The Blog
Every essay I've written, hosted here or on Medium, newest first. Browsing one topic instead? Back to the blog.
OpenAI says an upcoming cyber model found 948 distinct Linux kernel privilege escalation bugs in one mid-October run, with working root exploits, for about $1.2 million in API credits. Here is what actually happened, why it changes the old assumption that a low-privilege foothold is contained, and the eight changes I'd make to a startup's servers, containers and CI this week.
·10 min read
Moonshot AI put the full Kimi K3.1 Pro weights on Hugging Face this week: a 2.8T-parameter MoE with 104B active, a 1M-token context and API pricing of $2 / $10 per million tokens. Here is what actually shipped, what the licence allows, why 1.56 TB of weights rules out self-hosting for almost every startup, how it compares on cost with Claude Opus 5.5, and a one-week evaluation plan before you switch anything.
·10 min read
Technical debt in startups is a tool, not a sin. The three buckets I sort every debt into, how to prioritise by what each one blocks, how much of each cycle to spend paying it down, why AI-written code piles it up faster, how to explain it to your board and investors, and who should own it at your stage.
·10 min read
CVE-2026-109518 lets an attacker who can tamper with the HTTP traffic between APT and its mirror swap a package after APT has verified it, and run code as root. It affects default Debian 12+ and Ubuntu 22.04+ setups. Here is who is exposed, the fixed apt versions for Debian and Ubuntu, how to upgrade apt safely (when the tool you are fixing is the one at risk), the Acquire::Retries stopgap, and what to do about Docker images and CI runners.
·9 min read
CVE-2026-98432 is a remote, unauthenticated use-after-free in the Linux kernel's IPv4 TCP code, present since Linux 4.4 and rated up to 9.8. Here is who is affected, which distributions have fixed kernels today (Debian, Amazon Linux, RHEL, Oracle) and which don't yet (Ubuntu stable), the exact commands to check and patch, the nftables stopgap and its limits, and what a startup should do this week.
·10 min read
Rebuild or refactor an agency-built MVP? Usually refactor. The signs your MVP needs rescuing, the ownership checklist to run before anything else, how I audit an inherited codebase in two weeks, the rare cases where a rebuild is right, why rewrites get proposed so often, and who should own the rescue.
·10 min read
What a SaaS MVP really costs in 2026: market lanes, worked examples from my MVP cost calculator, the three decisions (tenancy, roles, billing) that decide whether v1 survives its first customers, which enterprise features to price but defer, realistic timelines, and the running costs that aren't code.
·10 min read
What a marketplace MVP really costs in 2026: why two-sided products cost more than a SaaS app with the same screens, worked examples from my MVP cost calculator, why payouts are the line that moves the budget, what to leave out of v1, realistic timelines, and the running costs that aren't code.
·10 min read
What a mobile app MVP really costs in 2026: why one cross-platform build costs about the same as the web version of the same screens, what the App Store and Play Store add, worked examples from my MVP cost calculator, the running costs nobody quotes, and when you should ship a web app first.
·10 min read
On 14 October 2026 Next.js shipped an out-of-band fix for two critical unauthenticated remote code execution flaws and a Server Actions denial of service. Here is what each one needs to be exploitable, how to tell in five minutes whether your app is exposed, and a step-by-step upgrade guide, including the sharp trap that leaves 15.x apps vulnerable after upgrading.
·11 min read
PHP2Shell is a pair of critical PHP flaws that let an attacker run code on a web server with a single unauthenticated request. Exploitation started before the patch shipped. Here is what happened, who is affected, and a step-by-step guide to finding every PHP install, patching it, mitigating what you can't patch today, and checking whether you were hit.
·12 min read
The best tech stack for an MVP is the boring one: widely used, easy to hire for, and managed wherever possible. Here is the MVP tech stack I point founders at in 2026 (web, mobile, backend, data, AI), the rule that matters more than any framework, when no-code is the right call, and the stack choices that quietly cost you a rebuild.
·10 min read
AI agent security, explained for founders by a security researcher who runs a multi-LLM platform: an agent is only as dangerous as the tools and data you hand it, and prompt injection means any text it reads can try to steer it. Here are the five risks that matter, the permission model I use, where a human must stay in the loop, and a ten-point AI agent security checklist for your first launch.
