the log · 159 entries
Log-scale notes on infrastructure.
Analysis on backup, cloud, open source, security and the companies shaping them. One entry a day, filtered through twenty-five years of running the systems involved.
all 159
ai-machine-learning 16
ai-engineering 78
infrastructure 119
machine-learning 3
programming 64
software-development 40
technology 113
technology-leadership 29
tutorials 1
2026.10.277 min read
Cloudflare knew the KV pool was too small at launch, and 155 responses carried other users' data
Cloudflare's GLM 5.3 endpoint returned 155 responses built from other customers' prompts between August 27 and September 9. The pool held 681,280 tokens. The context window was 1,048,576.
2026.10.267 min read
DreamHost reset FTP and email passwords, took its File Manager down for three days, and won't say why
DreamHost has rotated customer email and FTP/SFTP passwords since October 23 and kept its File Manager offline for three days, with nine status updates and no stated cause.
2026.10.257 min read
The Node2Shell Brotli bug now hits Python, Bun and Envoy, and the fix dates to February
CVE-2026-111497 is a Brotli decoder flaw compiled into Node, Bun, Python, Envoy, curl and .NET. Node patched October 21. Most bundled copies were still open on the 24th.
2026.10.248 min read
LiteLLM shipped a credential stealer for 104 minutes, and the build had valid provenance
LiteLLM 1.107.0 sat on PyPI for 104 minutes on October 21 with a stealer that ran on every Python start. The attacker got in with GitHub tokens scraped from LiteLLM's own logs.
2026.10.237 min read
Quad9 cuts off France on November 24, and the fine was only €1,000 a day
A Paris court fined Quad9 €1,000 a day for blocking none of beIN's 58 domains. The resolver will stop serving French users on November 24 rather than build a GeoIP filter.
2026.10.227 min read
PHP patched two unauthenticated RCEs, and a core developer saw the first clue in 2024
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two unauthenticated RCEs in code that dates to 2012. A PHP core developer saw the first signs in a 2024 audit, and the fix stalled for two years.
2026.10.217 min read
An eMudhra CA private key was the number 4, and your servers may still trust it
Eight eMudhra intermediate CA keys are integers under 256 that anyone can compute. Browsers blocked them on October 17. Linux and language trust stores took three more days.
2026.10.206 min read
OpenCode's hosted Console leaked provider keys, and the bills landed before the email did
OpenCode says 1.4% of Console users had stored OpenAI, Anthropic and Google keys exposed from a legacy system on October 17. Users saw bills up to $1,700 before the notice arrived.
2026.10.197 min read
ConnectWise's backup app had one key for every tenant, and now nobody can restore
A stolen ConnectWise Cloud Backup credential signed into more than 300 Microsoft 365 tenants on October 15. ConnectWise cut the app on October 17, and backups and restores stopped with it.
Nothing on this page matches. Press Enter to search every entry.