PostgreSQL 19 release date moves to 19 November: what was cut, what shipped, and how to test the RC
PostgreSQL 19 is now due on 19 November. What was reverted, what shipped, the defaults that change, and how to test your cluster against RC 1.
System architecture
Data models, migrations and the decisions that are expensive to reverse.
System architecture articles
ChatGPT share-link account takeover: the postMessage bug, and how to secure your own listeners
How a ChatGPT share link ran code as chatgpt.com through MathLive's postMessage listener, and the listener, iframe and CSP fixes for your own app.
Northflank breach: what to rotate first, and how to check whether your AI keys were abused
Northflank says assume every environment variable was decrypted. What to rotate first, how to spot abused AI keys in CloudTrail, and how to scope the next one.
Binance $6.3B hack explained: how EIP-7702 delegation emptied a hot wallet, and how to guard your signer
How 50 pre-signed EIP-7702 authorizations emptied a Binance hot wallet, what Binance has said, and the signer checks that would have refused them.
KV cache leak on Cloudflare Workers AI: how an SGLang bug served other users' data, and how to check your stack
How a KV pool smaller than GLM-5.3's context and an SGLang bug leaked users' data on Workers AI, and how to harden PD serving.
Android SMS of Death: how one WAP Push text crashes the phone process, and the patch Google calls won't fix
How the SMS of Death WAP Push bug crashes com.android.phone, why it loops for days, what the AOSP fix changes, and how to check your patch level.
Stalwart 1.0 mail server: what's new, the benchmarks, and how to upgrade from 0.16
Stalwart 1.0 is out: what's new, how its benchmarks against Postfix and Dovecot hold up, and how to migrate from 0.16 with stalwart-migrate.
OpenSSL 4.1.0 released: DTLS 1.3, GREASE, and what breaks when you upgrade
OpenSSL 4.1.0 adds DTLS 1.3 and GREASE and drops the CN fallback in host-name checks. What breaks, how to test it, and which version to run.
eMudhra's weak CA keys: why emSign ECC Root CA - G3 is distrusted, and how to replace affected certificates
eMudhra's CA keys were numbers below 256. Why that breaks P-384, what the emSign ECC G3 distrust breaks, and how to replace affected certificates.
DeepInfer explained: how DeepSeek's open-source inference engine serves V4.1 Flash, and what it takes to run it
DeepSeek open-sourced DeepInfer, the engine behind V4.1 Flash: what it includes, what it leaves out, the hardware it needs and how to run it.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): which PHP servers are exposed and how to patch today
PHP2Shell is two pre-auth RCE bugs in PHP itself. Which versions fix them, which servers are most exposed, and what to set if you cannot update today.
OpenCode Console breach: which API keys were exposed, and how to rotate them without an outage
What the OpenCode Console breach exposed, who is affected, and a safe order for rotating OpenAI, Anthropic and Google API keys.
NIST P-256 seed origin solved: how lrand48 and a 1997 timestamp made the ECDSA curves, and what it means for you
The NIST P-256 seed came from lrand48 and a 1997 timestamp. Rebuild it in Python and C, and see what it means for the ECDSA keys you use.
PostgreSQL 19 delayed to 19 November: what was reverted, what AI review had to do with it, and what to test in RC 1
PostgreSQL 19 now ships on 19 November. What was reverted and why, AI review's real role, and the checks to run before testing RC 1.
Microsoft's record October 2026 Patch Tuesday: how to triage 1,400 CVEs with exploit status, risk cohorts and VEX
October's Patch Tuesday fixed about 1,400 CVEs. A triage order, what risk cohorts miss, VEX, and a script that sorts the release.
Postgres isn't slow, your storage is: how to find disk waits with pg_stat_io
How to tell if PostgreSQL is waiting on storage with wait events, pg_stat_io and iostat, and what moving to local NVMe costs.
Supermarket fridge hack: how exposed Danfoss controllers were pushed to 50°C, and how to find yours
How the French supermarket fridge attack reached Danfoss controllers, what the known CVEs allow, and how to find and close the same exposure.
DuckDB 2.0 alpha: where the speed-ups come from, and what to test before it ships
Why DuckDB 2.0 reads S3 up to 3x faster, runs recursive queries in a tenth of a second, and where VARIANT is still slower than JSON.