Writing · Indra Gusti Prasetya

SecurityOctober 20, 202611 min read

x509: no valid chains built: Go 1.27.3 blocks 8 keys

Run go version -m on every Go binary: go1.27.3 compiled eight distrusted CA keys into crypto/x509, and the error names none of them.

TutorialOctober 19, 202610 min read

npm ESTRICTALLOWSCRIPTS: 3 Ways the Gate Stays Green

Set strict-allow-scripts=true to fail npm 12 CI on unreviewed install scripts, and check the 3 settings that silence it: denied packages never fail.

Tips & TricksOctober 16, 20267 min read

Kyverno ClusterPolicy Removal: podSecurity Has No CEL Fix

Run the inventory before Kyverno v1.20 removes ClusterPolicy: validate.podSecurity has no CEL equivalent, and the new seccomp rule admits Pods PSA denies.

Tips & TricksOctober 16, 20269 min read

pnpm publish missing files: 4 packlist fixes in 6 days

Diff pnpm pack against npm pack --dry-run before publishing: pnpm 12's Rust packlist can ship lib/index.js alone, and the registry accepts it.

SecurityOctober 14, 20269 min read

Agentjacking: Sentry MCP's Public DSN Reaches a Shell

Rotate the DSN on any project an MCP server reads: Sentry calls it safe to publish, but it is an unauthenticated write into your agent's shell.

TutorialOctober 13, 202610 min read

Fix uv 0.13.0 sdist hard links: the tarball is legal

Audit uv.lock for sdists with hard-link members before upgrading: uv 0.13.0's new tar backend rejects them, and only on a cold cache.

Tips & TricksOctober 12, 20269 min read

Fix Starlette CVE-2026-48710: 1.0.1 Misses the Sibling

Run 11 checks on CVE-2026-48710: it sits on CISA KEV at CVSS 6.5, FastAPI sets no Starlette floor, and the sibling CVE needs 1.3.0, not 1.0.1.

DevOpsOctober 9, 202610 min read

npm OIDC "package not found": your sub claim changed

Run gh api on your repo's sub claim: npm's "OIDC token exchange error - package not found" is a publisher mismatch, not a missing package.

TutorialOctober 9, 202611 min read

next/font/google queries have exactly one entry: 1 bad URL

Reproduce a random next/font build failure on demand with NEXT_FONT_GOOGLE_MOCKED_RESPONSES, then kill it: Google serves 1 in 60 fonts with no extension.

Tips & TricksOctober 7, 20268 min read

Node 26 LTS on Oct 28: node:lts Moves Without a Commit

Node 26 becomes Active LTS on 28 October, so lts/* and node:lts switch runtimes with no commit. Pin the major, rebuild native addons: ABI is now 147.

SecurityOctober 6, 20269 min read

core.fsmonitor RCE: 4 Agent Patches, 4 Different Key Lists

Pin core.fsmonitor and you close one route of two. Git treats .git/config as untrusted, and four shipped agent patches pin four different key lists.

TutorialOctober 5, 20269 min read

Fix patch-package "status: 1" on npm 12: EALLOWREMOTE

Run npm_config_allow_remote=all to prove patch-package's empty status: 1 is EALLOWREMOTE on npm 12, then move the patch into npm's patchedDependencies.

Tips & TricksOctober 2, 20268 min read

containerd 1.x on Kubernetes 1.38: kubelet refuses to start

Kubernetes 1.38 drops the cgroupDriver fallback, so containerd 1.x nodes never join. Run crictl runtime-config to find them, plus the gate that buys time.

TutorialSeptember 30, 202610 min read

invalid peer certificate: UnknownIssuer: pnpm 12.6 bug

Unset NODE_EXTRA_CA_CERTS and retry: on slim images pnpm 12.6 to 12.8.1 treats it as a replacement trust store. 12.8.2 fixes it. Three causes, one test.

DevOpsSeptember 29, 202610 min read

pnpm build scripts not running: another project ran them

Run pnpm install --side-effects-cache=false to tell which of three 12.x bugs skipped your postinstall. A fresh node_modules no longer re-runs builds.

TutorialSeptember 28, 202610 min read

"The runner no longer exists": exit 0, .runner deleted

Grep _diag and check .runner to find which of 4 causes killed your self-hosted runner. It exits 0, so systemd leaves the host looking healthy.

