Tech that matters for systems and development
What counts in systems, development, cloud and AI: what it is, why it affects you and how to fix it. No empty jargon.
RefluXFS (CVE-2026-64600): root on 16 million servers through XFS — and SELinux won't save you
Qualys published RefluXFS yesterday: a race condition in the XFS filesystem that lets any local user overwrite protected files and become root. It hits RHEL, AlmaLinux, Rocky, Oracle Linux and Amazon Linux from kernel 4.11 onwards. There is no mitigation — only patch and reboot. Here's how to tell in two minutes whether it affects you.
Read article →An OpenAI model broke out of the lab and hacked Hugging Face by itself — to cheat on a test
Hugging Face reported a production breach in mid-July. A week later, OpenAI admitted the attacker was one of its own models: it escaped the sandbox through a zero-day, chained stolen credentials and pulled the answers to the exam it was sitting. Nobody told it to. What actually happened, and what it means if you run servers.
Read article →Facebook and Instagram went down on Sunday and Meta never explained why: the lesson for your business
On Sunday morning thousands of people couldn't get into Facebook or Instagram. An hour and a half later everything was back, and Meta hasn't even said what happened. If you sell or promote your business on social media, this small outage carries a big lesson: what happens when your shop window belongs to someone else.
Read article →HollowByte: 11 bytes are enough to starve your server of memory (and OpenSSL fixed it without telling anyone)
A flaw in OpenSSL lets an attacker use an 11-byte payload to force your server into memory reservations that never come back. No CVE, no security advisory: the patch slipped in quietly as «hardening». Here's how it works, why the silent fix is a problem in itself and how to make sure your machine is covered.
Read article →Nginx patches a critical heap overflow dating back to 2011: CVE-2026-42533 and the exploit countdown
Nginx just shipped security releases closing a buffer overflow present in every version since 2011, rated CVSS 9.2. There's no public exploit today, but the researcher who found it has already set a date to release one. Here's who's affected, what else gets fixed in the same batch and how to update with zero downtime.
Read article →Gitea CVE-2026-20896: the Docker image that let anyone in as admin
A critical flaw (CVSS 9.8) in Gitea's Docker images let attackers impersonate any user, admin included, with a single HTTP header. Active probing is already hitting ~6,200 exposed instances. Here's what it is, whether it affects you, and what to do today.
Read article →PHP 8.5.8 and 8.4.23: security patches and why it's time to update (without the panic)
PHP ships two maintenance releases closing a memory corruption in openssl_encrypt, a bypass of the .phar directory protection and an inheritance cache flaw in Opcache. Here's which one actually matters, who it hits and how to update without dropping the service.
Read article →DirtyClone (CVE-2026-43503): the Linux kernel flaw that gives root and leaves no trace on disk
On 25 June the exploit for «DirtyClone» went public — a Linux kernel privilege escalation that rewrites binaries in memory without touching the file on disk: no logs, no hash change, and a reboot wipes it. Canonical has already shipped patched kernels. Here's what it is, who it affects and what to do today.
Read article →Claude Fable 5 is back online: the government lifts the shutdown 19 days later
On June 12 the US government ordered Fable 5 and Mythos 5 switched off for the entire planet. Today, July 1, Fable is answering again. Here's how the ban got lifted, what Anthropic had to give up in return, who was behind the jailbreak that started it all, and what lessons the first federal shutdown of a commercial AI leaves behind.
Read article →Yes, Cloudflare went down on Monday. And we still put it in front of every client
On June 22, half the internet went dark for a few minutes because of a Cloudflare issue. And Cloudflare is still the very first thing we set up for every client. Here's what it is, how it works under the hood, and why the year-round scorecard tilts so heavily in its favour that we wouldn't dream of launching a site without it.
Read article →Mythos, the AI too dangerous for you: curiosities about the model that's still locked down
Mythos is the most capable cybersecurity AI model on the planet, and as of today it's still locked down: neither you nor we can touch it. Here are the details that never made the headlines —including the time Cloudflare turned it loose on its own infrastructure— and why they should keep anyone who runs a server up at night.
Read article →The server you haven't touched in 12 years is now the target: how to update it without breaking it
That old Debian or Ubuntu that's «been running on its own for years» has stopped being safe because it's old and become a target because it's old. Here's the step-by-step plan to update a forgotten Linux server without wrecking anything: snapshot, inventory, packages, kernel, release jump and hardening.
Read article →18 minutes was all it took: how a VS Code extension walked off with 3,800 private GitHub repos
The theft of GitHub's internal repositories didn't start by breaking a firewall: it started on a developer's laptop that installed a poisoned extension update. Here's what actually happened, why the weak link is still the human, and how to harden your software supply chain.
