Notes on what we ship, what works, and what we'd do differently next time.
SecurityThe 2026 DevOps Threats Report flagged AI integration as the fastest growing attack surface in software delivery. Prompt injection in PR descriptions, RCE via AI generated build scripts, credential leaks. The hardening checklist.
SecurityCVE-2026-42945 is a heap buffer overflow in nginx that has been sitting in every build since 2008. Seventeen years of code review, fuzzing, and production deployment did not catch it. Here is what that tells us.
SecurityThe Verizon DBIR 2026 reports vulnerability exploitation is now the leading initial access vector for confirmed breaches at 36%, overtaking credential theft for the first time. The implications are not subtle.
AIAirbnb told the world AI now writes 60% of their new code. The headline is real. The framing is wrong. Here is why % of code written by AI is the wrong metric and what we measure instead.
EngineeringTwelve CVEs across DoS, SSRF, XSS, middleware bypass, and cache poisoning landed in one coordinated disclosure. Every Next.js shop on the planet had to ship a patch this week. Here is the punch list.
AIAnthropic shipped Opus 4.7 in mid-April. We have been using it daily since. Here is what actually got better, what did not, and what the unreleased Mythos model means for the rest of us.