Blog · page 5
Notes on engineering, design, and everything in between.
Node.js 24 is LTS: Krypton runs to 2028, and here is what changes
Node.js 24 became LTS on October 28, 2025 under the codename Krypton, supported until April 2028. V8 13.6, npm 11, a stable permission model and require(esm) by default — plus the rough edges to know before upgrading.
PHP's two 9.2 RCEs: the official root causes, and what the public PoC actually demonstrates
On October 21 PHP fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); a public PoC with a full lab appeared the next day. Here are the longjmp and stale-global-state root causes, a reproducible lab, the PoC, and where the PoC diverges from the advisory.
PostgreSQL 18: async I/O, uuidv7, and an upgrade path that hurts less
PostgreSQL 18 shipped in September 2025 with a new asynchronous I/O subsystem (up to 3x on reads), uuidv7() in core, virtual generated columns and OAuth 2.0 authentication. Here is what actually matters.
The CVSS 10.0 React bug: one request, code execution on your server
A flaw in how React Server Components decode payloads earned a perfect 10.0 — unauthenticated remote code execution. Here is who is affected, how to check, and what to do about it.
A retargeted tag: twenty thousand repos leaked secrets into build logs
In March 2025 the version tags of tj-actions/changed-files were pointed at a malicious commit, and CI tokens were printed into workflow logs. CVE-2025-30066 is the bill for mutable tags.
TLS certificates are heading to 47 days: automation is no longer optional
CA/Browser Forum ballot SC-081 caps certificate lifetimes at 200 days from March 2026, 100 days from 2027, and 47 days from 2029. Manual renewal has a deadline now.