Five months ago, PostHog rebuilt its data warehouse on DuckDB. Now Benjamin Knofe-Vider explains in Why we’re moving our warehouse off DuckDB why they’re leaving it. It caught my attention for two reasons: a …
If there’s one open source project you can rely on for planning, it’s PostgreSQL. For a decade now, every major version has shipped between mid-September and mid-October, with a regularity many commercial …
On Thursday 29 October, for about eleven hours, the Claude Code extension for VS Code distributed through the Cursor marketplace carried a backdoor. Cursor has published a security notice and the security firm Phorion a …
On 9 October, Ryan Dahl announced that the entire Deno team is joining Cloudflare. The weightiest part of the announcement isn’t the deal itself but what comes after: in a year they’ll stop developing the …
Yesterday evening, 29 October, Binance, the world’s largest cryptocurrency exchange, suffered the largest crypto theft on record: according to the company itself, around $6.3 billion. The figure is still moving …
Alpine Linux has published an incident report on its GitLab instance with a lesson I think is very useful for anyone maintaining their own container images: they upgraded GitLab to a fixed version and were still …
A week ago I wrote about how PHP2Shell came out early and forced people to mitigate without a patch. Now something similar has happened one level further down, in the firmware that boots servers. TianoCore has published …
Update (28 October): according to a follow-up published by Dennis Jackson, eleven days after the report, the git, curl and python3 that Apple ships with macOS still accept the compromised certificates. On top of that, …
Cloudflare has published an incident report that I think is required reading for anyone serving language models: between 27 August and 9 September, the GLM-5.3 model on Workers AI returned to some customers responses …
Something has happened that, as far as anyone can tell, had never happened before: the C++26 draft has been rejected in its ISO DIS ballot, the step before the standard is published. Robert Seacord, convenor of the C …
On Wednesday, while I was busy with the PHP2Shell patches, Node.js published another critical advisory: CVE-2026-111497, dubbed node2shell. It looked like a Node problem, so I left it for later. That was a mistake, …
For a few weeks now, almost every day has brought news of security bugs found with AI, and this very week we had PHP2Shell, discovered with the help of models. If finding bugs has become cheap, the question is what the …