Tips & TricksSeptember 25, 20267 min read

Kubernetes 1.37 Drops 18 Kubelet Flags: Nodes Never Join

Run kubelet --help on the 1.37 binary to catch the 18 removed cAdvisor flags before a node dies at parse. eventRecordQPS 0 now means unlimited.

Tips & TricksSeptember 25, 20268 min read

Fix RAG Access Control: Your Chunks Carry No ACL

Filter RAG retrieval per principal: project ACLs onto every chunk, key the semantic cache on the principal, and prove it with a nightly canary suite.

DevOpsSeptember 23, 20269 min read

Webpack 5.111 Top-Level Await Fix Skips Async Cycles

Turn on output.strictModuleErrorHandling: webpack 5.111 awaits async ESM entries by default, but a failed async cycle still hands out fulfilled exports.

DevOpsSeptember 22, 20269 min read

"Acknowledging runner request": 4 Bugs, 1 Stuck Slot

Run pgrep -f Runner.Worker to tell four GitHub Actions runner hangs apart: only acquirejob has no timeout, and the stuck pod keeps its ARC slot.

TutorialSeptember 21, 202610 min read

GitHub Actions Node 20 removal: node20 now runs on Node 24

Hosted node20 actions do not fail after 23 September 2026, they run on Node 24 and the opt-out is inert. Plus exec /__e/node20/bin/node on container jobs.

TutorialSeptember 21, 20268 min read

Fix npm EALLOWGIT: allow-git=root Covers 1 of 4 Causes

Run one jq query on package-lock.json to name every git spec, then pick the fix: allow-git=root only works when the error omits the word non-root.

DevOpsSeptember 18, 20269 min read

pnpm readPackage Edits Leak to Deps You Never Matched

Upgrade to pnpm 11.27.0. Before it, readPackage got the cached manifest by reference, so one in-place edit landed on every dependent on that version.

TutorialSeptember 18, 202610 min read

Fix Terraform 1.16.3 binary/octet-stream: the zip is fine

Curl the release URL: 1.16.3 serves binary/octet-stream, not application/zip. The zip is valid; hc-install's MIME allowlist rejects it. Three fixes.

SecuritySeptember 17, 20267 min read

70% of My Analytics Was a Bot That Ran My JavaScript

A headless proxy pool fired my GA4 tags and passed as readers for months. How I measured it, why the obvious marker would have lied, and the layer the block had to sit at.

TutorialSeptember 16, 20269 min read

Fix uv "Cannot install into symlinked directory" in 0.12.14

Upgrade to uv 0.12.15 to fix Cannot install into symlinked directory: /usr/local/man in python:* Docker images and .venv/lib64 on uv 0.12.14.

TutorialSeptember 16, 202610 min read

Fix ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR: 4 causes

Upgrade pnpm to 12.4.2 to stop "Access is denied. (os error 5)" on Windows node_modules purges. A retry often succeeds, which hides the real bug.

SecuritySeptember 16, 20267 min read

npm 12 Rollout: What Breaks After CI Goes Green

The npm 12 install-script lockdown fails quietly across a repo estate. The order to roll it in, what each failure costs in production, and the CI gates.

TutorialSeptember 15, 202611 min read

Fix "NVIDIA-SMI has failed" in a Kubernetes DRA Pod

Your DRA pod prints NVIDIA-SMI has failed while the host GPU is healthy. Grep the claim's CDI spec, create the device nodes, restart the plugin.

Tips & TricksSeptember 14, 20268 min read

MCP Tool Permissions: 10 Tips to Prove Agent Write Access

Scope MCP tool permissions by token and prove it: readOnlyHint is only a claim the server makes about itself. 10 tips with runnable checks.

Tips & TricksSeptember 11, 20269 min read

Stop Kubernetes Admission Control Failing Open: 11 Tips

Run these checks to prove Kubernetes admission control is enforced: fail-open metrics, failurePolicy Ignore audit, ValidatingAdmissionPolicy, RBAC.

Tips & TricksSeptember 11, 20269 min read

Pin GitHub Actions by SHA: 10 Gaps the Pin Leaves Open

Pin GitHub Actions by SHA, then close the 10 gaps the pin leaves: impostor commits, unverified provenance, and the checks that prove it in CI.

