In the hours following the release of CVE-2026-98432 for the project Linux, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a use-after-kfree where retransmitting a crafted connection request whil...
A forlorn businessman resting his head against a wall beside a window. Photo by Andrea Piacquadio, via Pexels.
In the hours following the release of CVE-2026-89078 for the project Ruby, site reliability workers
and systems administrators scrambled to desperat...
In the hours following the release of CVE-2026-93479 for the project NGINX, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a heap buffer overflow in worker script evaluation triggered by crafted...
In the hours following the release of CVE-2026-94300 for the project BIND 9 named, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix memory corruption in named triggered by replaying captured GSS-TS...
In the hours following the release of CVE-2026-111813
for Apache Traffic Server, site reliability
workers and systems administrators scrambled to patch systems running its
experimental magick plugin. In its default unsigned configuration, the plugin
...
In the hours following the release of CVE-2026-111497 for the project Brotli, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in the Brotli decoder that permits remote code ...
In the hours following the release of CVE-2026-107891 for the project musl, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix multiple integer overflows in regcomp() when compiling untrusted regular...
In the hours following the release of CVE-2026-109618 for the project PHP, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix multiple memory safety vulnerabilities that allow attackers to execute ar...
In the hours following the release of CVE-2026-92392 for the project curl, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a use-after-free in HTTP/2 upload retries where cleanup turns leftover up...
It sure seems that a bunch of companies are trying to ship a git product of
some kind as of late. Wonder why that is.
Either way, I’m building a Git server backed by object storage as an
open-source project. It sounded simple
enough to start: ...
The power of science is staggering! Every day we're making new advancements in the field of generative artificial intelligence via judicious application of large language model inference technology. However, as we approach the next critical threshold in capability, we must l...
After a year of work, hundreds of commits, 5 generations of pull requests, dozens of tests, rewriting part of Anubis in Rust, the first compiler bug of my career, and at least three times making my tower run out of ram I think I have finally done it. The next versio...
One of the hardest problems in distributed systems is conflict resolution, or
the same basic problem as merge conflicts in Git. Git merge conflicts happen
when your branch differs from upstream in a way that Git can’t easily work its
way around so it ...
In the hours following the release of CVE-2026-41992 for the project GNU gzip, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix decompressing two files in the same invocation of gzip (that's possib...
Tigris has a pretty advanced replication scheme for writes. What happens when
you actually need to delete things? Turns out deleting things is hard in
distributed systems. Especially when you have a geo-replicated active-active
database like Tigris do...
Anubis v1.27.0 (Moenbryda Wilfsunnwyn) is now available via Docker and direct download from GitHub releases. This release adds Windows Server support, automatically renames cookies based on settings to avoid infinite challenge loops, adds two new localizations, and ...
SigV4 looks simple: sign a request, check the signature. Then you implement
canonicalization, clock skew, and a cache that isn't allowed to hold your key.
Tigris is a drop-in replacement for AWS S3 (or GCS, anything S3API compatible).
As such, we need...
A presigned URL is a replay attack you did on purpose.
Replayable auth tokens are the textbook way to create vulnerable systems, but
Tigris ships them as a first-class feature with presigned URLs and so does every
other object storage system on the pl...
In the hours following the release of CVE-2026-8461 for the project FFmpeg, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in the MagicYUV decoder (libavcodec/magicyuv.c) c...
In the hours following the release of CVE-2026-55200 for the project libssh2, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in ssh2_transport_read() due to a missing upper...
What happens if I just point a git server at an object storage bucket?
Back when I was porting
agent sandboxes to Go, I
built everything on top of
billy, a filesystem
abstraction for Go. The whole trick of the project was teaching a Ti...
