Anthropic says Claude traced the NIST curve seeds to 1997 clocks
Anthropic says an internal model traced the NIST P-256 seed to 16 August 1997. Filippo Valsorda says he reproduced it. Users need not switch curves.
Wildness 2/5 · Mostly tamed
Habitat H4 · 141 sightings
DevOps & IT
Running AI: infrastructure, deployment, cost, security, and operations. Every sighting here, newest first, with its specimen number and wildness rating.
CERT-In says AI agents reached Indian organisations' live systems
CERT-In says unnamed AI providers disclosed that agents reached Indian organisations' live systems and read personal and confidential records.
Wildness 3/5 · Partly tamedLet's Encrypt sets a 64-day default certificate lifetime for February 2027
On 10 February 2027 Let's Encrypt defaults to 64-day certificates unless a subscriber picks 45 or 6 days. It expects the last 90-day one to expire 11 May 2027.
Wildness 2/5 · Mostly tamedCloudflare reports an OpenAI crawler pilot indexed new pages
Cloudflare's 15 October post says a July pilot on about 1% of its network fed discovery signals to OpenAI's search crawler. The page count is Cloudflare's.
Wildness 4/5 · Still wildMoynihan says Bank of America added 1,000 consultants on Mythos work
On the Q3 call, Moynihan tied a couple of hundred million plus to AML and Mythos work, and said 1,000 consultants were added.
Wildness 3/5 · Partly tamedAnthropic moved its monorepo from Git to an in-house system, Scion
Anthropic says daily merges rose from around 2,500 in May to over 30,000 in September, and that seven people built Scion in five months.
Wildness 4/5 · Still wildHiddenLayer says a Jev checkout agent clicked a planted ad
HiddenLayer says a Jev checkout agent gave a planted Confirm Price button 91 percent. The Register says TypeSafe did not immediately reply.
Wildness 3/5 · Partly tamedVercel counts 1,285 sandbox reports and a Linux kernel defect
Vercel's 14 October post counts 1,285 sandbox-challenge reports and $242,000 paid, with 57 valid findings. A Linux kernel defect is the critical one.
Wildness 3/5 · Partly tamedNoma says a patched Claude Desktop preview bug could read local files
Noma says an HTML file over 256 KB in Claude Code Desktop's preview pane could read local files. The CVSS 8.7 score and the 1.30096.1 fix are Noma's account.
Wildness 4/5 · Still wildTiger Data ships pg_vectorsearch, an alpha PRISM index for Postgres
Tiger Data's 13 October post introduces pg_vectorsearch, an alpha Postgres extension with a PRISM index. The post says pgvectorscale moves to maintenance.
Wildness 3/5 · Partly tamedCloudflare's API MCP server can push Workers Issues as events
Cloudflare's 13 October changelog says the API MCP server posts Workers Issues to a client webhook. Issues is an open beta and free during the beta.
Wildness 3/5 · Partly tamedNVIDIA says the Run:ai platform is now open source
NVIDIA's 13 October post says Run:ai is open source under DSX. The platform and its component repositories are under Apache 2.0.
Wildness 3/5 · Partly tamedIntel names Crescent Island the GPU D-series, led by the air-cooled D270
At OCP, Intel named Crescent Island the GPU D-series. GPU D270 is a 350 W air-cooled PCIe card. Specs are Intel's. No price or ship date.
Wildness 4/5 · Still wildAssign an incident commander, a scribe and a communications lead
Split incident duties into named roles with explicit handover rules, so the people fixing the problem are not also writing updates and keeping the timeline.
Wildness 1/5 · TamedLink every alert to its runbook with a Prometheus annotation
Add summary and runbook_url annotations to Prometheus alerting rules, render them in Alertmanager templates, and test them so the on-call link never goes missing.
Wildness 1/5 · TamedMirror production traffic to a new model version before it serves users
Use an Istio VirtualService to copy live requests to a candidate model deployment, discard its responses, and compare its errors and latency with the stable version.
Wildness 1/5 · TamedLiveness and readiness probes answer different questions
Liveness decides whether Kubernetes restarts a container. Readiness decides whether it gets traffic. Wiring one health check to both turns a slow dependency into a restart storm.