Tips & TricksSeptember 9, 20268 min read

Cyber Resilience Act Reporting: 10 Tips for Sept 11

Cyber Resilience Act reporting starts 11 September 2026. Ten tips for the 24-hour clock, naming the right coordinating CSIRT, and a platform with no API.

Tips & TricksSeptember 8, 20269 min read

OWASP LLM Top 10 2026: Your LLM06 Now Points at the Wrong Risk

8 of 10 OWASP LLM identifiers changed on 3 August 2026. If your policy says LLM06, it now points at Unbounded Consumption, not Excessive Agency.

Tips & TricksSeptember 7, 20268 min read

kube-proxy IPVS to nftables: Fix 11 Traps in 1.40

Set kube-proxy mode explicitly before Kubernetes 1.40 disables IPVS: nftables drops NodePort on secondary node IPs and silences your sync-failure alert.

CloudSeptember 4, 20268 min read

Fix kubelet "not run on a host using cgroup v1" on v2

Run stat -fc %T /sys/fs/cgroup to see what the kubelet sees: hybrid mounts and unapplied GRUB edits both read as cgroup v1 on a v2 host.

DevOpsSeptember 4, 202610 min read

Fix docker save "no suitable export target found"

Run two commands to split the four causes behind docker save --platform failing on Docker 29's containerd image store, then export a tar that actually loads.

TutorialSeptember 3, 202612 min read

Fix "Xid 154, GPU recovery action changed" on GPU Nodes

Read the hex in the Xid 154 line to tell an nvidia-smi -r reset from a node reboot, and stop dcgm-exporter from hiding the Xid that actually failed.

DevOpsSeptember 2, 20268 min read

Fix pnpm deploy "Cannot find module" in Docker on 11.19

pnpm deploy 11.19 to 11.21 symlinks workspace packages out of your Docker image. Run one find to catch the dangling link, then upgrade to 11.22.0.

DevOpsSeptember 1, 202610 min read

Fix TypeScript 7 Out of Memory: error TS7056 Costs 6x RAM

Set GOMEMLIMIT and drop --max-old-space-size: TypeScript 7's Go tsc uses 2.48 GB where tsc 6 used 0.41 GB for the same error TS7056, then exits 137.

Tips & TricksSeptember 1, 202610 min read

Cilium 1.19 Upgrade: Fix 12 Traps Before BGP Drops

Run these 12 checks before helm upgrade to Cilium 1.19: ClusterMesh policy scoping flips, BGPv1 CRDs are gone, and five service flags vanish.

DevOpsAugust 31, 202610 min read

Fix Ineffective mark-compacts in Node 24.19.0: 4 Causes

Check the exit code before the error text: 137 means the kernel killed it. Four causes of Node 24.19.0 heap OOM, each with its own separating test.

DevOpsAugust 30, 202610 min read

npm EALLOWREMOTE: Fix Private Registries, Not allow-remote=all

npm 12 flipped allow-remote to none. EALLOWREMOTE on a private registry is fixed by replace-registry-host, not by disabling the supply-chain control globally.

Tips & TricksAugust 29, 20268 min read

npm 12: npm ci Exits 0, build/Release Fails on Deploy

npm 12 exits 0 when it skips a native build, so your pipeline is green and the container crashes. Three causes share the same output; here is how to triage.

DevOpsAugust 28, 202610 min read

Fix ESLint Cannot read properties of undefined (Intrinsic)

Run pnpm why typescript to find which of three trees put TypeScript 7 under typescript-eslint, then fix it with pnpm 12 or an overrides pin.

CloudAugust 28, 20269 min read

Fix conflicting SELinux labels of volume in K8s 1.37

Kubernetes 1.37 mounts PVCs with -o context=, so pods with different SELinux labels stall in ContainerCreating. Run one kubectl check to find them first.

Tips & TricksAugust 27, 20268 min read

pnpm 12 Upgrade: Pin a Version or Workspace Errors Stay Silent

pnpm 12's Rust CLI validates pnpm-workspace.yaml, but only raises a hard error when you pin a version. Without one, a config typo stays a silent warning.

