Your Node Buildpack's --ignore-scripts Flag Didn't Stop Phantom Gyp
A June 2026 npm worm called Phantom Gyp bypassed --ignore-scripts entirely by hiding in binding.gyp instead of a lifecycle script — here's the exact mechanism, why it worked, and what a git-push buildpack needs to do instead of trusting one flag.
Pulumi Neo Is GA and Reads Your Terraform State Directly — Here's Why bex's Deploy API Won't
Pulumi Neo reads live Terraform and CloudFormation state directly and executes changes inside it. bex's MCP server calls a fixed, enumerable set of verbs instead. Here's the concrete case for why an agent that can create and destroy production infrastructure needs to know which shape it's actually operating under.
Railway's Reliability Problem: Five Incidents Since November 2025, and What an Outage Actually Costs a Migrating Team
Railway has logged five platform incidents since November 2025, including an 8-hour GCP account suspension. A worked cost model — SLA credits, hot-standby insurance, and the actual incident bill — for a team deciding whether to migrate.
The Heroku Buildpack Compatibility Myth: What Render's 'Zero-Config Migration' Actually Runs On
Render's 'Heroku buildpack support' is Cloud Native Buildpacks auto-detection, not the literal bin/detect/compile/release scripts your Heroku app runs today — here's the real API gap and what closing it actually takes.
Your AI App Builder Ships Where It Wants: The Open Deploy-Target Gap Behind v0, Bolt, Lovable, and Replit
v0, Bolt, Lovable, and Replit Agent all generate a working app and default to deploying it on their own cloud. Here's exactly what 'export the code' does and doesn't get you, and what it actually takes to run the result somewhere you own.
VolumeAttributesClass Went GA Promising Online Volume Resize. Here's What Actually Happens on a Self-Hosted Hetzner Fleet
Kubernetes 1.34 made VolumeAttributesClass GA, promising online volume tier changes with no detach-recreate cycle. Here's what actually happens when you check the CSI drivers a self-hosted Hetzner fleet runs — and the live gap even the one that supports it hasn't closed yet.
Your Admin Dashboard Doesn't Need Keycloak: Authelia and Pocket ID as Forward-Auth, Not Full IdP
A concrete Traefik+Authelia and Caddy+Pocket ID+OAuth2-Proxy walkthrough for locking down a self-hosted PaaS's own admin dashboard, plus the RAM/dependency numbers that show why a full IdP is the wrong tool for this specific job — and the line where it stops being wrong.
AWS CloudFront's Control-Plane Failure Took Down Hugging Face and Canvas: What Owning Your Infrastructure Doesn't Save You From
A CloudFront control-plane bug took down Hugging Face, Canvas, and Blackboard at once, even though none of them run application logic on CloudFront. A layer-by-layer look at what owning your own ingress actually removes from that risk — and what it only relocates.
AWS Built a Five-Step AI Agent Just to Pick a Service
AWS's deploy-on-aws plugin takes five steps and three MCP servers to deploy an app because it's solving a 200-service menu problem. Here's what happens to that step count on a platform that never had the menu — and the one step that stays hard everywhere.