Wildness 1/5 · TamedA CPU percentage needs two readings
Linux records how much CPU time a process has used, never a percentage. Every percent figure is a difference over an interval, which is why ps and top disagree and why a tool can print a confident zero.
Wildness 2/5 · Mostly tamedOne systemd setting keeps a service out of swap
MemorySwapMax=0 on a systemd unit stops that one service from being swapped out while the rest of the machine still can be. How to set it, read it back and undo it, and what it costs.
Wildness 2/5 · Mostly tamedA swapped-out process looks small in a memory list
A process list sorted by resident memory can hide the largest holder, because memory pushed to swap no longer counts as resident. Where Linux records the swapped part, and a one-line way to rank by both.
Wildness 2/5 · Mostly tamedWhy your servers disagree about the time
Two machines' logs that don't line up can mean one clock isn't synchronised, or that time zones got mixed. How to check sync on Linux, and which clock to use for timestamps and for durations.
Wildness 1/5 · TamedRotating logs without losing lines
logrotate can rotate a log by renaming it or by copying and truncating it. One can lose lines, the other needs the program to reopen its file. How to tell which your service needs.
Wildness 1/5 · TamedOne env file, three parsers
The same line in an environment file can give three different values in Docker Compose, a systemd unit and a shell. Three documented differences: comments, backslashes and spaces.
Wildness 1/5 · TamedCron or a systemd timer: what happens when the job fails
Both run a job on a schedule. They differ in what happens when the machine was off, when the last run is still going, where the output ends up, and who hears about a failure.
Wildness 1/5 · TamedNVIDIA and AMD each propose a rack for running AI agents at OCP
At the OCP summit in San Jose, NVIDIA and AMD each described a rack for AI agents, apart from GPU inference. Both are designs and plans, not shipping tests.
Wildness 3/5 · Partly tamedMicrosoft says Maia 300 starts production deployments in 2027
Scott Guthrie says Azure Maia 300, Microsoft's third in-house inference chip, begins production deployments in 2027 and is meant to be the company's main inference system. The efficiency figures are Microsoft's.
Wildness 4/5 · Still wildZod's 21 September malicious commits were reverted the same day. npm 4.6.6 is clean.
Two 21 September commits added a loader and a root-level preinstall key to Zod's git repo and were reverted that day. The npm tarballs for zod and @zod/mini 4.6.6 do not contain them.
Wildness 2/5 · Mostly tamedLMCache's multiprocess socket still unpickles network data, with no release fix
JFrog rates CVE-2026-105192 at 9.8 for pickle on LMCache's multiprocess ZeroMQ socket when that socket is routable. No release removes the path. Pull request 5644 is open and unmerged.
Wildness 3/5 · Partly tamedSplit one data center GPU into isolated slices with NVIDIA MIG
MIG cuts a supported NVIDIA GPU into up to seven instances with their own memory, cache and compute. How to create them and pick a profile for a model server.
Wildness 1/5 · TamedPostgreSQL 19 general availability moves to 19 November 2026
The release team is keeping PostgreSQL 19 RC1 on 15 October 2026, adding an RC2 on 12 November, and moving general availability from 29 October to 19 November. The roadmap still said October.
Wildness 2/5 · Mostly tamedA Replication Slot Can Keep Old WAL on Disk
An inactive PostgreSQL replication consumer can retain write-ahead log files. Learn how to inspect slot state and choose between unbounded retention and a finite recovery window.
Wildness 1/5 · TamedPipelining Redis Commands Does Not Make Them a Transaction
Pipelining cuts Redis request round trips, while MULTI/EXEC controls whether a group runs without another client interleaving. Choose by the state guarantee each operation needs.
Wildness 1/5 · TamedA Telephony Audio Frame Must Match the Wire Format
Twilio outbound media expects base64-encoded raw μ-law audio at 8 kHz. A voice model’s PCM or WAV output needs explicit conversion before it reaches the call.
Wildness 1/5 · TamedA Large UDP Message May Depend on Every IP Fragment
One missing IP fragment can erase a whole UDP datagram. Path MTU discovery and application-sized messages help voice systems avoid that failure mode.
Wildness 1/5 · TamedTCP Keepalive Is Different From a Request Deadline
A Linux TCP connection can look healthy while an AI request stalls. Keepalive, user timeout, and an application deadline answer different questions.
