What's breaking, what to patch, and how to build things that stay calm.
I'm Udara. I write about security incidents and software engineering in plain language, with checklists you can finish today.
ACP and MCP: two sides of an agent
The Agent Client Protocol connects coding agents to the apps you work in. The Model Context Protocol connects them to tools and data. What ACP is, how it works on the wire, how it differs from MCP, and when you need which.
More notes.
Node2Shell: the Brotli bug reaches beyond Node
The decompression flaw fixed in Node.js on 21 October lives in Google's Brotli library, so Bun, Python, Envoy and Istio are affected too. A public proof of concept exists. Here is what to patch.
PHP2Shell: the unpatched majority
Four days after PHP2Shell was patched, most internet-facing PHP hosts report a version that never got an official fix. What that means, what the attacks look like, and your options.
Two perfect tens in nine days: GitLab's regex engine
GitLab fixed two related CVSS 10.0 flaws in its CI/CD regular-expression engine on 12 and 21 October. The first patch release is not enough. Here is what to check if you run it yourself.
AI finds bugs faster than we patch
Machine-assisted bug hunting is producing tens of thousands of findings. Fixing them is the bottleneck. What the numbers say, what they do not, and how a small team keeps up.
Go: fifteen fixes in one release
Go shipped fifteen security fixes on 8 October: crashes, a proxy mix-up, a module checksum bypass and more. What they allow, and why every Go program needs a rebuild.
Node.js: ten fixes in one day
Node.js shipped ten security fixes on 21 October, four rated high. What they cover, what they could mean for your servers, and the update to make.
The lab.
Small, sharp, self-hosted tools that run on your own machine, most of them free. Come and look around when you are ready.
Hi, I'm Udara.
I'm a software engineer. Go by habit, with mobile, web, desktop and enterprise browser apps behind me. The lab is where I think with my hands.
If you're stuck on something bigger than a weekend, let's talk it through. I like those conversations best.
Got something on your mind?
A half-built idea. A system that got heavy. A decision you keep circling. Tell me about it.