Microsoft patches record 1,413 flaws including actively exploited Windows bug
Microsoft released patches for 1,413 vulnerabilities in October 2026, including a Windows Shell flaw under active exploitation and a .NET bypass.
News for teams that run their own software
A daily digest on self-hosting, DevOps, security, document AI and HR tech. Each story is summarized, explains why it matters and links to the original publisher.
Detecting terraform drift with scheduled github actions and aws oidc
A new guide details how to use scheduled GitHub Actions and AWS OIDC to detect infrastructure drift without long-lived keys, while warning of silent workflow failures.
How a hosts file entry broke an AI bot's voice transcription
A self-hosting migration and an SSRF guard caused an AI assistant to silently drop hundreds of customer voice notes and files for two days.
Google releases Gemini 4 Argon with unified token budget and new pricing
Google has made Gemini 4 Argon available to developers, introducing a shared 1 million-token limit for input and output alongside introductory pricing that matches key competitors.
Oxynote merges live metrics and documentation in one self-hosted wiki
The new open-source tool Oxynote embeds live Prometheus and SQL charts directly into documentation pages, allowing teams to review metrics and explanations together.
GitLab patches critical unauthenticated remote code execution flaw
GitLab released emergency updates for a CVSS 10.0 vulnerability allowing unauthenticated users to execute code on servers via CI/CD configuration.
Ivanti Connect Secure zero-days allow root access via chained exploits
Attackers are chaining three zero-day flaws in Ivanti Connect Secure VPNs to gain root access. Two flaws are patched, but a critical privilege escalation fix is still pending.
Facet engineers fix silent data loss bug in multi-tenant SQLite backup system
Facet developers discovered a logic error in their point-in-time restore system that could return stale data. They fixed the epoch handling to prioritize temporal accuracy over sequence numbers.
MiBee Steward v0.7.3 drops Go agent for Rust and enforces schema resets
The self-hosted network monitor MiBee Steward v0.7.3 replaces its Go agent with a lighter Rust version, breaks backward compatibility with older databases, and introduces read-only federation between
Cloudflare Tunnel security limits for self-hosted services
An analysis of Cloudflare Tunnel reveals it hides IP addresses but does not replace application-level authentication or patching.
Self-hosted Dify users may still share a public secret key after upgrades
Dify instances installed before version 1.15.0 often retain a default SECRET_KEY that is publicly known, allowing unauthorized token signing.
AI-augmented campaigns target WordPress and critical infrastructure in Ukraine
CyberXero used Claude Code to automate attacks on WordPress sites, stealing over 628,000 records. A separate operation targeted Brazilian financial systems with invoice fraud.
OpenCode 2.0 unifies terminal, web, and desktop interfaces under one service
Anomaly releases OpenCode 2.0, featuring a shared background service, rebuilt API, and Code Mode for efficient tool integration.
Personal AI agents are accessing work systems via employee identities
Employees are connecting personal AI assistants to corporate tools through OAuth and saved credentials, creating new identity security challenges for IT teams.
Silent deployment failures: why green pipelines still break production
Analysis of 538 verified cases reveals that 23% of app breaks stem from deploy issues, including chunk 404s and stale builds that pass CI checks.
