Ingress2Gateway 1.0: A Scripted Migration Path Off the Now-Read-Only Ingress-NGINX
Ingress-NGINX is archived and unpatched — ingress2gateway 1.0 converts existing Ingress objects to Gateway API automatically. What converts cleanly, what needs hand-migration, and the five behaviors that break silently.
Coolify v4 Is a Rolling Beta: What Pinning the Platform Underneath Your Apps Actually Requires
Coolify v4.3.1 was 'latest patched' on August 12 and four releases behind by August 16 — inside a CVE cluster with RCE to host root. How to run a rolling-beta PaaS panel safely: version-pinned installs, a staging canary box, and advisory-feed monitoring.
Your Registry Is a Trust Root: What the JFrog Artifactory Breach Campaign Teaches Self-Hosters
Attackers chained three Artifactory flaws into full admin takeover of self-hosted registries — then planted backdoors that survive patching. The timeline, the kill chain, and a 7-item hardening checklist for your own OCI store.
Your TLS Renewals Have an Expiration Date Too: Auditing cert-manager for Let's Encrypt's 45-Day Countdown
Let's Encrypt drops to 45-day certificates by 2028 — run this four-step cert-manager audit on versions, hardcoded renewBefore windows, the ARI gate, and expiry alerting before fixed renewal intervals start breaking.
Your Build Server Was Owned for 24 Days. Patching It Doesn't Tell You What Shipped Clean.
Attackers held admin access to self-hosted JFrog Artifactory servers for 24 days in August-September 2026, planting Rust backdoors with remote C2. A triage table for which window artifacts are suspect, the rebuild-and-compare procedure that re-verifies them, and the SLSA signing checklist that makes the next incident answerable.
Node 26 Hits Active LTS on October 28: A Builder Checklist for Git-Push PaaS Teams
Node.js 26 becomes Active LTS on October 28, 2026 — with Yarn v1 and Corepack gone from builder images and six tenant-facing breakages to triage. A dated checklist for git-push PaaS operators covering default-flip timing, EOL warnings, and the annual cadence that starts with Node 27.
Stop Guessing When to Renew: cert-manager 1.21 Lets Let's Encrypt Tell Your Fleet When
cert-manager 1.21 adds experimental support for ACME Renewal Information, letting Let's Encrypt tell each certificate when to renew instead of clients guessing at two-thirds lifetime — plus the safe upgrade order for its breaking RBAC changes.
The Heroku Exit Playbook's Missing Half: Pipelines and Review Apps on Machines You Own
The Heroku exit playbook moved apps, add-ons, and data — but release process stayed behind. A concrete mapping of Pipelines promotion and Review Apps onto Kargo, GitHub Actions environments, and per-PR namespaces, with the honest cost of replicating automatic per-PR databases.
MinIO Vanished From Docker Hub: The One-Line Fix and the Migration You Actually Owe Yourself
MinIO deleted minio/minio and minio/mc from Docker Hub in mid-September 2026, breaking every cold docker compose pull. The quay.io repoint restores green builds today — but that image is frozen forever, so here is the honest SeaweedFS vs Garage vs RustFS comparison plus the registry mirror that makes the next deletion a non-event.