PSF Hires New Security Developer, Funded by Anthropic
The PSF has added Brett Smith as a new Security Developer to keep pace with a sharp rise in security reports and malware on PyPI throughout 2026.
Notes
Written for the next person with the same problem.
Engineering, management, weekend R&D and the occasional detour. Pick a category, narrow by tag, or search for a word.
Security Roundup Nov 6-7: SSHole, Axis2, Allura, Tryton, Python
From the OpenSSH SSHole flaw that was already being exploited within hours, to a 31-bit key in InfiniteWP, and three CVEs in Apache Axis2 — here's what to patch first.
Vitekube: Vitest Tests Running on a Real Kubernetes Cluster
A community project that makes Kubernetes tests feel like unit tests: the cluster stays alive, rebuilds only what changed, and failure evidence shows up automatically in the output.
eMudhra CA incident: how the Python ecosystem responded
The eMudhra intermediate certificate leaked, and certifi, pip, and Python had to be patched together because they depend on each other along the package bootstrap path.
Podman v5.8.9: Fix WSL3 and CVE in gvproxy
Podman v5.8.9 patch release fixes Podman on WSL3, addresses Mac machines that could become corrupted if start is interrupted, and patches CVE-2026-107935 in gvproxy.
Security Recap Nov 4 2026: Node-RED, cPGuard, Rails, Barracuda
Node-RED CVSS 10 is already being exploited in the wild and a cPGuard update was hijacked into a backdoor this week; Rails, Barracuda, and ActiveMQ also have critical-to-high bugs that need patching right away.
How JetBrains Evaluates KotlinConf Talk Proposals
JetBrains shares tips from KotlinConf organizers and speakers on how to write a strong CFP proposal, not just an attractive one.
Elephant-Goldfish Model in GAOS: a design gate for a platform that runs its own agents
GAOS runs agents but never reviewed a design before building it. I had five zero-context reviewers attack the design that introduced the gate. Ten defects in the workspace, four more in my own audit.
I ran a goldfish review on my own agent roster, and it found 52 errors
This repo is where I learned AI. It grew to 136 agents and 191 skills. A zero-context reviewer found 52 errors my own validation never caught.
Elephant-Goldfish Model: a hands-on tutorial, tested on my own agents
Google's EGM has a full-context agent draft the design and zero-context reviewers attack it before any code is written. I installed it, ran it on this site's own agent setup, and it found three blockers I had missed.
Astra: When LLMs Can Read and Write Neural Network Weights
MIT CSAIL research shows that GPT-6 Astra can edit neural network weights directly through natural language, raising Qwen3.5-0.8B's MATH-500 score from 7.9% to 48.1%.
PHP2Shell: Palo Alto Rooted, WordPress Gets Away
I read a report on mass exploitation of the PHP2Shell bug — total success against Palo Alto firewalls via exploit chaining, but almost always failing against WordPress despite tens of thousands of attempts.
JDK 28 and Value Classes: Compatibility Impact
JDK 28 introduces value classes as a preview feature. This change affects object identity, synchronization, record constructors, and requires testing in both preview modes.
Ginux: A New Rust-Based Kernel with a Linux User Space
Ginux is a Rust-based x86-64 kernel built from scratch in 11 days with AI, while still running Linux binaries through the Linux ABI.
mkinitcpio 42 and TPM2-Based LUKS Unlocking
The mkinitcpio 42-1 update changes PCR measurements, so certain TPM2 unlock scenarios for LUKS require re-enrollment.
Summary of Critical CVEs and Key Security Risks
A summary of recent security incidents: a Linux kernel vulnerability with a CVSS score of 9.8, a DHS data leak, exposed cloud credentials, and SQL injection vulnerabilities in Apache Fineract and OpenStack. Prioritize Linux servers, Fineract, and OpenStack first.
Kotlin/Wasm Tail Calls and the Kotlin Education Map
GSoC 2026 resulted in tail call support for Kotlin/Wasm and a structured database for tracking Kotlin’s spread in education.
Maven Build Cache in Azure DevOps: From 18 Minutes to ~9 Minutes
Info Support shares their experience setting up Maven Build Cache in Azure DevOps: missing target dir issues, SonarCloud conflicts, PR build time dropped from 18 to ~9 minutes.
Gemini 4 Carbon: Google Ramps Up Its Cybersecurity and Agentic Model
Google has released Gemini 4 Carbon, the successor to Argon, claiming the best cybersecurity and agentic scores yet, but the initial rollout is limited to select cyber defenders.
