Blog
Insights on software development, security, and technology from our team.
A polluted prototype can hijack your axios traffic. Upgrade to 1.18.0.
axios just disclosed CVE-2026-67320, a prototype pollution flaw in its Node.js HTTP adapter that can reroute your server's outbound requests through an attacker-controlled proxy and leak credentials over plaintext HTTP. It's a sharp reminder that a dependency you barely configure is still attack surface. Here's what to patch, and what to change beyond the patch.
React Compiler goes Rust, and Next.js 16.3 can already use it
The React team rewrote the React Compiler in Rust, and Vercel wired it into Turbopack. Next.js 16.3 reports 20 to 50% faster route compilation on the native path. We break down whether the experimental flag is worth flipping, and how to test it without risking production.
One POST request now owns a default WordPress site. Patch to 7.0.2 today.
WordPress just patched wp2shell, an unauthenticated remote-code-execution chain in core that turns one crafted request into a full site takeover on a default install. It affects versions 6.8 through 7.0.1, and public exploit code is already circulating. Here's what web and security teams should do this week, and how to check if you were already hit.
SwiftUI's @State just became a macro, and Xcode 27 will break some of your builds
WWDC 2026 turned SwiftUI's @State from a property wrapper into a macro. In Xcode 27 a common init pattern now fails to compile. The App Store floor is still iOS 26, so this is a chore you can schedule, not an emergency, if you start now.
A critical PhpSpreadsheet bug walked straight through its own patch
PhpSpreadsheet's fix for a phar deserialization bug got bypassed with a path carrying one extra slash. The new flaw, CVE-2026-45034, is a 9.2 critical: full remote code execution on PHP 7.x and a file-read primitive on PHP 8.x. Here is how the bypass works and what your team should do this week.
TypeScript 7.0 is 10x faster and written in Go. Here's how to adopt it without breaking CI.
Microsoft shipped the TypeScript 7.0 Release Candidate on June 18, 2026, and the big change is the compiler itself, now written in Go and roughly 10x faster than 6.0. It's a port rather than a rewrite, so the type rules stay the same. The smart move is to run it as a shadow CI job now and adopt it on your own schedule.
Node.js is dropping odd-versus-even. Here's how to plan your upgrades now.
Node.js is retiring the odd-versus-even release model that backend teams have leaned on for a decade. Starting with version 27, there's one major a year, every release becomes LTS, and a new six-month Alpha channel opens this October. Here's what that changes if you run Node in production, and the one CI job to add now.
Redis 8.8 finally has native arrays and a built-in rate limiter. Here's what to do with them.
Redis 8.8 just shipped with a native array data type and INCREX, a built-in rate-limiting command that replaces the hand-rolled Lua most teams run today. The features are genuinely useful, but the smart move isn't to upgrade on Friday. Here's how we'd approach it for a client, and the one audit worth doing this week regardless.
Android is officially Compose-first. Your View-based app is now legacy code.
At Google I/O 2026, Google made Jetpack Compose the official way to build Android UI and moved the View toolkit into maintenance mode. For the many production apps still built on Views, that turns a long-running question into a real decision. Here is how mobile teams should respond, without rewriting everything at once.
Apple and Google just made phones less sticky. Mobile teams need a new playbook.
iOS 26.5 shipped this week with wireless Transfer to Android, RCS end-to-end encryption, and a new App Store subscription tier. Hours later, Google's Android Show I/O Edition 2026 confirmed the cooperation runs both ways. Platform lock-in just got weaker, and that changes how mobile teams should think about retention and pricing.
Next.js just patched 13 security advisories. Self-hosted teams have the most work.
Vercel shipped a coordinated security release on May 7: 13 Next.js and React Server Components advisories covering DoS, SSRF, cache poisoning, and middleware bypasses in App Router. Self-hosted teams running Node are hit hardest. The deeper takeaway: middleware was never an authorization boundary.
An AI agent nuked a production database in 9 seconds. Here's what went wrong.
A Cursor agent running Claude Opus 4.6 autonomously deleted a startup's entire production database and backups through a single API call. The incident exposes real gaps in how teams hand AI agents the keys to production infrastructure.