Your Namespace-Scoped Sealed Secret Wasn't: What CVE-2026-22728's Rotation Bug Actually Broke
A rotation-endpoint bug in Bitnami's Sealed Secrets let attacker-controlled annotations turn a namespace-scoped secret cluster-wide — without touching Kubernetes RBAC at all. Here's the attack, and the NetworkPolicy audit every shared cluster needs to run.
Docker's CVE-2026-34040 Is the Second Time This AuthZ Bypass Shipped: A Padded HTTP Request Still Grants Host Access on Unpatched Engines Below 29.3.1
CVE-2026-34040 bypasses every Docker AuthZ plugin with one oversized HTTP request — the same underlying gap as 2024's CVE-2024-41110, patched twice and still exploitable below Engine 29.3.1. Here's the exact payload, why the first fix didn't hold, and what it means for a Cluster API fleet's patch discipline.
AWS Open-Sourced the Exact MCP Governance Layer Snowflake Just Paid to Acquire
Snowflake just paid an undisclosed sum to acquire Natoma's MCP governance gateway. AWS's Apache-2.0 mcp-gateway-registry already does the same identity, policy, and audit job — self-hosted on EKS, ECS, or a single Docker Compose file.
The Jscrambler npm Backdoor Beat npm's 3-Day-Old Fix — What That Means for Your Build Pipeline's Secrets
A compromised Jscrambler npm release beat npm 12's new install-script defaults within three days, stealing CI credentials and AI tool configs. Here's the build-pipeline architecture — platform-enforced script policy, egress-denied sandboxes, ephemeral scoped credentials — that actually closes the gap.
Anubis Crosses 20,000 Stars: What Self-Hosting Your Own AI-Scraper Defense Actually Costs
Anubis's proof-of-work challenge crossed 20,000 GitHub stars fighting AI scrapers — here's what it actually costs in compute versus what its JavaScript requirement costs real visitors, and whether a self-hosted PaaS should bundle it.
Dokploy's WebSocket Terminal Bug (CVE-2026-24841): One Exec Call, Root on Every Server It Manages
Inside Dokploy's CVSS 9.9 WebSocket terminal bug: the actual vulnerable code, why an argv-array fix only solves half the exploit path, and why the flaw reached every server the control plane manages over SSH, not just the local box.
Four Root Exploits in Ten Weeks: What GhostLock Says About Kernel Patching for a Self-Hosted PaaS
GhostLock lets any logged-in user become root in five seconds — and it's the fourth independently discovered kernel or hypervisor escape disclosed in ten weeks. Here's the patch-cadence argument for treating kernel CVEs as a same-day operational primitive on a self-hosted fleet.
Coolify Fixed 11 Critical CVEs in January. The Same Root Cause Struck Again in July
Coolify patched 11 critical CVEs at CVSS 9.4-10.0 in January 2026, then shipped a fix for the same root-cause bug class in July. Here's what the repeat says about single-daemon PaaS architecture versus RBAC-scoped, Kubernetes-native control planes.
10,000 MCP Servers and Counting: Why Deploy-From-Chat's Real Bottleneck Is Discovery, Not Capability
The official MCP Registry now lists nearly 10,000 servers and MCP SDKs hit 97 million monthly downloads. Here's why that scale makes discovery and trust the real bottleneck for a deploy-from-chat MCP server — and what actually closes the gap.