At some point JWTs became the default answer to "how do I keep a user logged in." For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as "the server cannot forget it" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.
Modern pull request review is built on a clean trust boundary. Code in the PR is untrusted until reviewers approve it. Configuration in the PR is treated as ambient context, more or less along for the ride. The Gemini CLI hook CVE that landed in May 2026 made it
When CVE-2026-31431 dropped on April 29 with a public proof-of-concept and no vendor patches available, every Linux machine in the homelab was affected. Two weeks later the OpenSSH GSSAPIKeyExchange flaw shipped as DSA-6204-1 and the question arose again. This post is the short writeup of how Ansible turned both incidents into routine work.
The FortiGate 100F arrived this week and slots into the homelab between the Fritz!Box modem and the MikroTik core router, adding real next-generation firewall capability to a routing-strong but inspection-light architecture.
Running endlessh-go as a Docker container on Strato VPS, deployed via Ansible
Exploring base and bound memory protection
QUIC is in late draft, HTTP/3 is shipping in Chrome and Firefox, and Cloudflare and Google are already serving meaningful traffic over both. The internet's transport layer is being rewritten. This is what changed, why it changed, and what it means for everyone who runs servers.
Mathy Vanhoef forced WPA2 to reinstall a key it was already using, resetting the nonce and handing an attacker the keystream. Every correct implementation was affected, and Linux managed to be affected worst of all by installing an all-zero key. Here is the handshake, the flaw, and why the link layer was never where your trust belonged.
Borg 1.0 has been stable since February. If your backup strategy is still rsync to an external drive, you are leaving real safety on the table. Encryption, deduplication, and compression are not optional anymore.