Shopify
Shopify Cut Checkout Bundle Sizes by 85% with Polaris
Shopify rebuilt five Checkout Blocks extensions with Polaris. Bundles fell 40 to 85 percent and load time fell 8 percent at the median.
Rohit Bhadani
I write about why software breaks and how people figure it out. Founder of Krova Cloud, building isolated microVMs on our own hypervisor. Years of Shopify theme work and shared hosting before that. If I have not reproduced it, I do not publish it.
Security
PHP2Shell: Two PHP Core RCEs Need Patch and Restart Now
PHP shipped fixes Oct 21 for CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated RCE. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart.
Security
SiteGuard WAF Bug Exploited: How a Stats Feature Gave Root
Attackers are exploiting CVE-2026-106931 in SiteGuard WAF. The stats feature, on by default, lets a low privileged user run OS commands as root or SYSTEM.
Security
Redis RESTORE Flaw Exploited in the Wild: Patch or Block It
Honeypots caught attackers exploiting CVE-2026-25243 in Redis RESTORE on Oct 16. Any authenticated user with RESTORE can get code execution.
Security
Big Fish: A 37-Year-Old Counter Bug Gave Root on OpenBSD
A 1988 signed 16-bit counter wrapped from 32,767 to -32,643 and gave root on OpenBSD 7.9 with KARL, SMAP and SMEP on. Patches shipped in September.
Security
AI Agents Breached 100 Companies for $5,000
A solo hacker used AI agents to breach 100+ sites for $5,000. Reuters traced the work through exposed Cairn dashboards.
Security
OpenAI Agent Robbed a Crypto Wallet to Pay for Its Own Task
On June 26 an OpenAI model checked 362 wallets from public phrases, found Sepolia test ETH, and paid for a deploy without permission.
Security
ConnectWise Breach: One Credential, 173 Microsoft 365 Tenants
A stolen ConnectWise credential let attackers sign into 173 Microsoft 365 tenants on Oct 15. The OAuth design behind it matters more.
Security
BeyondTrust Zero-Day: Months of Access, Logs That Vanished
A China-nexus group exploited a BeyondTrust Remote Support zero-day since August and erased logs to hide their tracks. The log deletion is the real lesson.
Security
PwnEscape: A Guest VM Read the Host's Memory on Vercel's Sandbox
A critical Linux kernel flaw lets code inside a VM read the host's memory. A researcher proved it on Vercel's live sandbox and Vercel confirmed the result.
DevOps
HTTP Keep-Alive vs TCP Keep-Alive: They Are Not the Same Header
HTTP keep-alive reuses connections for speed. TCP keep-alive detects dead peers. Mixing them up causes timeouts, leaked sockets, and load balancer failures.
Security
Four Bytes and a Timer: Inside the SmartScreen Enclave Break
Researchers used a four-byte write and a timing bug to run code inside the VBS enclave guarding SmartScreen passwords, on the same day Patch Tuesday landed.