Late on Sunday, Bloomberg reported that Microsoft and OpenAI have ended their exclusive cloud-and-revenue-sharing arrangement — the deal that made Azure the de facto home for OpenAI’s models since 2019 and gave Microsoft a percentage of OpenAI’s revenue in return …
The pgBackRest GitHub repository was archived this week — the maintainer announced that the project is no longer being actively developed. For anyone running production PostgreSQL backups via pgBackRest (and that’s a lot of people; it’s been the de facto …
GitHub Copilot is moving to usage-based billing — announced this week on the GitHub blog. The flat $10 / $19 / $39 per-seat pricing isn’t going away entirely, but each tier now comes with a “premium request” budget, and once …
Howard Oakley’s eclectic-light blog flagged this week that the upcoming macOS 27 release brings a non-trivial reshuffle of how the OS handles networking — specifically the deprecation of a few long-standing low-level APIs and a tightening of how routing tables, …
One of the most common WordPress malware patterns I’ve cleaned in the last two years isn’t a webshell or a credential stealer — it’s a “fake plugin” or “fake theme.” The attacker creates a directory in wp-content/plugins/ or wp-content/themes/ with …
The Scratch team’s blog post on SVG sanitization (linked from Hacker News this week) is one of those technical write-ups that really should be required reading for anyone who lets users upload images to a web app. The author’s account …
You have a private server in a VPC that’s only reachable through a bastion host. The “obvious” way to SSH there is the wrong way: copy your private key onto the bastion, then SSH from bastion to the private box. …
Apple wants you to buy a Time Capsule, an iCloud subscription, or at minimum a Thunderbolt-attached SSD. None of that helps if you already have a Linux box sitting on your network with a few terabytes of free space. Time …
If a WordPress site of yours has been compromised — even briefly, even silently — there’s a very good chance it now has at least one administrator account that you didn’t create. Most WP malware families plant one as part …
Every WordPress site running with default config is being hammered right now by brute-force scripts hitting xmlrpc.php and wp-login.php. If you run multiple sites on a single OpenLiteSpeed (LSWS) box, dropping a per-site .htaccess rule on each one is …