Engineering notes
Security, runtime behavior and operations.
Technical analysis with primary sources, configuration details and verification procedures.
- Install scripts are the supply-chain attack surfaceThe 2026 npm and PyPI compromises ran through lifecycle scripts and stolen publish tokens. A probe that shows what your install actually executes.
- Proxmox VE 9.2: what changes before you upgrade a cluster9.2 adds dynamic HA load balancing, disarm/arm HA, WireGuard and BGP SDN, and a 7.0 kernel. An upgrade order and probe for an existing cluster.
- Zabbix 8.0 is a release candidate: inventory before the LTSZabbix 8.0 is at release candidate and planned as the next LTS. A probe to record the server, database and frontend state the upgrade depends on.
- Docker Engine 29: the image store changed under youEngine 29 makes the containerd image store the default for new installs, bumps the API, and its 29.9.x line carries a long list of security fixes.
- Prometheus 3 changes queries, not just the binaryThe 3.0 migration guide is a list of silent behaviour changes: regex newlines, left-open ranges, normalized le labels and strict scrape content types.
- MySQL 8.0 is out of support: an upgrade probe for 8.4 LTSMySQL 8.0 reached end of life in April 2026. Three queries that find the accounts, plugins and replication state blocking an 8.4 upgrade.
- OpenSSL 4.0 is current: find the copies your services actually loadOpenSSL 4.0 shipped in April 2026 and 4.1 in October. A probe that finds the OpenSSL builds linked into running services, not the one on PATH.
- OpenSSH 10.6: the October 2026 security releaseOpenSSH 10.6 fixes a compression side-channel, tightens command-line username handling, and enables a hybrid post-quantum signature by default.
- MTA-STS, TLS-RPT and DANE: mail transport security with Postfix 3.10Postfix 3.10 adds TLS-RPT reporting for DANE and MTA-STS. What the three mechanisms do, how to enable reporting, and what the implementation does not cover.
- DMARC is now RFC 9989: what changed in May 2026The DMARC specification was replaced in May 2026. The pct tag is gone, np and psd arrived, and policy discovery no longer uses the Public Suffix List.
