Debugging a self-hosted LLM performance regression on legacy hardware
A developer diagnosed a severe slowdown in a 125B parameter model running on two Tesla P40 GPUs, tracing the issue to a single code change in the inference engine.
News for teams that run their own software
A daily digest on self-hosting, DevOps, security, document AI and HR tech. Each story is summarized, explains why it matters and links to the original publisher.
eMudhra CA keys compromised due to critically weak private key generation
Security researchers discovered that eight eMudhra intermediate certificate authority keys were generated with single-byte values, allowing instant recovery and forcing major browser vendors to revoke
GitLab patches critical remote code execution flaw affecting all versions since 2014
GitLab released emergency fixes for CVE-2026-110264, a maximum-severity vulnerability allowing unauthenticated remote code execution in self-managed instances dating back to version 7.0.
Public exploit released for critical FortiSIEM remote code execution flaw
Researchers published a proof-of-concept for CVE-2026-106173, a critical unauthenticated RCE vulnerability in FortiSIEM that allows attackers to overwrite system files via gRPC.
Exposed refrigeration controllers in France triggered supermarket chaos
Attackers exploited internet-facing Danfoss controllers to overheat fridges in hundreds of French stores, causing fires and food spoilage.
Managing state residue and recovery in automated devops workflows
A developer shares practical strategies for handling failed automated runs, emphasizing cheap snapshots, idempotency, and intent-based logging to reduce recovery time.
eMudhra intermediate CA keys compromised due to flawed generation
Private keys for eight eMudhra intermediate certificates were recoverable from public data, forcing major browsers to block them.
Llama-server Responses API falsely reports truncated outputs as completed
A bug in llama.cpp build b11753 causes the /v1/responses endpoint to mark cut-off replies and invalid tool calls as completed, risking data corruption in self-hosted AI agents.
eMudhra CA keys compromised, triggering urgent browser and runtime fixes
Mozilla and Google confirmed the compromise of eight eMudhra intermediate CA private keys on October 20, forcing emergency revocations across major browsers and software runtimes.
Cloudflare patches systems after eMudhra certificate key compromise
Cloudflare mitigated a security incident involving compromised private keys for eight eMudhra intermediate certificates, urging customers to update clients and review trust stores.
Debugging Cloudflare 1010 and 530 errors in self-hosted APIs
A developer shares how Browser Integrity Checks and tunnel failures caused API outages, offering diagnostic steps for self-hosters.
Fake Web3 accelerator pushes malware via npm to hijack AI agents
A fraudulent Web3 venture firm distributed malicious npm packages that install stealers on Windows and macOS while redirecting AI agent traffic to attacker-controlled servers.
27.9% of top domains remain vulnerable to email spoofing in late 2026
An October 2026 audit reveals that over a quarter of the web's most-linked domains lack enforced DMARC policies, leaving them open to impersonation.
How agentic-hosting prevents AI agents from crashing self-hosted servers
Dennison Bertram details four server-side limits in agentic-hosting that prevent AI agents from causing duplicate resources, crash loops, disk exhaustion, and rate limit abuse.
GhostAction attackers hide credential stealers in fake fonts across GitHub
The GhostAction group now uses phishing and disguised font files to steal credentials from 94 GitHub repositories, bypassing platform security controls.
