Notes from the workshop.
What I'm learning while building: Go, self-hosting, identity, and the quiet craft of shipping software that lasts. Take whatever helps.
Node2Shell: the Brotli bug reaches beyond Node
The decompression flaw fixed in Node.js on 21 October lives in Google's Brotli library, so Bun, Python, Envoy and Istio are affected too. A public proof of concept exists. Here is what to patch.
PHP2Shell: the unpatched majority
Four days after PHP2Shell was patched, most internet-facing PHP hosts report a version that never got an official fix. What that means, what the attacks look like, and your options.
Two perfect tens in nine days: GitLab's regex engine
GitLab fixed two related CVSS 10.0 flaws in its CI/CD regular-expression engine on 12 and 21 October. The first patch release is not enough. Here is what to check if you run it yourself.
Go: fifteen fixes in one release
Go shipped fifteen security fixes on 8 October: crashes, a proxy mix-up, a module checksum bypass and more. What they allow, and why every Go program needs a rebuild.
Node.js: ten fixes in one day
Node.js shipped ten security fixes on 21 October, four rated high. What they cover, what they could mean for your servers, and the update to make.
PHP2Shell, explained
A critical remote-code-execution flaw in PHP, a language behind roughly seven in ten websites. What it is, why details leaked a day early, and what to do about it now.
The week the foundations shook
In three weeks of October 2026 the web's most common building blocks (PHP, Node.js, Go and the certificate system) all needed urgent attention. One story, five deep dives, and a checklist you can finish today.
Seven small rules for a boring login server
Identity is the one place you want no surprises. These are the rules that keep ids dull in the best way.
Stuck on something I've written about? Tell me where it hurts.