THE JDNEER

Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do

Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do

GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.

Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.

Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.

A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.

eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust

eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust

Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.

The Threat Was Already Badged In: Insider Lessons From Two Lab Poisoning Cases

The Threat Was Already Badged In: Insider Lessons From Two Lab Poisoning Cases

A Wyoming grad student is accused of poisoning an officemate, and the internet already called it espionage. The charge says assault. What the court record actually shows, and the access, procurement, and reporting controls that would have caught it sooner.

Rakazo v0.3.3: What's New in the Self-Hosted Grok Bot Alternative

Rakazo v0.3.3: What's New in the Self-Hosted Grok Bot Alternative

Rakazo, the open source, self-hostable AI agent platform, shipped v0.3.3 on October 22. A small release: delete chats on mobile, Telegram replies with images and files, and a handful of fixes.

PHP CVE-2026-115560: Disable Session Upload Progress Until the Next Release

PHP CVE-2026-115560: Disable Session Upload Progress Until the Next Release

PHP.net recommends setting session.upload_progress.enabled=0 to block an unlikely RCE vector, CVE-2026-115560. No patch yet; the fix comes in the next regular release. Only apps that switch serialize_handler to php at runtime are exposed.

Quad9 Leaves France: When a DNS Resolver Becomes a Censorship Tool

Quad9 Leaves France: When a DNS Resolver Becomes a Censorship Tool

A Paris court ordered Quad9 to block IPTV piracy domains for beIN. Rather than lie to its users or apply French law to the whole world, Quad9 will stop serving France on November 24. Why resolvers are the wrong place to fight piracy.

Unpatched KSMBD Bugs Hit Public Kernel Lists: What It Means for You

Unpatched KSMBD Bugs Hit Public Kernel Lists: What It Means for You

Trend Micro ZDI copied unpatched Linux kernel bug reports, including two CVSS 9.0 KSMBD flaws, to public mailing lists. Greg Kroah-Hartman objected. The exposure is narrow: only hosts running the in-kernel SMB server. Here is how to check.

DITO CME elects four new directors at annual stockholders' meeting

DITO CME elects four new directors at annual stockholders' meeting

DITO CME Holdings elected Oozi Cats, Xinxin Wang, Enrique Pampolina and Cenon Audencial Jr. to its board, as Eric Recto and Salvador Medialdea ended their terms.

TESDA's two-day cyber workshop is a start. Let's not call it a cyber skills push

TESDA's two-day cyber workshop is a start. Let's not call it a cyber skills push

A two-day workshop for TESDA's own ICT staff is a reasonable start, not a national cyber skills effort. Here is what would build real capability.

Signal Bug CVE-2026-113380 Could Keep Your Mic Live After You Hang Up

Signal Bug CVE-2026-113380 Could Keep Your Mic Live After You Hang Up

A RingRTC flaw rated CVSS 9.3 let a malicious Signal caller flood the call state machine so your hang-up never landed, keeping the mic and possibly the camera live. It was fixed in RingRTC 2.72.0 on September 4. Here is how to check your app.

The downfall of bgp.exchange: how a volunteer peering exchange lost its domain, mail and management plane in a day

The downfall of bgp.exchange: how a volunteer peering exchange lost its domain, mail and management plane in a day

In September 2026 a volunteer peering exchange lost its domain, mail and management plane in about a day. A timeline from public records.