Engineering notes
Security, runtime behavior and operations.
Technical analysis with primary sources, configuration details and verification procedures.
- PostgreSQL 19 is a release candidate: what a Patroni upgrade should checkPostgreSQL 19 RC1 is out, RC2 lands 12 November and general availability is planned for 19 November 2026. A planning checklist for a Patroni-managed cluster.
- TLS certificates are getting shorter: 200 days now, 100 days in 2027The 200-day maximum is already in force, Let's Encrypt moves to 64-day and then 45-day certificates, and hardcoded renewal intervals need to change now.
- nginx 1.30.6 and 1.31.7: the October 2026 security releaseFive nginx CVEs fixed in October 2026: the affected directives, exposure conditions, fixed versions, and how to confirm which build is actually serving.
- CVE-2026-109618: PHP memory exhaustion and request cleanupHow PHP's OOM bailout corrupts request state, why mod_php and FPM differ, and how to verify a patched deployment.
- CVE-2026-109619: stale PHP state across worker requestsThe producer-consumer lifetime bug behind CVE-2026-109619, conditional FPM exposure, and a practical worker-replacement and configuration review.
- CVE-2026-115560: audit PHP session serialization changesThe configuration and application-code conditions behind PHP's October 23 session advisory, with a source audit, mitigation placement and regression plan.
- Disable SEO URLs in the Spinning addonTurn off the Spinning addon's SEO URL rewriting by changing one constant in its configuration file.
- Add subscribers using the Interspire XML APIImport or add subscribers to any Interspire Email Marketer contact list with the XML API exposed by the Installer addon.
