The Blog
Timely takes on what's moving fast in tech, startups, and the industry: the conversations worth having right now. On-site and Medium, all in one place. Back to the blog.
OpenAI says an upcoming cyber model found 948 distinct Linux kernel privilege escalation bugs in one mid-October run, with working root exploits, for about $1.2 million in API credits. Here is what actually happened, why it changes the old assumption that a low-privilege foothold is contained, and the eight changes I'd make to a startup's servers, containers and CI this week.
·10 min read
Moonshot AI put the full Kimi K3.1 Pro weights on Hugging Face this week: a 2.8T-parameter MoE with 104B active, a 1M-token context and API pricing of $2 / $10 per million tokens. Here is what actually shipped, what the licence allows, why 1.56 TB of weights rules out self-hosting for almost every startup, how it compares on cost with Claude Opus 5.5, and a one-week evaluation plan before you switch anything.
·10 min read
CVE-2026-109518 lets an attacker who can tamper with the HTTP traffic between APT and its mirror swap a package after APT has verified it, and run code as root. It affects default Debian 12+ and Ubuntu 22.04+ setups. Here is who is exposed, the fixed apt versions for Debian and Ubuntu, how to upgrade apt safely (when the tool you are fixing is the one at risk), the Acquire::Retries stopgap, and what to do about Docker images and CI runners.
·9 min read
CVE-2026-98432 is a remote, unauthenticated use-after-free in the Linux kernel's IPv4 TCP code, present since Linux 4.4 and rated up to 9.8. Here is who is affected, which distributions have fixed kernels today (Debian, Amazon Linux, RHEL, Oracle) and which don't yet (Ubuntu stable), the exact commands to check and patch, the nftables stopgap and its limits, and what a startup should do this week.
·10 min read
On 14 October 2026 Next.js shipped an out-of-band fix for two critical unauthenticated remote code execution flaws and a Server Actions denial of service. Here is what each one needs to be exploitable, how to tell in five minutes whether your app is exposed, and a step-by-step upgrade guide, including the sharp trap that leaves 15.x apps vulnerable after upgrading.
·11 min read
PHP2Shell is a pair of critical PHP flaws that let an attacker run code on a web server with a single unauthenticated request. Exploitation started before the patch shipped. Here is what happened, who is affected, and a step-by-step guide to finding every PHP install, patching it, mitigating what you can't patch today, and checking whether you were hit.
·12 min read
AirLLM promises 70B language models on a 4GB GPU. I ran it on a base M4 Mac mini with an external SSD, fixed four bugs to get it working on Apple Silicon, and timed every token. Llama 3.1 8B took 19.6 seconds per word. Here are the real numbers and when AirLLM is worth it.
·9 min read
India's Digital Personal Data Protection Act is usually explained by lawyers as a consent law. Read it as a security engineer and it looks different: the biggest penalty in the Act is for failing to protect data, not for failing to ask permission. Here is why the law was needed, what the DPDP Rules actually require, and what to build before May 2027.
·13 min read
Five days ago a $40M startup launched a frontier model that cannot write a single word. Jev takes your program state and returns typed decisions with probabilities, in under a second, for almost nothing. Here's what it is, which claims hold up, and where I'd actually use it.
·11 min read
Apple just shipped its best chip, its first foldable, and a Siri that arrived two years late running on Google's models. Here is what is actually new, what the Duo gives up, why Apple is still this weak in AI, and how to not lose $300 on your old phone.
·12 min read
