Newsroom
Insights, updates, and engineering stories about AI, SaaS, security, and infrastructure.
Page 2 of 7
Analysis and engineering notes on AI, architecture, delivery, and search.
June 5, 2026
The review reflex fires on checkout and stays silent on an agent reading a bug report
Agentic CI moved the attack surface from code execution to text: reaching a job that holds your secrets now costs one filed issue. Splitting the workflow by privilege closes that; a filter in front of the model only lowers the share of attempts that land.
Ihor K
CEO
June 2, 2026
One connection can pin more memory than a thousand well-behaved ones — budget per connection, at every hop
The HTTP/2 Bomb, disclosed on 2 June by Calif, chains HPACK indexed-reference amplification with a zero-window flow-control stall, so one compliant connection pins memory the server never frees. The control that answers it is a per-connection budget set at every hop that speaks the protocol; requests per second never touches it.
Ihor K
CEO
May 30, 2026
Google handed the account back nine minutes after taking it, and Railway's edge went on answering 404 for services that had never stopped running
Railway's incident report puts an automated Google Cloud account suspension at 22:20 UTC on 19 May 2026, the first 404s fifteen minutes later, and edge traffic serving again at 01:38 — three hours in which services on AWS and bare metal were running and unreachable. The account itself had been returned at 22:29, before the first 404. What set the length of the blackout was what the edge proxies did with a cache they could no longer refresh.
Ihor K
CEO
May 12, 2026
Eighty-four malicious @tanstack versions carried valid provenance: the signature named the right repository, the right workflow and the right commit, and every word of it was true
An attacker published 84 malicious versions across 42 @tanstack packages without stealing a publish token: a poisoned Actions cache, then an OIDC token read out of runner memory. Provenance verified correctly throughout, and that is the finding — the signature was accurate and the artifact was hostile.
Ihor K
CEO
May 1, 2026
No setting chose this rate and none can unset it; the miss rate it multiplies is written in your handlers
Google raised list prices for data transfer out via CDN Interconnect, Direct Peering and Carrier Peering on 1 May 2026 — a rate that follows the destination of the packets, chosen by no setting in your stack and unsettable by any. Origin egress is the miss rate times bytes delivered times that rate, and the two factors you still control are both written in application code.
Ihor K
CEO
April 23, 2026
The serving part shipped with more memory and less arithmetic than the training part, and whether you can ever use it was settled by kernels written last year
Decode streams weights out of memory and does a few FLOPs per byte moved; training does the opposite, so a part built for both is tuned for neither. Google's 22 April announcement splits its eighth-generation TPUs along exactly that line, and the spec sheets confirm it: the inference part carries more HBM, more bandwidth and less peak arithmetic than the training part. Whether your stack can follow it is a property of your kernels, not of your contract.
Ihor K
CEO