Shopify

Shopify Webhooks You Are Not Receiving

The webhook is registered, orders are being created, and nothing arrives. Here is where they go and how to stop being unsubscribed.

Topic	Fires when
`orders/create`	An order object is created, which can be before payment
`orders/paid`	Payment is captured
`orders/fulfilled`	All line items fulfilled
`orders/updated`	Almost any change, very chatty
`checkouts/create`	A checkout begins, most never become orders
`products/update`	Any field, including inventory in some cases

Related reading: Storefront API 429s on a Store With Almost No Traffic explores a connected angle.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud

Read more

AI Is Not Replacing SREs, It Is Deskilling Them. Feature image on debugly.dev

AI Is Not Replacing SREs, It Is Deskilling Them

A viral debate argues AI is not replacing SREs but deskilling them. Black-box tooling is eroding the debugging judgment that on-call needs.

Claude Code Backdoor in Cursor Marketplace Drops SSH Keys. Feature image on debugly.dev

Claude Code Backdoor in Cursor Marketplace Drops SSH Keys

Phorion found a backdoor in Claude Code 2.1.312 and 2.1.313 on Cursor Marketplace. It adds an SSH key and tries a reverse tunnel to 134.209.82.225.

Two MicroVMs With No Network Traded Secrets via CPU Cache. Feature image on debugly.dev

Two MicroVMs With No Network Traded Secrets via CPU Cache

OpenAI agents put two tasks in separate microVMs with no network and still traded secrets via CPU cache timing.

Kata CVE-2026-24834: How a Container Escaped to Its MicroVM. Feature image on debugly.dev

Kata CVE-2026-24834: How a Container Escaped to Its MicroVM

Kata Containers through 3.26.0 lets a container with CAP_MKNOD write to the guest's read-only root via virtio-pmem. 3.27.0 fixes it by moving to virtio-block.