Wildness 1/5 · TamedHTTP/2 Streams Still Share One TCP Loss Event
HTTP/2 interleaves independent request streams, yet one missing TCP segment can delay them together. QUIC changes stream delivery, with limits of its own.
Wildness 1/5 · TamedA Valid Certificate Still Needs to Match the Hostname
A trusted TLS certificate can belong to the wrong service. Follow the reference hostname into subjectAltName and reject mismatches without Common Name fallback.
Wildness 1/5 · TamedALPN Chooses a Protocol Inside the TLS Handshake
A trusted certificate can coexist with an unexpected HTTP protocol. Learn how ALPN selects h2 or http/1.1 and what to verify at a voice or AI API edge.
Wildness 1/5 · TamedTelemetry Resource Attributes Describe Who Produced the Signal
OpenTelemetry resource attributes identify the emitting service and environment. Keep request details on spans so voice application traces group by a stable service identity.
Wildness 1/5 · TamedJournald Can Drop Messages During a Log Burst
A burst of voice worker errors can exceed journald’s per-service limit. Learn how its interval, burst and disk rules affect what an incident log can prove.
Wildness 1/5 · TamedA Notify Service Must Actually Announce Readiness
What systemd waits for with Type=notify, when an application should send READY=1, and why short-lived helpers can lose notifications.
Wildness 1/5 · TamedSystemd Can Stop Restarting a Service That Fails Too Often
How systemd restart policy meets start-rate limits, and why clearing a failed counter is a separate step from fixing a service.
Wildness 1/5 · TamedDeleting an Open File May Leave Its Space Allocated
Why a removed log can still consume disk space, and how to identify the process holding it before taking action.
Wildness 1/5 · TamedA Redis Script Is Atomic While It Blocks Other Work
A Lua script can keep a Redis read-and-update decision together, but every millisecond of execution holds up other server activity. Bound the work before using EVAL.
Wildness 1/5 · TamedA Redis Eviction Policy Decides Which Writes Can Fail
Redis memory pressure can evict a cache key or reject a write. Choose the policy by deciding which data may disappear and how the application handles a full instance.
Wildness 1/5 · TamedA one-day-old SQLite extension claims many writers on one ordinary file
Marco Bambini's sqlite-multiwriter, a VFS extension created 8 October 2026, claims concurrent writers on one SQLite file. The 5.7x and 3.0x figures are the project's own runs.
Wildness 4/5 · Still wildBarracuda: one phishing email targets the person and the AI summary
Barracuda describes a phishing email aimed at the person and at the AI assistant that summarizes the inbox. The research gives no count of how widespread the campaign is.
Wildness 4/5 · Still wildA Counter Reset Changes How a Monitoring Query Reads the Line
A restarted voice worker can make a cumulative request counter fall. Use Prometheus rate on each series before summing replicas, and keep gauges for values that fall normally.
Wildness 1/5 · TamedSQLite 3.54.0 ships a CLI overhaul and new limits for untrusted SQL
SQLite 3.54.0 is dated 9 October 2026, ahead of the 15 October date still on its draft changelog. The release overhauls the shell, drops Windows XP, and adds limits for untrusted SQL.
Wildness 2/5 · Mostly tamedDuckDB's v2.0 CLI gets an agent mode that writes for the model, not the terminal
DuckDB's v2.0 CLI detects coding agents and switches to compact Markdown tables, explicit truncation and JSON errors. DuckDB says agent output fell 59%, about 0.5% of total input tokens.
Wildness 2/5 · Mostly tamedWhy PostgreSQL 19 lost features late in beta, from a committer who lost some
Committer Peter Eisentraut says 8 to 10 significant features were reverted from PostgreSQL 19 in beta. He points to LLM-assisted review finding defects faster and security work cutting review time.
Wildness 2/5 · Mostly tamedNVIDIA DCGM Exporter flaw CVE-2026-47483 can crash GPU monitoring on exposed hosts
NVIDIA's bulletin rates CVE-2026-47483 at 8.2: unauthenticated pprof requests can exhaust DCGM Exporter. Lava found about 2,100 hosts exposing exporter metrics. NVIDIA lists 4.8.2 as the fix.
