CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint, fixed in August but flagged as actively exploited by Singapore's CSA on 4 November. Here's what's affected, the workaround, and the cleanup steps most people skip.
Dockhand's BSL 1.1 promised a fixed Apache 2.0 conversion date. That date quietly became a rolling four-year window per release — which never actually arrives if the project keeps shipping. A reminder to read the license text, not the marketing page, before building infrastructure around a tool.
Alpha.19 replaces Craft's upload stack with Uppy, shared upload sessions, and tus/S3 multipart transports — uploads that can bypass the PHP process entirely and survive you navigating away mid-upload. It's also a real breaking change for anyone hooking the old multipart endpoints.
The 2026-07-28 Model Context Protocol spec removed sessions, the initialize handshake, and SSE resumability entirely. If you're running an MCP server behind a reverse proxy, these are the breaking changes that will actually bite, not just a version bump.
Komodo is a Rust-based, fully open Docker fleet manager built around declaring stacks as TOML in a Git repo. Here's the actual architecture — Core/Periphery split, outbound-only agent connections, PKI auth — and what it costs you versus a Portainer-shaped dashboard.
PHP pre-announced an emergency release on 20 Oct, then shipped 8.5.12/8.4.27/8.3.36/8.2.35 fixing two critical RCEs the next day. My Dockerfile already pointed at the right base image tag — and that still wasn't good enough. Here's why, and the one-line fix.
Let's Encrypt's default cert drops from 90 to 64 days on 10 Feb 2027. For a default Traefik/Coolify box, nothing breaks — the stock 30-day renewal window has margin to spare. The real trap is the 'helpful' edit of setting certificatesDuration to match, which shrinks your buffer from 34 days to 10.
Coolify holds every key on my VPS, so when it shipped seven releases in three days (one feature reverted 37 minutes after it landed), I wrote an update policy instead of clicking Update. Patch for security on its own clock; adopt features a beat late, after the hotfix storm settles.
Five security-bearing Traefik patch releases between 31 Jul and 6 Oct 2026, all sharing one bug class: the proxy and the backend parse the same request differently. Why that's an argument for app-level authorization.
