Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3404 posts · View all authors
A 'Medium' CVE Popped a Full Reverse Shell: What ms-agent's Six-Layer Regex Bypass Teaches About Agent Sandboxing
CVE-2026-2256 scored a 'Medium' 6.5 on CVSS, but its proof-of-concept is a full reverse shell through an AI agent's own shell tool. Here's exactly how a six-layer regex denylist got bypassed, and why only a real sandbox boundary — not command validation — closes the gap.
Next.js 16.2 Ships a Stable Adapter API — Vercel's Build Contract Is Now Public
Next.js 16.2's stable Adapter API turns Vercel's once-private build output into a public, testable contract. Here's what the NextAdapter interface actually exposes, and what it takes for a self-hosted platform to build a native adapter instead of guessing.
The State of Platform Engineering Vol 4: 29.6% of Platform Teams Don't Measure Success at All
A 2026 survey of 518 platform engineers found nearly a third don't measure success at all. Here's what the budget and adoption data actually show — and three cheap metrics to instrument instead so your platform isn't next year's defunded line item.
Your Files Never Moved: What Plex's July 2026 Outage Reveals About Fake Self-Hosting
Plex's July 14, 2026 outage never touched a single self-hosted file — but users still got locked out, because auth and discovery route through Plex's cloud by default. Here's what that reveals about the gap between owning your disk and owning your infrastructure.
PowerDNS Operator: The Last Layer a Self-Hosted PaaS Still Outsources
PowerDNS Operator turns DNS zones and records into Kubernetes Custom Resources so tenants can self-serve custom domains via RBAC instead of a shared API credential — here's the CRD model, the win over external-dns, and the anycast tradeoff it doesn't solve.
Your Namespace-Scoped Sealed Secret Wasn't: What CVE-2026-22728's Rotation Bug Actually Broke
A rotation-endpoint bug in Bitnami's Sealed Secrets let attacker-controlled annotations turn a namespace-scoped secret cluster-wide — without touching Kubernetes RBAC at all. Here's the attack, and the NetworkPolicy audit every shared cluster needs to run.
How SNCF Cut Kubernetes Cluster Provisioning From 30 Days to 30 Minutes With Cluster API
SNCF rebuilt its on-prem Kubernetes fleet around Cluster API, cutting cluster provisioning from 30 days to 30 minutes and reconciling every cluster monthly with zero drift — a real-world case for owning the machines under a self-hosted platform.
Tekton Joins the CNCF: What Building a Git-Push PaaS's Pipeline Directly on Kubernetes CRDs Actually Buys You
Tekton became a CNCF incubating project on March 24, 2026. Here's what building a self-hosted PaaS's build pipeline directly on its Task and Pipeline CRDs actually gets you architecturally — and where the platform still has to fill in the gaps.
Gateway API v1.6 Graduates UDPRoute to GA: What It Actually Takes to Route Non-HTTP Traffic on a Self-Hosted PaaS
Gateway API v1.6 made UDPRoute GA, but controller support is uneven, there's an upgrade-order trap that drops traffic, and UDPRoute still can't multiplex tenants on one port the way HTTPRoute does. Here's what actually changes, with a working example.