Two Vulnerabilities in golang.org/x/net/html: DoS & Namespace Bug
The Go security team released two CVEs in golang.org/x/net/html: a quadratic complexity bug when parsing text, and a namespace confusion bug that can change the result of re-parsing HTML.
ca-certificates-mozilla 3.131.1-1: closing an MITM gap from CA eMudhra
Arch Linux is urging an immediate upgrade to ca-certificates-mozilla ≥ 3.131.1-1 after an intermediate certificate from CA eMudhra was found to be leaked and could be used for man-in-the-middle attacks.
Podman v6.2.0-RC1: A Major RC Heading Toward Podman 7.0
Podman v6.2.0-RC1 adds --platform to push, new options in kube play and Quadlet, while preparing several major deprecations on the road to Podman 7.0.
Security Roundup Oct 26: PHP2Shell Active, Brotli, eMudhra
PHP2Shell has already produced real shells on a honeypot, Brotli got hit with a CVSS 9.2 that spread across many stacks, and Go rushed out a patch for the eMudhra PKI incident within hours.
Reactor Kotlin Extensions 1.3.3
Release 1.3.3 updates the Reactor Core and Reactor Addons dependencies and is part of several 2025 and 2026 release trains.
Podman v6.1.3: Checkpoint Image Support Dropped Due to a Security Bug
Podman 6.1.3 patches CVE-2026-94603, which could disable sandboxing via a checkpoint image, and at the same time drops checkpoint image support from podman run.
JetBrains Discontinues IDE Support for Swift in the KMP Plugin
JetBrains is removing Swift editing, syntax highlighting, and navigation features from the Kotlin Multiplatform plugin starting with IntelliJ IDEA 2026.3, because developers prefer to use Xcode for Swift code.
Go 1.27 Fixes Silently Failing HTTP/1 Connection Reuse
Go 1.27 makes net/http automatically drain unread HTTP/1 response bodies, so connection reuse works again and requests can be up to 5x faster.
BeamFS: A Proposed Linux Filesystem That Can Repair Corrupted Data
Aurelien Desbrieres proposes BeamFS, a filesystem that stores Reed-Solomon codes in every block to correct damaged bits on read, suited for satellite computers and radiotherapy rooms.
OWASP Java Encoder & HTML Sanitizer: Time to Update
Jim Manico has released Java Encoder 1.6.0 and HTML Sanitizer 20261011.1, and is asking the Java community to re-check these two anti-XSS libraries before they end up as forgotten dependencies.
PSF Revives the Python Wiki Through GitHub Pages
PSF has relaunched the PSF, Python, and Jython wikis, which had been locked read-only since February 2026, now as a static site on GitHub Pages with contributions via pull request.
Python 3.15 Unifies Built-in Profilers Through the New profiling Module
Python 3.15 merges the Tachyon sampling profiler and the tracing profiler (formerly cProfile) into a single profiling module, while also retiring the old profile module.
Security Roundup Oct 23: Pillow, Node2Shell, LiteLLM, GitLab
This week there are critical RCEs in Pillow, Node.js, and Ruby/GitLab, plus LiteLLM which briefly spread malware through the official 1.107.0 package. Prioritize those three RCEs, then check LiteLLM.
OpenZPL: A Drop-in Replacement for Labelary to Render ZPL Labels
OpenZPL lets you preview and convert ZPL labels to PNG/PDF via the browser or an API, and can be a direct replacement for Labelary just by swapping the hostname.
This Week's Security Roundup: A String of RCEs & an OpenJDK CA Zero-Day
This week brings a wave of RCEs: Ruby/GitLab, Node.js (brotli), and an unpatched auth bypass in Apache Vysper, plus a CA zero-day in OpenJDK.
JDK 28: Off-Heap Confined Arena Allocation Can Be 6-18x Faster
JDK 28 adds native-memory pooling for confined arenas in the FFM API, cutting small-allocation latency by up to 90% without requiring any code changes at all.
OpenShell: NVIDIA's Kernel-Level Sandbox for Autonomous AI Agents
NVIDIA released OpenShell, a runtime that isolates AI agents through kernel-level control and formally verifies policy changes before they're applied.
Kotlin Toolchain 0.13: Officially Recommended for New KMP Projects
JetBrains now recommends Kotlin Toolchain 0.13 for new KMP projects, featuring the kotlin new command, Kotlin/Native compiler caching, and SwiftPM support.
Podman v6.1.4: Fix WSL Bug and Patch CVE in gvproxy
This Podman v6.1.4 patch release fixes a fatal bug in WSL and patches one CVE in gvproxy, plus bumps the versions of Buildah and Storage - worth the upgrade if you use Podman on Windows.
Linux Kernel 7.3: Good News for Gamers with Limited VRAM
Linux 7.3 brings a new mechanism for GPUs running out of VRAM, plus KSM and zsmalloc lock fixes that make the system far more responsive.
Hello, World
The first note on this site: what I plan to write here, and why the posts now live in a real database.