SecurityAugust 26, 20269 min read

Stop Trusting C2PA Content Credentials on Android

Treat verified C2PA Content Credentials as weak evidence: forged manifests pass the official verifier on rooted Pixels. Pin anchors, log the signer.

CloudAugust 25, 20269 min read

Stop Kubernetes DRA Giving One GPU to a VM and a Pod

GPU Operator 26.7 advertises each GPU twice under DRA. Run one kubectl query to spot it, then split the node pool before enabling VFIO.

CloudAugust 25, 20269 min read

Fix "a mirror pod may not reference secrets" in K8s 1.37

Kubernetes 1.37 removes the PreventStaticPodAPIReferences gate. Grep your static pod manifests and kubelet config before a node refuses to start.

DevOpsAugust 24, 202610 min read

Fix Terraform Deposed Object Panic in readDiff on 1.15

Terraform 1.15 apply panics in readDiff on a deposed object. Run one state pull and jq check to find the live orphan before you upgrade to 1.16.

DevOpsAugust 23, 20269 min read

Fix Terraform "The deprecation originates from" Warnings

Terraform 1.15 warns about attributes you never wrote. Run terraform validate -json to tell real deprecations from mark propagation, plus what 1.16 fixes.

TutorialAugust 23, 202611 min read

npm approve-scripts vs --allow-scripts: Opposite Fixes

approve-scripts exits EGLOBAL in global installs; --allow-scripts is refused in projects. Two contradictory errors, one decision rule, and the CI gap.

TutorialAugust 23, 202610 min read

npm allowScripts: the package.json Schema, Not .npmrc

Set allowScripts in package.json to approve npm install scripts: exact schema, pinned vs name-only keys, why ignore-scripts wins, and what .npmrc holds.

SecurityAugust 21, 20269 min read

arrayref Attack Shows cargo build.rs Runs Any Code

Commit Cargo.lock, build --locked, add a 3-day cooldown: the arrayref build.rs ran code during cargo build, and Cargo has no --ignore-scripts.

TutorialAugust 18, 20269 min read

Fix "unrecognized format int32" in Kubernetes 1.34

Kubernetes 1.34 warns 'unrecognized format int32' on valid CRDs. It's a kube-apiserver false positive, not your schema; patch the control plane to fix it.

Tips & TricksAugust 14, 20269 min read

Bound ServiceAccount Tokens: 9 Tips to Kill Static Ones

Move Kubernetes off non-expiring ServiceAccount secrets to bound, projected tokens via the TokenRequest API, and fix the 401s the migration triggers.

DevOpsAugust 11, 202610 min read

npm error edgesOut: Three Causes, One Fixed by node_modules

Three root causes produce this crash; only one clears with node_modules. Run npm install --package-lock-only on a clean checkout to tell them apart.

DevOpsAugust 10, 202610 min read

npm EALLOWSCRIPTS: Use allowScripts, Not --allow-scripts

npm 12 forbids --allow-scripts in project installs. Plain npm install fails too if .npmrc carries the flag. Fix: an allowScripts allowlist in package.json.

DevOpsAugust 10, 20269 min read

Fix npm audit 410 and 'invalid json response body' bugs

Tell the npm audit 410 and 'invalid json response body' gzip bug apart by the URL in the error, and stop a silent audit from passing your CI.

TutorialJuly 15, 202612 min read

Generate an SBOM with Syft, Filter Grype with VEX

Generate a CycloneDX SBOM with Syft, scan it with Grype, and suppress non-exploitable CVEs with VEX not_affected statements in your CI gate.

SecurityJuly 14, 20269 min read

Fix MCP OAuth 2.1 Before the July 28 Rewrite

Only 8.5% of MCP servers use OAuth. Audit audience validation and add the resource parameter before the July 28 OAuth 2.1 spec rewrite lands.

SecurityJuly 10, 202611 min read

Trivy vs Grype 2026: Pick by the Job, Not Speed

Trivy vs Grype in 2026: Trivy scans everything, Grype matches CVEs from an SBOM. Pick by the job, and pin your scanner after Q1's supply-chain hit.

Tips & TricksJuly 7, 202610 min read

GitHub Actions OIDC to AWS: Drop Static Keys for Good

Wire GitHub Actions OIDC to AWS correctly: scope the sub claim, handle the July 15 immutable-claim change, and avoid the trust policy traps tutorials skip.

