https://ulab24.com/writing/Notes from the workshop: Go, self-hosting, identity, and the craft of shipping software that lasts.enSat, 31 Oct 2026 03:00:00 +0530https://ulab24.com/writing/acp-vs-mcp/https://ulab24.com/writing/acp-vs-mcp/Sat, 31 Oct 2026 03:00:00 +0530The Agent Client Protocol connects coding agents to the apps you work in. The Model Context Protocol connects them to tools and data. What ACP is, how it works on the wire, how it differs from MCP, and when you need which.https://ulab24.com/writing/node2shell-brotli-reaches-beyond-node/https://ulab24.com/writing/node2shell-brotli-reaches-beyond-node/Sun, 25 Oct 2026 00:00:00 +0000The decompression flaw fixed in Node.js on 21 October lives in Google's Brotli library, so Bun, Python, Envoy and Istio are affected too. A public proof of concept exists. Here is what to patch.https://ulab24.com/writing/php2shell-the-unpatched-majority/https://ulab24.com/writing/php2shell-the-unpatched-majority/Sun, 25 Oct 2026 00:00:00 +0000Four days after PHP2Shell was patched, most internet-facing PHP hosts report a version that never got an official fix. What that means, what the attacks look like, and your options.https://ulab24.com/writing/gitlab-two-tens-in-nine-days/https://ulab24.com/writing/gitlab-two-tens-in-nine-days/Sun, 25 Oct 2026 00:00:00 +0000GitLab fixed two related CVSS 10.0 flaws in its CI/CD regular-expression engine on 12 and 21 October. The first patch release is not enough. Here is what to check if you run it yourself.https://ulab24.com/writing/ai-finds-bugs-faster-than-we-patch/https://ulab24.com/writing/ai-finds-bugs-faster-than-we-patch/Thu, 22 Oct 2026 00:00:00 +0000Machine-assisted bug hunting is producing tens of thousands of findings. Fixing them is the bottleneck. What the numbers say, what they do not, and how a small team keeps up.https://ulab24.com/writing/go-fifteen-fixes-october-2026/https://ulab24.com/writing/go-fifteen-fixes-october-2026/Thu, 22 Oct 2026 00:00:00 +0000Go shipped fifteen security fixes on 8 October: crashes, a proxy mix-up, a module checksum bypass and more. What they allow, and why every Go program needs a rebuild.https://ulab24.com/writing/nodejs-ten-fixes-october-2026/https://ulab24.com/writing/nodejs-ten-fixes-october-2026/Thu, 22 Oct 2026 00:00:00 +0000Node.js shipped ten security fixes on 21 October, four rated high. What they cover, what they could mean for your servers, and the update to make.https://ulab24.com/writing/php2shell-explained/https://ulab24.com/writing/php2shell-explained/Thu, 22 Oct 2026 00:00:00 +0000A critical remote-code-execution flaw in PHP, a language behind roughly seven in ten websites. What it is, why details leaked a day early, and what to do about it now.https://ulab24.com/writing/the-week-the-foundations-shook/https://ulab24.com/writing/the-week-the-foundations-shook/Thu, 22 Oct 2026 00:00:00 +0000In three weeks of October 2026 the web's most common building blocks (PHP, Node.js, Go and the certificate system) all needed urgent attention. One story, five deep dives, and a checklist you can finish today.https://ulab24.com/writing/go-stops-trusting-eight-ca-keys/https://ulab24.com/writing/go-stops-trusting-eight-ca-keys/Thu, 22 Oct 2026 00:00:00 +0000On 20 October Go blocked eight certificate-authority keys in a point release. Rebuilt programs may refuse sites that older binaries still accept. Here is what to check.https://ulab24.com/writing/before-you-self-host-your-sign-in/https://ulab24.com/writing/before-you-self-host-your-sign-in/Fri, 09 Oct 2026 00:00:00 +0000Running your own identity server gives you control and also responsibility. A short checklist to decide if you are ready.https://ulab24.com/writing/seven-small-rules-for-a-boring-login-server/https://ulab24.com/writing/seven-small-rules-for-a-boring-login-server/Fri, 09 Oct 2026 00:00:00 +0000Identity is the one place you want no surprises. These are the rules that keep ids dull in the best way.https://ulab24.com/writing/why-passkeys-come-first/https://ulab24.com/writing/why-passkeys-come-first/Fri, 09 Oct 2026 00:00:00 +0000Passwords fail in the same ways every time. Here is why the identity server in the lab starts from passkeys instead of adding them later.https://ulab24.com/writing/one-binary-no-ceremony/https://ulab24.com/writing/one-binary-no-ceremony/Mon, 05 Oct 2026 00:00:00 +0000Why every tool in the lab ships as a single Go binary, and what that does for your next 3 a.m. deploy.