Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3404 posts · View all authors
Dokploy's WebSocket Terminal Bug (CVE-2026-24841): One Exec Call, Root on Every Server It Manages
Inside Dokploy's CVSS 9.9 WebSocket terminal bug: the actual vulnerable code, why an argv-array fix only solves half the exploit path, and why the flaw reached every server the control plane manages over SSH, not just the local box.
The EU's Cloud Sovereignty Framework Grades Providers SEAL-0 to SEAL-4: Where Owned Hetzner Hardware Lands That a Hosted PaaS Provider Can't Follow
The EU's new SEAL-0 to SEAL-4 sovereignty scale just rated a Google-powered cloud service 'sovereign' — here's the real methodology behind that number, and where self-hosted, owned Hetzner hardware actually lands on it.
The EU Data Act's Cloud-Switching Mandate Takes Effect: What a 30-Day Portability Deadline and a 2027 Fee Ban Actually Change
The EU Data Act's cloud-switching rules are already in force: a 2-month notice cap, a 30-day transition window, and a full ban on switching fees from January 12, 2027. Here's the exact timeline, what it actually forces vendors to hand over, and what it still doesn't reach.
Fly.io's Job Postings Hit Zero While Render and Railway Raise $100M Each
Fly.io's careers page shows zero open roles the same year Render and Railway each raised $100M — a concrete checklist for reading hiring and funding signals before you build a business on any hosted PaaS.
Four Root Exploits in Ten Weeks: What GhostLock Says About Kernel Patching for a Self-Hosted PaaS
GhostLock lets any logged-in user become root in five seconds — and it's the fourth independently discovered kernel or hypervisor escape disclosed in ten weeks. Here's the patch-cadence argument for treating kernel CVEs as a same-day operational primitive on a self-hosted fleet.
Giant Swarm's AI Agent Platform Proves Cluster API Scales — But Not Every Layer It Runs
Giant Swarm's production numbers — 2.8x lower cost per agent run, 500 parallel agents — validate Cluster API and GitOps as an AI-agent substrate. But its Backstage-centric IDP layer is a $300K-$700K/year commitment a simpler git-push control-plane API doesn't need.
GitHub Copilot's Token Billing Blindsided Users With 25-60x Bills — What It Means for Metering an MCP Server
GitHub's June 2026 switch to token-metered Copilot billing collided with its own research showing agentic tasks burn 1,000x more tokens than chat — real bills jumped 10x-50x. Here's the exact retrofit GitHub, Cursor, and Replit all shipped too late, and what an MCP-metered PaaS should ship on day one instead.
GuardFall: Why 10 of 11 Open-Source AI Coding Agents Can't Tell What Bash Will Actually Run
Adversa AI's GuardFall research found 10 of 11 open-source AI coding agents check a shell command's raw text for danger, then hand that text to bash, which rewrites it before running. Here are the five bypass classes, per-agent results, and what it means for building agent-callable deploy tools.
Hetzner Killed the datacenter Field: Is Your CAPH Fleet's CCM Still Reading It?
Hetzner quietly deprecated the datacenter field on Servers and Primary IPs, and any hcloud-cloud-controller-manager older than v1.30.1 panics once it disappears. Here's the exact check, the exact failure mode, and the upgrade path for a Cluster-API-provider-Hetzner fleet.