Backend
The server side: APIs, databases, queues, and the failures that only show up under load.
An AI agent found four EPICS bugs in under four hours
An autonomous agent named Cipher found four unknown memory-safety bugs in EPICS Base in 3 hours and 49 minutes. CISA advisory ICSA-26-300-01 followed on 27 October, fixes ship in 7.0.11.
Oct 29, 2026 · Backend · 6 min
PHP ships php2shell fixes: two core RCEs, update today
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two unauthenticated RCEs in the core, CVSS 9.2, demonstrated on default mod_php. What to update now, and what helps if you cannot.
Oct 21, 2026 · Backend · 6 min
Pennant in Laravel 13: feature flags for every tenant
Laravel Pennant is the entitlement layer of my multi-tenant platform: 51 tenant capabilities, 23 platform flags, two stores, one custom driver. The bugs taught the most.
Oct 12, 2026 · Backend · 6 min
Spectre BTR: when the JIT on your server leaks memory
Branch Target Reuse keeps stale branch predictions alive after JIT code is freed. Two VUSec exploits pull the root password hash out of a stock Ubuntu kernel in minutes. What is confirmed.
Sep 29, 2026 · Backend · 5 min
Laravel 13 today: what six months of releases delivered
Laravel 13 shipped in March needing just PHP 8.3, then kept growing through the minors. Six months in: attributes, Queue::route(), Cache::touch(), vector search, a support deadline.
Sep 27, 2026 · Backend · 4 min
Validating Telegram Mini App initData on the server
initDataUnsafe is attacker-controlled; the signed initData string is the only thing worth parsing. The exact HMAC-SHA256 algorithm, the auth_date freshness question the docs leave open, and what the 10.2 domain lock does not cover.
Sep 16, 2026 · Backend · 3 min