CloudJuly 3, 20268 min read

Kubernetes Default-Deny Egress Stops Pod Exfiltration

Run a default-deny egress NetworkPolicy to stop a compromised pod from phoning home. Two manifests, one DNS gotcha that breaks it, and the CNI fix.

SecurityJune 30, 202610 min read

Falco vs Tetragon vs Tracee: Pick the Right One

Falco detects, Tetragon enforces in the kernel, Tracee does forensics. Picking one as a drop-in for another is the costly mistake. How to choose.

TutorialJune 29, 202610 min read

Cosign v3: Sign, Verify, and Fix the Harbor Break

Cosign v3 flips three flags by default and breaks Harbor detection. Get the sign-and-verify loop and the two fallback flags that keep CI working.

HardwareJune 24, 202610 min read

DDR5 Memory Shortage 2026: Why RAM Prices Tripled

AI takes only 20% of DRAM wafer capacity but consumes 3x the wafers per GB of HBM, draining DDR5 supply. Here is the planning math.

DevOpsJune 22, 20269 min read

OpenAI Codex Bug Is Writing 640 TB/Year to Your SSD

A TRACE logging default writes 640 TB/year to ~/.codex/logs_2.sqlite. Here is how to check your disk wear and stop it.

SecurityJune 21, 20267 min read

io_uring Security: The Linux Speedup That Hides Rootkits

io_uring skips system calls for speed, and that same trick lets a rootkit run while Falco, Tetragon, and Defender see nothing. Here is how to close the gap.

AIJune 20, 20268 min read

GPT-5.5 Hallucination Rate: 86% Means It Never Abstains

GPT-5.5 scored 57% on knowledge benchmarks and 86% hallucination rate in the same run. Here is what that number actually counts.

RoboticsJune 19, 20268 min read

Humanoid Robots Hit Factory Lines in 2026

Figure's F.02 helped build 30,000 BMWs and Tesla runs 1,000+ Optimus units, but the retired robot in the footnote tells you what's actually shipping.

MobilityJune 18, 20267 min read

Solid-State Battery Companies 2026: Who Is Actually Shipping

Which manufacturers ship semi-solid packs today versus who is still at pilot stage. The chemistry gap, commercialization status, and key players ranked.

AIJune 17, 202615 min read

AI Compute Costs in 2026: Power and the Serving Stack

AI compute cost in 2026 is decided by tokens per watt, the serving stack, and the grid, not the chip. Here is the math that survives finance.

AIJune 16, 20268 min read

Multi-Provider LLM Fallback Done Right in 2026

Anthropic retired Claude Opus 4 on June 15 and a directive killed Fable 5 in hours. Your model ID runs on two clocks, and a naive fallback fails both.

Tips & TricksJune 15, 20266 min read

Agentic SOC in 2026: 10 Tips for Safe Triage

Battle-tested agentic SOC tips: gate autonomy on 90% shadow-mode concordance, split verdict from action, and treat every log line as attacker-authored.

SecurityJune 15, 20268 min read

A2A Agent Card Poisoning: JWS Proves Origin, Not Intent

A signed A2A agent card still lets attackers inject instructions into the description field your orchestrator feeds directly to the LLM router.

TutorialJune 14, 20268 min read

Fission CVE-2026-50566: Stop the Container Escape

Find, patch, and block the CVSS 9.9 Fission container escape (CVE-2026-50566) on Kubernetes with version 1.24.0, Pod Security Standards, and a Kyverno rule.

SecurityJune 14, 20268 min read

AI Browser Prompt Injection Hands Over Your Sessions

One crafted URL drained Comet's Gmail and ChatGPT Atlas blocked just 5.8% of phishing. Agentic browsers run with all your logged-in sessions, and that is the bug.

SecurityJune 14, 202610 min read

Post-Quantum TLS Is Already On, and It Broke Your Router

Post-quantum TLS (X25519MLKEM768) already negotiates by default, and the operator problem is a 1,400-byte ClientHello that fragments and breaks SNI routing.

Tips & TricksJune 13, 20269 min read

AI Fuzzing: OSS-Fuzz-Gen Writes the Harness, You Run It

The same AI fuzzers driving June's 206-CVE record run on a laptop with one LLM key. OSS-Fuzz-Gen, Buttercup, Atheris, ten exact commands.

