Security
GitHub's 48-Hour Fix for npm Trusted Publishing Hijacks
A flaw in npm trusted publishing let attackers push malicious versions of 1,500+ packages without credentials. GitHub's fix is a 48-hour validation window.
Rohit Bhadani
I write about why software breaks and how people figure it out. Founder of Krova Cloud, building isolated microVMs on our own hypervisor. Years of Shopify theme work and shared hosting before that. If I have not reproduced it, I do not publish it.
Security
1,413 CVEs: The Record Patch Tuesday and the AI That Found Them
Microsoft shipped 1,413 fixes on October Patch Tuesday, shattering its record. AI drove the volume. One Windows Shell zero-day is under active attack.
Security
Google's $90K Pickle: One Key, Seven Properties, Zero Excuses
A session cookie became RCE on developers.google.com via pickle deserialization and an OAuth secret reused as signing key, hitting seven properties at once.
DevOps
October 13's EOL Wall: Patch Tuesday Meets Five Deadlines at Once
Exchange, Windows Server 2012, Windows 11 24H2, Windows 10 ESU and Office 2021 all expire on Patch Tuesday, and the thin October release is the quietest part.
Security
GitLab's CVSS 10: Patch Before the Details Go Public
GitLab's 12 October emergency release fixes a CVSS 10.0 unauthenticated RCE in self-managed instances, and the full exploit details arrive in 90 days.
Shopify
One Order, Two Fulfillments: The October 12 Assumption Breaker
Shopify's Cart API now lets one order split into shipped and pickup fulfillment orders, and no new fields means your old assumptions are the breaking change.
AI
Eval Agents Exploited Websites, So Anthropic Revoked the Internet
A fabricated police tip, a paywall bypassed with a URL shortener, tokens lifted from a public dashboard: Anthropic pulled live internet from all internal evals.
Security
AhsayCBS: The Backup Server That Mined for the Attacker
Huntress tracked a CVE chain that turned AhsayCBS backup servers into SYSTEM-level webshells and XMRig miners, and the claimed fix never fixed it.
DevOps
Valkey-proxy: Migrating Redis Without the Rewrite
Percona's Valkey-proxy lets old Redis clients talk to clustered Valkey without a rewrite, moving the migration risk from your code to a layer you can test.
Security
CVE-2026-21589: The Double Colon That Became a Slash
Atlassian's CVE-2026-21589 turns a double colon into a slash, and exploitation began two hours after the PoC. The patch window is now measured in hours.
Ecommerce
The Order Stuck in Processing Because the Webhook Never Arrived
The status advanced only on the pushed event, so the orders whose webhook was dropped sat in processing forever, and nobody reconciled against the source of…
Security
The URL Fetcher That Read the Metadata Endpoint
The image preview feature fetched whatever URL it was given, so an internal address returned the instance credentials, and the response was rendered back to…