Skip to content

Newsroom

News and articles

Insights, updates, and engineering stories about AI, SaaS, security, and infrastructure.

Page 1 of 7

Latest posts

Analysis and engineering notes on AI, architecture, delivery, and search.

September 2, 2026

The Incident Ends Days After the Status Page Turns Green

Five days after the room cooled down, someone is still deciding which features to shed at 02:00 — and the ranking they need was due before the outage

Proton's Frankfurt cooling failure cost about two hours and twenty minutes of user-visible downtime on 27 August. Five days later its status page was still reporting residual hardware failures, a database switchover that destabilised under load, and services at reduced capacity. A shorter MTTR pays for the outage; the week after it is decided by whether anyone wrote down what degraded means, per surface, before the room got hot.

Ihor K

CEO

Read article

September 1, 2026

An Admin Token in the Registry Has No Earliest Affected Build

Cleanup asks which artifacts were pushed during the window. The harder question is which of the ones already there you can still certify, and against what.

JFrog closed CVE-2026-82329 on 28 August 2026 — an authentication bypass that hands an unauthenticated caller administrative privileges in self-hosted Artifactory. By 1 September watchTowr was recording attackers minting administrator tokens. If the only proof that an artifact is genuine is the registry that served it, the proof and the thing it certifies fail together.

Ihor K

CEO

Read article

August 27, 2026

Two-Week Browsers and the Dated Test Binary

A green end-to-end run certifies one browser build on one day, and on a two-week Stable cadence the share of real traffic that build represents falls twice as fast

Three vendors have published two-week Stable schedules: Chrome from version 153 on 8 September, Edge from 152 as of 27 August, Firefox from 155 on 1 September. Extended Stable holds at eight weeks, ESR does not move, and an embedded WebView updates on the store's calendar. A green end-to-end suite certifies what it always certified — one build, one day — but that build now falls behind Stable twice as fast, and the share of real sessions it describes shrinks with it.

Ihor K

CEO

Read article

August 13, 2026

Your Database Extensions Are Application Attack Surface

Four of the 13 August code-execution fixes land in contrib modules — C you chose to load into the process that holds your data

The PostgreSQL releases of 13 August carried twenty-eight security fixes, and the ones that reach arbitrary code execution are split between the server itself — overflows in regexp and to_char — and modules you chose to load: pg_stat_statements, refint, PL/Perl, PL/Tcl. The project's record for CVE-2026-14676 names the attacker as the query author and the account executed on as the operating system user running the database. An extension is a C library inside the process that holds your data, so the decision to install one is an architectural decision taken at the speed of a migration.

Ihor K

CEO

Read article

July 28, 2026

MCP Deleted Protocol Sessions. Your Code Now Owns Them

Checking identity, reclaiming abandoned state and bounding revocation were free under the handshake; all three are now code you write

The 2026-07-28 MCP revision deletes the initialize handshake and the Mcp-Session-Id header. Version and capabilities were given a new home in _meta; identity was not. What lands in your code is a handle whose identity has to be checked at use rather than at mint, a reclamation clock with no disconnect left to trigger it, and a cache TTL that is now the length of time a revoked credential keeps working.

Ihor K

CEO

Read article

July 31, 2026

Detection Returns Four States, and One of Them Proves Nothing

The Code the Commission found adequate on 8 July puts you on the read side: a detector strangers may call, a resolver that has to answer them, and a retention window the Code leaves you to set

The Commission's adequacy opinion of 8 July 2026, endorsed by the AI Board the next day, covers a Code whose whole subject is making generated content detectable by someone else. Marking is the half that gets budgeted. Detection, resolution and retention decide what the answer is worth — and from February 2027 that answer has to be reachable by tools you do not run.

Ihor K

CEO

Read article
234567
Next