Vulnerability Management in 2026: 48,185 CVEs, a Triaged NVD, EPSS v5
Vulnerability management in 2026 explained: 48,185 CVEs in 2025, 67,000+ by September 2026, an NVD that now enriches only KEV and critical software, the CVE funding scare, EPSS v5, CISA KEV at 1,748 entries, VEX and reachability, and a prioritisation order that works.
12 minOct 20, 2026TLS Certificate Lifetimes in 2026: 200 Days Now, 47 Days by 2029
CA/Browser Forum ballot SC-081 cut public TLS certificates to 200 days on 15 March 2026, then 100 days in 2027 and 47 days in 2029. What changed, what Let's Encrypt did (no OCSP, 6-day certs, ACME profiles, 45 days), and how ARI keeps renewals safe.
11 minOct 20, 2026Terraform State in 2026: S3 Locking Replaced DynamoDB, What Else Changed
What Terraform state is and how to run it in 2026: S3 native locking with use_lockfile (GA in 1.11, DynamoDB deprecated), backend choices, HCP Terraform per-resource pricing, OpenTofu state encryption, secrets in state, splitting state and Stacks.
13 minOct 20, 2026How to Self-Host n8n with Docker Compose in Queue Mode (2026)
Step-by-step n8n queue mode setup on Docker Compose: Postgres, Redis, a webhook processor, workers with task runner sidecars, the encryption key, N8N_WEBHOOK_URL, TLS with Caddy, backups, upgrades and patching. Tested on n8n 2.43.8.
16 minOct 20, 2026How to Deploy a Secure Remote MCP Server with OAuth (2026)
Step-by-step: run a remote MCP server over Streamable HTTP as an OAuth 2.1 resource server with Keycloak 26.8.1 and MCP Python SDK 2.3.0, validate audience and scopes per tool, add rate limits and audit logs, deploy to Cloud Run, and fix 401 and discovery errors.
16 minOct 20, 2026Secrets Sprawl 2026: 28.65M Leaked Keys and 64% Still Valid Years Later
What the 2026 secrets sprawl data says: 28.65M new secrets on public GitHub in 2025, AI service keys up 81%, AI-assisted commits leaking at twice the baseline, 24,008 secrets in MCP configs, 10,456 leaky Docker Hub images, and why 64% of old leaks still work.
13 minOct 20, 2026How to Stop Secrets Leaking Into Git: Gitleaks, Pre-commit, CI (2026)
Step-by-step guide to secret scanning in 2026: gitleaks 8.30.1 and TruffleHog 3.99.3 as pre-commit hooks, GitHub push protection, CI scanning with pinned actions, rotating a leaked key, and removing it from history with git filter-repo.
14 minOct 20, 2026Container Runtime Security in 2026: Falco vs Tetragon vs KubeArmor
Kubernetes runtime security in 2026: what Falco 0.45, Tetragon 1.7 and KubeArmor 1.7 actually do, detection versus in-kernel prevention, the runc, NVIDIA toolkit and containerd escape CVEs of 2025 and 2026, and where CNAPP vendors fit.
13 minOct 20, 2026How to Run an AI Coding Agent in GitHub Actions Safely (2026)
Step-by-step hardening for claude-code-action v1.0.254 and codex-action v1.13: SHA pinning, least-privilege permissions, safe triggers, keeping prompt injection from issues away from secrets, tool allowlists, turn caps, rulesets and troubleshooting.
15 minOct 20, 2026How to Defend LLM Apps Against Prompt Injection: 8 Steps (2026)
A practical prompt injection defence guide for LLM apps and agents: break the lethal trifecta, split privileged and quarantined models, gate tool calls in code, sanitise output, add Prompt Guard 2 as a tripwire, and red team with garak 0.17.1 and promptfoo 0.124.1.
17 minOct 20, 2026How to Implement Multi-Tenancy with Postgres Row-Level Security (2026)
Step-by-step Postgres row-level security for multi-tenant SaaS: tenant_id schema design, FORCE RLS and non-owner roles, policies using current_setting, SET LOCAL with PgBouncer transaction pooling, indexes, CI isolation tests and fixes for common errors.
13 minOct 20, 2026OWASP Top 10 for LLMs 2026 and Agentic Apps: 20 Risks, Real Incidents
The OWASP Top 10 for LLM Applications 2026 and the Agentic Top 10 explained risk by risk: what moved since 2025, the real incidents behind each entry (EchoLeak, Amazon Q, postmark-mcp, Replit), and the infrastructure controls that contain them.
13 minOct 20, 2026Multi-Tenant SaaS Architecture Explained: Silo, Pool, Bridge, Cells (2026)
Multi-tenant SaaS architecture explained: the AWS SaaS Lens silo, pool and bridge models, database-per-tenant vs shared schema with row-level security, noisy neighbours, cell-based architecture, and how to work out cost per tenant, with real examples.
12 minOct 20, 2026How to Migrate From ingress-nginx to Gateway API: Step-by-Step (2026)
A tested, step-by-step ingress-nginx to Gateway API migration: inventory annotations, install Gateway API v1.6.3 and Envoy Gateway v1.9.2, convert with ingress2gateway v1.2.0, handle TLS, rewrites and canaries, read route status conditions, cut over with DNS and roll back.
13 minOct 20, 2026MCP Authorization Explained: OAuth 2.1, RFC 9728 and CIMD in 2026
How MCP authorization works in the 2026-07-28 spec: OAuth 2.1 with PKCE, RFC 9728 protected resource metadata, RFC 8707 resource indicators, Client ID Metadata Documents replacing deprecated DCR, the token passthrough ban, and enterprise IdP access through ID-JAG.
12 min