·11 min read
Is it cheaper to self-host an open-weight LLM or pay per token? I ran the 2026 numbers: two rented H100s cost about $5,560 a month at any volume, which only beats a mid-tier API above roughly 214,000 requests a month and a hosted open model above roughly 594,000. Here is the break-even math, what it leaves out, and when self-hosting is right anyway.
·10 min read
RAG vs fine-tuning, explained for founders by someone who runs a multi-LLM platform: retrieval gives a model the facts, fine-tuning changes how it behaves, and most AI startups should exhaust prompting first. Here is how to decide, what each one really costs, when to fine-tune an LLM, and the mistakes that make AI products expensive to change.
·10 min read
What an AI MVP really costs in 2026, from someone who runs a multi-LLM platform: the build is usually smaller than founders expect, and the inference bill is usually bigger. Here are the four cost lines of an AI app, how to work out cost per user before launch, what to leave out of v1, and how to get an honest quote.
·10 min read
How long it takes to build an MVP, from someone who builds them: most real MVPs take 8 to 12 weeks once the scope is counted. Here is the MVP development timeline week by week, what makes it longer, what genuinely makes it faster, and how to tell a realistic timeline from a sales promise.
·10 min read
Your MVP budget is more than the build quote. Here is how to set one: the eight lines a real first-year MVP budget needs, the five MVP pricing models (fixed price, hourly, monthly team, per screen, equity) and who each one protects, how to compare two quotes, and how much of your runway the build should take.
·10 min read
If your business is building on AI, use the providers' APIs directly from their developer consoles, not the chat apps. Here is how Gemini, Claude, Grok, OpenAI (ChatGPT) and DeepSeek compare on price, data handling and fit, and the exact steps to set each one up safely: org account, billing limits, scoped keys, your first call, data controls, and a switchable architecture.
·14 min read
A startup CTO owns every technical decision the company cannot afford to get wrong: what to build, how to build it, who builds it, and how it stays secure. The job changes completely with stage. Here is what a CTO actually does at pre-seed, seed, Series A and beyond, the core responsibilities, how the role differs from a VP of Engineering, and when you need one.
·10 min read
You can build an MVP without a technical co-founder if your product is a well-understood build and the technology is not your moat. Here is the step-by-step path for non-technical founders: validate first, scope in screens, pick the right builder, rent technical judgment instead of giving away equity, and keep ownership of the code.
·10 min read
A tested setup for AirLLM 2.11.0 on an M-series Mac: the exact install, an ungated Llama 3.1 download to an external SSD, the four Apple Silicon fixes in one wrapper script, real speeds, and the errors you will hit.
·9 min read
A full-time startup CTO hired at seed to Series A typically earns $180,000 to $260,000 in salary plus 1 to 4 percent equity on a four-year vest. Here is how startup CTO compensation really moves with stage, salary, and timing, how much equity a CTO should get in each shape of the role, and where fractional CTO equity fits.
·10 min read
AirLLM promises 70B language models on a 4GB GPU. I ran it on a base M4 Mac mini with an external SSD, fixed four bugs to get it working on Apple Silicon, and timed every token. Llama 3.1 8B took 19.6 seconds per word. Here are the real numbers and when AirLLM is worth it.
·9 min read
India's Digital Personal Data Protection Act is usually explained by lawyers as a consent law. Read it as a security engineer and it looks different: the biggest penalty in the Act is for failing to protect data, not for failing to ask permission. Here is why the law was needed, what the DPDP Rules actually require, and what to build before May 2027.
·13 min read
Most startups don't get breached through a zero-day. They get breached through a shared admin login, a key in a repo, or one config line nobody reviewed. Here is the security checklist I work through in the first weeks of every engagement, including the AI-specific items most founders skip.
·12 min read
Hiring a CTO is the most expensive hire most founders ever make, and most of them make it in the wrong shape at the wrong time. Here is the whole process: deciding whether you need one, choosing between co-founder, full-time, fractional, and interim, finding candidates, evaluating them when you are non-technical, and paying them without giving away the company.
·11 min read
A fractional CTO gives you the same seniority for two or three days a week, no equity, and an exit. A full-time CTO gives you forty hours and total ownership, at roughly $260,000 a year plus equity. Here is the honest decision rule, from someone who has been both.
·9 min read
If a technical co-founder is building the entire product and you are pre-revenue, the defensible range is 40 to 50 percent of the founder pool. Here is what actually moves that number, why vesting matters more than the split, and the three patterns that turn a fair deal into resentment.