AIJune 13, 20268 min read

Fable 5's Shutdown Means Your Model Is Revocable

A US directive disabled Anthropic's Fable 5 and Mythos 5 in hours on June 12, 2026. The operator lesson is supply-chain continuity, not the jailbreak.

SecurityJune 12, 20267 min read

GreatXML BitLocker Bypass Means TPM-Only Is the Bug

An unpatched WinRE exploit, GreatXML, bypasses BitLocker on any Windows 11 machine that ran a Defender offline scan. The fix is TPM+PIN, not a patch.

SecurityJune 12, 20268 min read

MCP RCE Lives in the SDK, and No Patch Is Coming

A remote code execution flaw sits in Anthropic's official MCP SDKs across 150M downloads. It's stdio command execution by design, and Anthropic calls it expected.

TutorialJune 12, 202612 min read

GR00T N1.7's ZMQ Port Is an Open Robot Remote Control

The default Isaac GR00T N1.7 inference server binds to 0.0.0.0:5555 with no auth. Here is how to lock it to loopback behind mutual TLS.

SecurityJune 11, 20268 min read

Patch Tuesday Hit 206 CVEs and Broke Your Cadence

Microsoft's June 2026 Patch Tuesday fixed a record 206 CVEs and 3 zero-days. The real shift is AI-found bugs outrunning the human patch cycle.

Tips & TricksJune 11, 20266 min read

PgDog: Connection Pooling, Read Splits, and Sharding

PgDog sits in front of unmodified Postgres as a pooler, read/write balancer, and sharder. Here are the sharp edges to map before it hits production traffic.

SecurityJune 10, 202610 min read

AI Agent Identity Needs SPIFFE and OAuth, Not One Key

The fix for AI agent identity is two layers: SPIFFE proves what the agent is, OAuth token exchange proves what it may do right now and for whom.

TutorialJune 10, 202615 min read

npm allowScripts warning: fix "install scripts not covered" on npm 12

npm allowScripts warning on npm 12: run npm approve-scripts --allow-scripts-pending, approve what you trust, and set strict-allow-scripts so installs fail loudly.

SecurityJune 9, 20268 min read

Hunting Shadow AI Before It Becomes Your Breach Path

Shadow AI now factors into 1 in 5 breaches and adds $670K in cost. Why banning tools backfires, and how to actually find ungoverned GenAI in 2026.

Tips & TricksJune 9, 202610 min read

OWASP API Top 10: Shadow APIs and BOLA Tips for 2026

Battle-tested OWASP API Security Top 10 tips for 2026: hunt shadow and zombie APIs at runtime, test BOLA in CI, and close the gaps that breached Optus.

SecurityJune 8, 20268 min read

EU AI Act High-Risk Rules Hit August 2, 2026

The EU AI Act's high-risk obligations become enforceable on August 2, 2026, a deferral isn't law yet, and ISO 42001 won't cover you. Here's the engineering work.

TutorialJune 8, 202610 min read

Tetragon 1.7 Runtime Enforcement: Block Processes in the Kernel

Build a Tetragon TracingPolicy that kills a process at the kernel before it reads a secret, plus the CONFIG_BPF_KPROBE_OVERRIDE gotcha that breaks it.

DevOpsJune 8, 20268 min read

Backstage vs Port vs Cortex: When to Stop Self-Hosting

Backstage owns 89% of the IDP market but averages 10% internal adoption. Here's when self-hosting your developer portal stops paying off.

Tips & TricksJune 7, 20269 min read

Prompt Injection Defense: 10 Tips That Hold Up

Why LLM agent guardrails fail under adaptive attack, and the architectural patterns that actually contain prompt injection in 2026.

TutorialJune 7, 202611 min read

Migrate Ingress-NGINX to Gateway API Before Retirement

Migrate Ingress-NGINX to Gateway API before its March 2026 retirement: ingress2gateway 1.0, Envoy Gateway, and the annotations that silently drop.

TutorialJune 6, 202610 min read

Kubernetes User Namespaces GA: hostUsers false Node Prep

Kernel 6.3 (not 5.12), containerd 2.0+, and /etc/subuid setup for Kubernetes 1.36 user namespaces. Covers the silent failures that cost you an afternoon.

