Developer tools
Frameworks, platforms and the craft of shipping.
Frameworks, hosting platforms and the small scripts that keep a business running. Pieces here start from release notes, changelogs and documentation, and say what a change means for a project that is already in production.
- News Work software
Nextcloud Collabora flaw joins CISA list; 29 and older get no fix
Attackers use a flaw in Nextcloud's built-in Collabora server to plant web shells. Nextcloud 29 and older have no patched build: upgrade or remove the app.
- News Developer tools
Brotli flaw spreads past Node.js to Python, Envoy, Istio and Bun
CVE-2026-111497 sits in Google's Brotli decoder, so any service that unpacks Brotli data needs a patched build, not only Node.js apps.
- News AI
OpenAI Decisions API leaves beta with no charge for output
Classifiers and routers can get typed answers from gpt-6-luna for $0.10 per million input tokens. The saving is the output fee; the bigger change is speed.
- News Developer tools
eMudhra quits TLS after key flaw; old trust stores still at risk
Browsers already block eMudhra's eight broken CAs. Servers, scripts, containers and macOS command-line tools may still trust them until you update.
- News Developer tools
GitLab CVSS 10 flaw hits every release since 7.0; patch again
A login-free code execution flaw hits self-managed GitLab servers on every release since 7.0. Older 19.x and 18.11 lines got fixes too.
- News Developer tools
PHP fixes are out: 8.5.12, 8.4.27, 8.3.36 and 8.2.35
PHP's two critical flaws hit every PHP web server, and only the update closes them. Ubuntu packages carry the fix under different version numbers.
- News Developer tools
PHP patches two critical bugs today; 8.1 and older get no fix
PHP ships fixes for two remote code execution flaws at 14:00 UTC. Sites on PHP 8.2 or newer can patch; older ones need a host's backport or an upgrade.
- News Developer tools
Google Cloud London outage: one-zone power event hit 38 products
A power event in one London zone disrupted Revolut for hours, and Google reported errors beyond that zone. What that means for multi-zone setups.
- News Developer tools
Cloudflare sends new projects to Workers; static sites stay free
Pages stays supported while feature work goes to Workers; static hosting stays free after a move, but only domains on Cloudflare's nameservers can follow.
- Analysis Developer tools
Scheduled scripts fail silently; seven checks make them speak up
In a 34-line invoice script, two lines find the late invoices; the rest of the work is making sure a failure reaches a person, as GitLab learned in 2017.