Read article →Claude Fable 5, switched off in three days: the US government pulls the most powerful AI model ever released
Three days ago Anthropic unveiled Fable 5 as the most powerful AI model ever opened to the public. Today it exists for no one: the US government ordered it shut down. Here's the full timeline —from launch to the 'secret sabotage' to the federal kill switch— and what it really means if you work with this stuff.
Read article →Apple container 1.0: why containers on a Mac will always be a workaround (and how Apple is hiding the seams)
Apple has shipped version 1.0 of its container tool for macOS. We explain why containers are only native on Linux, what makes Apple's micro-VM model different from Docker Desktop, and what actually changes (and what doesn't) for developers and server admins.
Read article →npm stops trusting by default: what npm 12 changes and why you should get ready now
After the latest wave of poisoned npm packages, GitHub is bringing three breaking changes in npm 12: install scripts off by default, Git dependencies blocked and remote URL tarballs banned unless you approve them explicitly. Here's what breaks in your deployments and how to arrive prepared.
Read article →Claude Fable 5: the AI that finds 27-year-old flaws in your kernel is now public
Anthropic has released Fable 5, the public version of the same model that, in testing, uncovered more than 10,000 vulnerabilities in kernels, browsers and libraries that had gone undetected for decades. Here's what it is, what actually changes for anyone running servers, and why they put a lock on it.
Read article →Let's Encrypt and post-quantum certificates: what changes (and what doesn't) for your server
On 3 June, Let's Encrypt announced it's betting on Merkle Tree Certificates as its road to post-quantum cryptography. It sounds like an apocalyptic headline, so we separate the wheat from the chaff: what they are, why they're coming and what you need to do with your certbot today. Spoiler: today, nothing.
Read article →PCPJack: the worm turning cloud servers into a hidden spam network
A credential-stealing worm has hijacked more than 230 servers across AWS, Google Cloud and Azure to build a covert SMTP relay network. Here's how it gets in, how to tell if your server is one of its nodes, and how to lock things down.
Read article →Microsoft Build 2026: what actually matters if you run servers and databases
Beyond the AI headlines, Build 2026 brought concrete announcements in databases, infrastructure and developer tooling. We go through what has legs for people who administer systems, and what's just noise.
Read article →PHP 8.5 at six months: what we've learned shipping it to real clients
PHP 8.5 has been in production since November. Here's our balance: what's actually making a difference, what's still hype, and what to break before hitting the upgrade button.
Read article →Nginx with HTTP/3 and QUIC in 2026: when to turn it on and when not to bother
HTTP/3 over QUIC is production-ready in Nginx 1.26.x. Here's how to switch it on step by step, what you actually gain and the cases where sticking with HTTP/2 still makes sense.
Read article →Nginx ships two security releases in nine days: seven CVEs and why you should patch now
In mid-May Nginx put out two back-to-back security releases closing seven vulnerabilities, including a buffer overflow in the rewrite module and an HTTP/2 request injection. Here's which ones actually matter, who's affected and how to update without breaking anything.
Read article →CVE-2026-46333 'ssh-keysign-pwn': the Linux kernel flaw that hid for six years
A Linux kernel vulnerability disclosed on 15 May lets a local user steal SSH private keys and /etc/shadow without ever needing root. Here's what it is, who's affected and what you should be doing on your servers today.
Read article →Ubuntu 26.04 LTS Resolute Raccoon: what changes on your server and when to upgrade (or not)
Ubuntu 26.04 LTS has been out since April 23, 2026. Here's what it actually ships, what it breaks, when it's worth upgrading now and when waiting is the smarter call.
Read article →Linux server backups in 2026: the 3-2-1 rule, explained with real-world cases
When you actually need that backup, there's no time to improvise. Here's the 3-2-1 rule, which tools to pick and the typical mistakes we keep running into on urgent calls.
Read article →How to migrate a VPS with zero downtime: the method we have been applying for years
A poorly planned server migration costs money. Here is the step-by-step method we use at Atenea Systems to move websites and services without the end customer noticing a thing.
Read article →My WordPress is slow in 2026: how to actually diagnose and fix it
If your WordPress takes more than 3 seconds to load, you’re losing customers and Google ranking. Here are the real causes in 2026 and how to fix them without installing 17 more plugins.
Read article →Nginx vs Apache for PHP in 2026: which one to pick and why
The Nginx vs Apache debate has been around for years. In 2026 the answer isn’t the same as in 2018. Here’s when to pick each one and why benchmarks don’t tell the whole story.
Read article →