P.01A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption instead. CISA confirmed active exploitation on August 4 and set an August 7 remediation deadline. Here's what happened and what to patch.
P.02Uber's engineering org quadrupled frontier AI usage since January while cutting per-token cost, after blowing through a year's AI coding budget in four months. The CTO's public account of how is a useful playbook for any team past the AI adoption honeymoon.
P.03Unit 42 researchers found three ways local Windows malware can hijack Google Password Manager's synced passkeys, no biometric prompt or PIN required. Here's how the attacks work and what changes for anyone treating passkeys as unphishable.
P.04CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4. Unlike July's Langflow flaw, this one needs no credentials at all. Here's how the two-endpoint chain works and what to patch.
P.05Alibaba's Qwen3.8-Max launched August 3 with 2.4 trillion parameters, a 1-million-token context window, and a promise to open-source the weights within a week. Here's what actually changes for teams evaluating it against closed frontier models.
P.06Most agencies tolerate a bad client relationship for months longer than they should because nobody has a framework for the decision. Here's how to recognize when a client is no longer worth keeping, and how to end the relationship without burning your reputation.
P.07A circuit breaker stops you from calling a failing service. The bulkhead pattern is the piece that comes before that: making sure a slow, not-yet-failing service can't consume every thread and starve every other feature in the meantime.
P.08Four different philosophies for the same problem: getting a database schema from what it is to what it should be, safely, in a team. Here's how Flyway, Liquibase, Prisma Migrate, and Atlas actually differ, and which one fits your stack.
P.09Domain-driven design gets a reputation for ceremony: ubiquitous language, aggregates, bounded contexts, a vocabulary that scares teams off before they see the actual idea. The actual idea is simple and it solves a real problem. Here's what it is and when to reach for it.
P.10OpenAI cut GPT-5.6 Luna's API price 80% and Terra's 20% on July 30, three weeks after launch. Here's what moved, why it moved that fast, and how to decide whether to switch tiers instead of just enjoying a smaller bill.
P.11N-able's first fix for an N-central auth bypass was incomplete. The follow-up flaw, CVE-2026-18577, is now under active exploitation and lets attackers pivot from one RMM server into every endpoint it manages. Here's what to patch and how to check if you were hit.
P.12CVE-2026-20079 is a critical Cisco Secure FMC authentication bypass with a maximum 10.0 CVSS score, disclosed months before the hardcoded-password bug that made headlines. Here's why it matters anyway, and what to patch.