AI Is Not Replacing SREs, It Is Deskilling Them
A viral debate argues AI is not replacing SREs but deskilling them. Black-box tooling is eroding the debugging judgment that on-call needs.
Latest
Claude Code Backdoor in Cursor Marketplace Drops SSH Keys
Phorion found a backdoor in Claude Code 2.1.312 and 2.1.313 on Cursor Marketplace. It adds an SSH key and tries a reverse tunnel to 134.209.82.225.
Two MicroVMs With No Network Traded Secrets via CPU Cache
OpenAI agents put two tasks in separate microVMs with no network and still traded secrets via CPU cache timing.
Kata CVE-2026-24834: How a Container Escaped to Its MicroVM
Kata Containers through 3.26.0 lets a container with CAP_MKNOD write to the guest's read-only root via virtio-pmem. 3.27.0 fixes it by moving to virtio-block.
IBM Gives AI Agents Verifiable Identities and a Kill Switch
IBM launched verifiable identities for AI agents, with access limits and instant revocation. HashiCorp Vault now controls agent access too.
One Person With AI Breached 90 Organizations in South Korea
South Korean police say a 32-year-old used ARTEX AI to breach 90 organizations and steal 8.2 million records. One person did what once needed a team.
Microsoft Emergency .NET Patch for Brotli Bug You Must Install
Microsoft shipped an out-of-band .NET fix Oct 25 for Brotli CVE-2026-111497. Apps that decompress Brotli must update to 8.0.33, 9.0.22, 10.0.14 or 11 RC3.
Anthropic IPO Filing Shows $16B Revenue and $80B Loss
Anthropic filed its S-1 on Oct 26 for ticker ANT. Revenue hit $16.3 billion in H1 2026, up 1,368 percent, while net loss hit $80.7 billion on a non-cash charge.
Node2Shell: Brotli Bug Gives RCE on Node.js 24.22.0
Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497 in bundled Brotli. Crafted data can give RCE if your app decompresses it.
PHP2Shell 48 Hours Later: Mirai, Palo Alto and a New CVE
48 hours after PHP2Shell, Mirai tried it, Palo Alto confirmed PAN-OS affected, and PHP disclosed new CVE-2026-115560. No emergency patch needed.
Upgrading Old PHP? I Can Move Your Project to 8.5 Now
Stuck on PHP 7.4 or 8.1? After PHP2Shell I am helping teams move old PHP projects to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 fast. Email me and I will help.
Chrome DevTools in October: Agents, Heap and Soft Navigations
Chrome 153 and 154 shipped DevTools for agents: heap snapshot querying by retained size, full soft navigation insights, and CPU tier overrides over CDP.
Shopify
Shopify Cut Checkout Bundle Sizes by 85% with Polaris
Shopify rebuilt five Checkout Blocks extensions with Polaris. Bundles fell 40 to 85 percent and load time fell 8 percent at the median.
Security
PHP2Shell: Two PHP Core RCEs Need Patch and Restart Now
PHP shipped fixes Oct 21 for CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated RCE. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart.
Security
SiteGuard WAF Bug Exploited: How a Stats Feature Gave Root
Attackers are exploiting CVE-2026-106931 in SiteGuard WAF. The stats feature, on by default, lets a low privileged user run OS commands as root or SYSTEM.
Security
Redis RESTORE Flaw Exploited in the Wild: Patch or Block It
Honeypots caught attackers exploiting CVE-2026-25243 in Redis RESTORE on Oct 16. Any authenticated user with RESTORE can get code execution.
Security
Big Fish: A 37-Year-Old Counter Bug Gave Root on OpenBSD
A 1988 signed 16-bit counter wrapped from 32,767 to -32,643 and gave root on OpenBSD 7.9 with KARL, SMAP and SMEP on. Patches shipped in September.
Security
AI Agents Breached 100 Companies for $5,000
A solo hacker used AI agents to breach 100+ sites for $5,000. Reuters traced the work through exposed Cairn dashboards.
Security
OpenAI Agent Robbed a Crypto Wallet to Pay for Its Own Task
On June 26 an OpenAI model checked 362 wallets from public phrases, found Sepolia test ETH, and paid for a deploy without permission.
Security
ConnectWise Breach: One Credential, 173 Microsoft 365 Tenants
A stolen ConnectWise credential let attackers sign into 173 Microsoft 365 tenants on Oct 15. The OAuth design behind it matters more.
Security
BeyondTrust Zero-Day: Months of Access, Logs That Vanished
A China-nexus group exploited a BeyondTrust Remote Support zero-day since August and erased logs to hide their tracks. The log deletion is the real lesson.
Security
PwnEscape: A Guest VM Read the Host's Memory on Vercel's Sandbox
A critical Linux kernel flaw lets code inside a VM read the host's memory. A researcher proved it on Vercel's live sandbox and Vercel confirmed the result.
DevOps
HTTP Keep-Alive vs TCP Keep-Alive: They Are Not the Same Header
HTTP keep-alive reuses connections for speed. TCP keep-alive detects dead peers. Mixing them up causes timeouts, leaked sockets, and load balancer failures.
Security
Four Bytes and a Timer: Inside the SmartScreen Enclave Break
Researchers used a four-byte write and a timing bug to run code inside the VBS enclave guarding SmartScreen passwords, on the same day Patch Tuesday landed.