·10 min read
Five days ago a $40M startup launched a frontier model that cannot write a single word. Jev takes your program state and returns typed decisions with probabilities, in under a second, for almost nothing. Here's what it is, which claims hold up, and where I'd actually use it.
·11 min read
A fractional AI officer owns your model strategy, your inference economics, and your AI security posture, part-time. A fractional CTO owns your whole engineering org, AI included. Here's the honest difference, from someone who runs a production multi-LLM platform and holds an M.Tech in cybersecurity.
·8 min read
Apple just shipped its best chip, its first foldable, and a Siri that arrived two years late running on Google's models. Here is what is actually new, what the Duo gives up, why Apple is still this weak in AI, and how to not lose $300 on your old phone.
·12 min read
Most fractional CTO retainers fail quietly: hours get billed, nothing ships, and nobody can say why. Here is how I structure mine so that does not happen, including the one clause I refuse to put in a contract.
·9 min read
An MVP costs anywhere from $5,000 to $150,000+ in 2026 depending on who builds it and how the scope is controlled. Here are the real market numbers, the hidden costs nobody quotes, and why I price MVPs per screen so founders know the total before a single screen is built.
·9 min read
A fractional CTO is a senior technology executive who leads your engineering part-time, typically 2 to 3 days a week, for a fraction of a full-time CTO's cost. Here's what the role actually involves, what it doesn't, and how to tell if you need one. Written by someone who does this for a living.
·8 min read
Investors doing technical diligence on an AI startup now ask about model dependency, eval rigour, inference economics, and prompt injection, not just team background and burn rate. Here is what actually gets checked, from someone who has prepared for it and sat on the other side of the call.
·10 min read
Every technical person who looked at this problem walked away. It needed Linux, MERN, DevOps, Python, AI, security, and custom protocols in one head. Here's how we built it, went from processing thousands to 500,000 assessments in an hour, the one wrong AWS line that almost sank the launch, and why competitors now keep calling.
·9 min read
Every fractional CTO's website tells you why to hire one. Almost none of them tell you when not to. I have been on both sides of this decision six times as a founder and I am not going to sell you a retainer you don't need. Here is the honest version.
·10 min read
Most advice on finding a technical co-founder is written by people who have never been one. I've said yes six times and no far more often. Here's what actually makes engineers commit, what founders get wrong, and when you shouldn't look for one at all.
·12 min read
Most of the founders who ask me this do not need me yet, and I tell them so on the call. Here is the checklist I actually use: the signs you need a fractional CTO now, the signs you need something cheaper, and the signs you need something more expensive.
·8 min read
AI writes most of the code I ship. The 2019 junior developer role is gone and I don't hire for it. But 84% of developers use these tools and only 3% trust the output, and that gap is the job description I actually pay for now.
·5 min read
Most CTO interview question lists are written by recruiters who have never hired one. I have hired technical leaders for six companies I co-founded and been the candidate on the other side of this table more times than that. Here are the questions that actually separate a strong CTO from someone who interviews well.
·11 min read
No hustle-porn, no 4am cold plunges. Here's what an honest day actually looks like when you write code, run companies, and try to stay a real person across three continents.
·4 min read
Everyone wants the success story. The failures taught me more. Here's an honest look at the startups I co-founded that didn't make it - and the simple mistakes I kept repeating.
·8 min read
Prompt injection is the SQL injection of the AI era. If you are building with LLMs and you have not thought about this, your product has a hole in it. Here is what it is, how it works, and how to defend against it.
·10 min read
When I was doing my M.Tech in Cybersecurity, attackers were skilled but slow. That asymmetry is collapsing. Here is what AI-powered attacks actually look like, and what we built at ColadAI to fight back.
·12 min read
We spent years adding rules on top of rules to catch threats we had already seen. Then we rebuilt the detection layer with ML at ColadAI and realised we had been fighting the wrong battle the entire time.
·9 min read
You used to hire a tool. Now the tool does the hiring. I've watched founders replace entire ops workflows with a single agent. Here's what that actually looks like and what it means for what you're building.
·10 min read
The skills that make you a great engineer can quietly undermine you as a founder. Here's the trap most technical founders fall into - and how to get out of it.
·7 min read
A bad JEE rank felt like a closed door at 18. Fourteen years later, here's what actually happened - and what I'd tell my younger self about the roads that don't show up on the map.
·7 min read
