Learning Linux in 2025! Get your hands dirty with the Linux Command Line CTF Challenges on @learntocloud It literally takes 15-20 second to deploy the provided lab environment in your choice of cloud. More challenges coming soon.

This week has been rough to run anything in production! Secrets: > Railway: decrypted env vars exposed, all deploys paused > Zeabur: attacker read the platform database, env vars included > OpenCode: Console breach exposed OpenAI, Anthropic and Google API keys > TeamUpdraft: UpdraftCentral keys abused to backdoor WordPress sites > ConnectWise: cloud backup identities compromised Supply chain: > LiteLLM 1.107.0: malicious PyPI and Docker release > OVHcloud CLI: official binaries backdoored > Rank Math PRO: malware shipped in an official update > Tensorlake and SubQuery: npm packages infected > GhostAction: around 1,900 GitHub accounts hit with malicious workflows Patch these now: > PHP2Shell: pre-auth RCE in PHP core, every version back to 5.4 > Node.js: RCE and TLS validation bypass fixed > GitLab: CVSS 10 unauthenticated RCE > Plex2Shell: actively exploited to drop crypto miners Trust layer: > eMudhra: CA keys compromised, rogue TLS certs possible > Tailscale: caught up in the eMudhra incident Most of this isn't bad code. It's secrets and dependencies we trusted. What I'd do today: patch PHP and Node, rotate any key stored on a third-party platform, pin your dependencies, and update your trust store.

3 years ♥️

I am serious let's shutdown the Internet for a week

Today we are in a security nightmare: - Railway may have exposed customer environment variables and API keys - SBI confirmed that customer records ended up on the dark web - eMudhra's certificate keys were extremely weak (one was literally just the number 4) - LiteLLM shipped a compromised version that steals credentials and includes a backdoor - PHP released two critical remote code execution vulnerabilities (PHP2Shell) - Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates - Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records - OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users - Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers - GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler

see you all next week at @github universe!

played this, so much nostalgia! thank you, may your pillow always be cold

new mechanical keyboard added to the setup!

AI-102 is retired. Its replacement, AI-103, is a very different exam. I just passed the Microsoft AI-103 (Azure AI Apps and Agents Developer Associate), and made a video on how I prepared. The biggest shift: it's no longer "which Cognitive Service do I pick?" It's agents, tools, RAG, and Microsoft Foundry. A few things that helped me: - Start with the official study guide. AI-103 is new, so a lot of third-party content is still recycled AI-102 material. - Spend most of your time on 2 domains. Planning/securing Foundry + building gen AI apps and agents make up 55-65% of the exam. - Know which agent tool fits which scenario: File Search vs Azure AI Search, Bing grounding, Code Interpreter, function calling, OpenAPI, MCP. - Managed identity beats API keys. Every time. - Go hands-on. Build one agent in Foundry and the whole object model clicks. If you're coming from AWS like me, I also mapped the Azure services to their AWS equivalents in my notes. Video - piped.video/3Ew7kLkv8gk

👀👀@github

wait, what!

time to try Gemini 4 Argon in the @github copilot!

Today we are rolling out Gemini 4 Argon globally in the Gemini API, to Pro + Ultra in Gemini App, and Ultra subs in Antigravity! Argon is a huge step forward for Gemini, and a labor of love. This model has been battle tested by over 100,000 people at Google over the last month, with so much new innovation, ambition, and hard work baked into this release. The team has been heads down over the last 6 months working to make this possible across the stack (research, infra, safety, eng, etc). We rolled the model out to cyber defenders as part of our fairwind program and early access customers over the last 2 weeks, it has been amazing to see and talk to folks who are now using this model daily. Seeing the models writing capability, raw knowledge and persistence for coding, paired with new features like 1M token output when the model needs to work more has gotten me even more excited about our path ahead. This is just the start of the Gemini 4 era. As you saw with 3.5, 3.6, 3.7, and 3.8 Flash, our iteration speed with Gemini is fast : ) Now with Gemini 4 Argon to work from, I am cannot wait to see the progress continue, and most importantly see what this new model enables for the world. This is such a special moment in the arc of technology, as millions of people everyday tackle problems they could never have thought possible before. Gemini 4 Argon was built to help you tackle the hardest problems. I have personally felt this spark with Argon and hope you do too. Onwards!!

good morning run! 🏃🏽

OpenCode 2.0 anoma.ly/notes/opencode-2-0/

i sat down and reflected on my 8 years working in the tech! here are 8 lessons:

the surface laptop ultra is a good release and i am tempted!

my first time playing grass volleyball league! and it is pretty competitive. looking forward to a good season.

it’s here! thanks for the suggestion @madebygps

some days don’t go your way. you can question the timing, replay what could’ve been, or wonder why things didn’t work out. but none of that changes the next step. take the lesson. keep the gratitude. Let go of the rest. what’s meant for me may take a different road to find me. until then, we keep moving