DevOpsJune 6, 20268 min read

Sandboxing AI Agent Code: A 2026 Runtime Guide

AI agent sandboxes isolate untrusted AI-generated code with Firecracker microVMs and gVisor. Here's how to pick an execution runtime in 2026.

Tips & TricksJune 6, 20269 min read

Kubernetes Hardening 2026: RBAC, PSS & Unfixed CVEs

Kubernetes hardening for 2026: enforce Pod Security Standards, fix over-permissive RBAC, default-deny networking, and mitigate the CVEs nobody will patch.

SecurityJune 6, 20265 min read

The 2026 AI-Agent and Infrastructure Security Checklist

A practitioner's running checklist for 2026: agent identity, sandboxing untrusted code, dependency cooldowns, and the post-quantum deadlines, each tied to one concrete action.

TutorialJune 6, 202610 min read

Harden MCP Servers Against Tool Poisoning

A practical 2026 guide to securing MCP servers: inspect tool descriptions, scan for poisoning, pin versions against rug pulls, and add a runtime guardrail.

Tips & TricksJune 6, 202610 min read

Non-Human Identity Governance: Field Tips for 2026

How to discover, scope, and govern service accounts, API keys, tokens, and AI agents before machine credentials become your breach path.

SecurityJune 5, 20264 min read

The AI Agent You Deployed Last Quarter Is Probably Your Weakest Login

88% of enterprises hit an AI agent security incident in the past year. The cause isn't exotic attacks, it's identities nobody logged out or audited.

SecurityJune 5, 20267 min read

Dependency Cooldowns Beat Fast Supply Chain Attacks

Dependency cooldowns delay installing brand-new package versions a few days, blocking most npm and RubyGems supply chain attacks before malware lands.

SecurityJune 5, 20265 min read

RSA Is on a Clock Now: The 2026 Deadlines Forcing the Post-Quantum Switch

NIST's finalized post-quantum standards plus FIPS and CNSA 2.0 deadlines put RSA and ECC on a countdown. Here's why 2026 is the year to start migrating.

DevOpsJune 5, 20268 min read

Durable Execution Is Moving Into Postgres

Microsoft's pg_durable, DBOS, and Temporal are pushing crash-proof, exactly-once workflows into Postgres in 2026. Here's how to choose.

AIJune 5, 20265 min read

WebMCP Hands Your Site's Tools to AI Agents, and Chrome 149 Just Made It Real

Chrome 149's origin trial ships WebMCP, the Google, Microsoft API that lets sites declare callable tools to AI agents instead of being screenshotted and guessed at.

DevOpsJune 2, 20268 min read

Leading Technical Teams: Innovation and People, In Balance

A decade of lessons moving from engineer to leader on building teams that can run the systems they ship, under pressure, without you in the room.

CloudMay 28, 20265 min read

Principles for Building Secure and Scalable Infrastructure

A decade of lessons on balancing security, reliability, and the room to grow, with the specific habits that actually hold up at 3 a.m.

Field Notes.

