of a marketplace isn't building the technology.

It's creating a system where both sides of the marketplace get real value.

I'm building this journey with PlanToday.

👉 https://PlanToday.in

If you're working on marketplaces, AI applications, recommendation systems, or event-tech products, I'd love to hear what you're building and what challenges you're facing.

DEV Community: Deepak Kumar

China's AI Stock Bubble Just Burst. Here's What Developers Should Actually Take From It

The 30-second version

1. The "boring" hardware got hit hardest

2. Valuation isn't capability

3. Funding freezes slow roadmaps

4. It's not (yet) a global AI crash

The lesson I keep coming back to

Want the full breakdown?

I Read Every Security Advisory This Week So You Don’t Have To. This is the most personal and human-sounding. Use it only if it’s true for you.

1. Node.js: your fetch() decodes Brotli whether you asked or not

2. PHP2Shell: millions of attempts, (so far) zero confirmed breaches

3. The volunteer who patched PHP for everyone

4. Pillow: one crafted image, code on your server

5. CISA KEV: Nextcloud web shells and a VeloCloud takeover

The pattern I can't stop noticing

How I’m Building an AI-Powered Event & Wedding Planning Platform

Wedding Planners & Event Vendors in India | PlanToday

1. Node.js: your `fetch()` decodes Brotli whether you asked or not