/railway-breach-envelope-encryption-decrypt-authority-blast-radius/ Railway's Breach Shows Per-Tenant Keys Don't Limit Who Can Decrypt Nov 12
/openssh-10-6p2-musl-crypt-star-oversized-password-bypass/ OpenSSH Accepted a 300-Byte Password for Accounts With No Password. The Bug Is in musl and Alpine's Shadow File Nov 7
/lxd-mtls-client-certificate-chain-cve-2026-112816/ LXD and Incus Checked Every Certificate in the Client's Chain Against the Trust Store. Only the First One Proves a Key Nov 2
/tofu-targeted-plan-unscoped-apply-replaced-servers/ A Targeted tofu plan Said '2 to add'. The Unscoped Apply Replaced Both Production Servers Oct 29
/emudhra-weak-ca-keys-trust-store-baked-into-build/ Chrome Blocked the Weak eMudhra CA Keys in 100 Minutes. Your Go Binary and Python Container Did Not Get the Memo Oct 25
/php-oom-longjmp-memory-limit-rce-cve-2026-109618/ PHP's memory_limit Was the Attack Surface: Two Critical RCEs Hide in the Out-of-Memory Path Oct 22
/github-sha1-https-sunset-tls-not-git-hashing/ GitHub Turned Off SHA-1 in HTTPS. It Has Nothing to Do With Git's SHA-1 Sep 18
/anthropic-postmortem-xla-topk-precision-bug/ Claude Degraded for a Month. The Cause Was a Workaround Nobody Fully Understood. Sep 17
/openai-jalapeno-inference-chip-broadcom/ OpenAI's First Chip, Jalapeño, Just Beat Nvidia on Nvidia's Own Numbers Aug 27
/nvidia-groq-3-lpx-inference-full-production/ Nvidia's Groq 3 LPX Enters Full Production, and Inference Speed Becomes a Silicon Choice Aug 25
/cloudflare-bot-preference-sync-robots-txt/ Cloudflare Will Write Your robots.txt Now, and That Changes What the File Is For Aug 24