Notes from the workshop.
What I'm learning while building: Go, self-hosting, identity, and the quiet craft of shipping software that lasts. Take whatever helps.
ACP and MCP: two sides of an agent
The Agent Client Protocol connects coding agents to the apps you work in. The Model Context Protocol connects them to tools and data. What ACP is, how it works on the wire, how it differs from MCP, and when you need which.
Node2Shell: the Brotli bug reaches beyond Node
The decompression flaw fixed in Node.js on 21 October lives in Google's Brotli library, so Bun, Python, Envoy and Istio are affected too. A public proof of concept exists. Here is what to patch.
PHP2Shell: the unpatched majority
Four days after PHP2Shell was patched, most internet-facing PHP hosts report a version that never got an official fix. What that means, what the attacks look like, and your options.
Two perfect tens in nine days: GitLab's regex engine
GitLab fixed two related CVSS 10.0 flaws in its CI/CD regular-expression engine on 12 and 21 October. The first patch release is not enough. Here is what to check if you run it yourself.
AI finds bugs faster than we patch
Machine-assisted bug hunting is producing tens of thousands of findings. Fixing them is the bottleneck. What the numbers say, what they do not, and how a small team keeps up.
Go: fifteen fixes in one release
Go shipped fifteen security fixes on 8 October: crashes, a proxy mix-up, a module checksum bypass and more. What they allow, and why every Go program needs a rebuild.
Node.js: ten fixes in one day
Node.js shipped ten security fixes on 21 October, four rated high. What they cover, what they could mean for your servers, and the update to make.
PHP2Shell, explained
A critical remote-code-execution flaw in PHP, a language behind roughly seven in ten websites. What it is, why details leaked a day early, and what to do about it now.
The week the foundations shook
In three weeks of October 2026 the web's most common building blocks (PHP, Node.js, Go and the certificate system) all needed urgent attention. One story, five deep dives, and a checklist you can finish today.
When Go stopped trusting eight CA keys
On 20 October Go blocked eight certificate-authority keys in a point release. Rebuilt programs may refuse sites that older binaries still accept. Here is what to check.
Stuck on something I've written about? Tell me where it hurts.