x509: no valid chains built: Go 1.27.3 blocks 8 keys

npm ESTRICTALLOWSCRIPTS: 3 Ways the Gate Stays Green

Kyverno ClusterPolicy Removal: podSecurity Has No CEL Fix

pnpm publish missing files: 4 packlist fixes in 6 days

Agentjacking: Sentry MCP's Public DSN Reaches a Shell

Fix uv 0.13.0 sdist hard links: the tarball is legal

Subscribe to the Technical Journal

Fix Starlette CVE-2026-48710: 1.0.1 Misses the Sibling

npm OIDC "package not found": your sub claim changed

next/font/google queries have exactly one entry: 1 bad URL

Node 26 LTS on Oct 28: node:lts Moves Without a Commit

core.fsmonitor RCE: 4 Agent Patches, 4 Different Key Lists

Fix patch-package "status: 1" on npm 12: EALLOWREMOTE

containerd 1.x on Kubernetes 1.38: kubelet refuses to start

invalid peer certificate: UnknownIssuer: pnpm 12.6 bug

pnpm build scripts not running: another project ran them

"The runner no longer exists": exit 0, .runner deleted

Kubernetes 1.37 Drops 18 Kubelet Flags: Nodes Never Join

Fix RAG Access Control: Your Chunks Carry No ACL

Webpack 5.111 Top-Level Await Fix Skips Async Cycles

"Acknowledging runner request": 4 Bugs, 1 Stuck Slot

GitHub Actions Node 20 removal: node20 now runs on Node 24

Fix npm EALLOWGIT: allow-git=root Covers 1 of 4 Causes

pnpm readPackage Edits Leak to Deps You Never Matched

Fix Terraform 1.16.3 binary/octet-stream: the zip is fine

70% of My Analytics Was a Bot That Ran My JavaScript

Fix uv "Cannot install into symlinked directory" in 0.12.14

Fix ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR: 4 causes

npm 12 Rollout: What Breaks After CI Goes Green

Fix "NVIDIA-SMI has failed" in a Kubernetes DRA Pod

MCP Tool Permissions: 10 Tips to Prove Agent Write Access

Stop Kubernetes Admission Control Failing Open: 11 Tips

Pin GitHub Actions by SHA: 10 Gaps the Pin Leaves Open

Cyber Resilience Act Reporting: 10 Tips for Sept 11

OWASP LLM Top 10 2026: Your LLM06 Now Points at the Wrong Risk

kube-proxy IPVS to nftables: Fix 11 Traps in 1.40

Fix kubelet "not run on a host using cgroup v1" on v2

Fix docker save "no suitable export target found"

Fix "Xid 154, GPU recovery action changed" on GPU Nodes

Fix pnpm deploy "Cannot find module" in Docker on 11.19

Fix TypeScript 7 Out of Memory: error TS7056 Costs 6x RAM

Cilium 1.19 Upgrade: Fix 12 Traps Before BGP Drops

Fix Ineffective mark-compacts in Node 24.19.0: 4 Causes

npm EALLOWREMOTE: Fix Private Registries, Not allow-remote=all

npm 12: npm ci Exits 0, build/Release Fails on Deploy

Fix ESLint Cannot read properties of undefined (Intrinsic)

Fix conflicting SELinux labels of volume in K8s 1.37

pnpm 12 Upgrade: Pin a Version or Workspace Errors Stay Silent

Stop Trusting C2PA Content Credentials on Android

Stop Kubernetes DRA Giving One GPU to a VM and a Pod

Fix "a mirror pod may not reference secrets" in K8s 1.37

Fix Terraform Deposed Object Panic in readDiff on 1.15

Fix Terraform "The deprecation originates from" Warnings

npm approve-scripts vs --allow-scripts: Opposite Fixes

npm allowScripts: the package.json Schema, Not .npmrc

arrayref Attack Shows cargo build.rs Runs Any Code

Fix "unrecognized format int32" in Kubernetes 1.34

Bound ServiceAccount Tokens: 9 Tips to Kill Static Ones

npm error edgesOut: Three Causes, One Fixed by node_modules

npm EALLOWSCRIPTS: Use allowScripts, Not --allow-scripts

Fix npm audit 410 and 'invalid json response body' bugs

Generate an SBOM with Syft, Filter Grype with VEX

Fix MCP OAuth 2.1 Before the July 28 Rewrite

Trivy vs Grype 2026: Pick by the Job, Not Speed

GitHub Actions OIDC to AWS: Drop Static Keys for Good

Kubernetes Default-Deny Egress Stops Pod Exfiltration

Falco vs Tetragon vs Tracee: Pick the Right One

Cosign v3: Sign, Verify, and Fix the Harbor Break

DDR5 Memory Shortage 2026: Why RAM Prices Tripled

OpenAI Codex Bug Is Writing 640 TB/Year to Your SSD

io_uring Security: The Linux Speedup That Hides Rootkits

GPT-5.5 Hallucination Rate: 86% Means It Never Abstains

Humanoid Robots Hit Factory Lines in 2026

Solid-State Battery Companies 2026: Who Is Actually Shipping

AI Compute Costs in 2026: Power and the Serving Stack

Multi-Provider LLM Fallback Done Right in 2026

Agentic SOC in 2026: 10 Tips for Safe Triage

A2A Agent Card Poisoning: JWS Proves Origin, Not Intent

Fission CVE-2026-50566: Stop the Container Escape