Wildness 3/5 · Partly tamedA self-funded check of Postgres 19 beta finds a small OLTP gain
Kaarel Moppel's self-funded cloud runs put PostgreSQL 19 Beta 3 and Beta 4 about 3 percent ahead of 18.6 on his OLTP tests, with pgbench inserts about 25 to 30 percent faster. It is one person's beta benchmark.
Wildness 4/5 · Still wildincident.io says savepoints throttled a Postgres queue under SKIP LOCKED
incident.io's 6 October post says each on-call tick ran in a savepoint, so SKIP LOCKED workers piled up on MultiXact locks. A lease, no subtransactions, and one claimer per pod preceded a 3.5 times gain.
Wildness 4/5 · Still wildPlanetScale TIN 1.0.6 speeds tied BM25 top-k queries, and 1.0.4 added stemming
PlanetScale says TIN 1.0.6, rolling out over the next week, uses a block-max plan for BM25 top-k queries that also sort by a heap column. Stemming for 18 languages arrived in 1.0.4 and needs a rebuild.
Wildness 4/5 · Still wildGoodfire says activation probes can monitor open agents from inside the model
Goodfire says a probe plus a judge reached about 93 percent recall on harmful Kimi K3 sessions, at roughly 50 times lower cost than judging every turn. TechCrunch says Baseten customers can enable the monitors.
Wildness 4/5 · Still wildA Filesystem Can Run Out of Inodes Before Bytes
A voice pipeline can fail to create another tiny segment while capacity still looks available. Check inode supply alongside bytes and find the owning directory before changing data.
Wildness 1/5 · TamedDNS Can Cache the Absence of a Name
Creating a DNS record for a new voice endpoint does not clear earlier negative answers. Learn how NXDOMAIN, NODATA and SOA-derived lifetimes affect rollout checks.
Wildness 1/5 · TamedCompose Expands Variables Before Starting the Container
A voice service can receive a different setting from the one Compose used to build its configuration. Learn how defaults, host inputs and escaped dollar signs cross that boundary.
Wildness 1/5 · TamedA Bind Mount Can Hide Files Already in an Image
A bind mount overlays its container target, hiding files packaged there. Read-only protects the host source from container writes but does not preserve obscured image files.
Wildness 1/5 · TamedA Secret Mounted With SubPath Will Not Receive Updates
Kubernetes refreshes ordinary Secret volume files eventually, but a subPath mount stays on its old content. Credential rotation also needs an application reload or a Pod rollout.
Wildness 1/5 · TamedA Build Secret Should Travel Through a Secret Mount
BuildKit secret mounts make credentials available only to the build instruction that needs them. ARG, ENV and copied files can disclose values through image metadata, layers or cache.
Wildness 1/5 · TamedA Terminating Pod Still Has an Endpoint Lifecycle
EndpointSlice conditions distinguish an endpoint that is serving from one accepting normal new traffic. Use ready, serving, and terminating to design a drain policy for long voice or AI sessions.
Wildness 1/5 · TamedNeon puts Lakebase Search synonyms and stop words in SQL tables
Neon says the lakebase_tokenizer extension, packaged with Lakebase Search, stores synonyms and stop words in SQL tables. The post does not name a new plan or region.
Wildness 2/5 · Mostly tamedpgx-bm25 1.0 adds BM25 as a native PostgreSQL index
PGX says pgx-bm25 1.0 is a PostgreSQL-licensed BM25 index for PostgreSQL 17 and 18. The index lives in the server's own pages, so it gets WAL, crash recovery, and VACUUM.
Wildness 2/5 · Mostly tamedClickHouse Cloud calls executable UDFs generally available
ClickHouse's 5 October post calls executable UDFs generally available on AWS, GCP, and Azure, with a Native runtime beside Python 3.11. Its Cloud UDF overview still labels the console, API, and Terraform paths beta.
Wildness 4/5 · Still wildYou Cannot Average P95s
Averaging latency percentiles across replicas can misstate an endpoint’s performance. Histograms let you combine observations before calculating p95.
Wildness 1/5 · TamedWhy a Pod Runs Out of Memory Before the Node Does
Memory requests place a Pod. Limits constrain its containers. Learn how to tell a container out-of-memory kill from node-pressure eviction and size inference workloads accordingly.
Wildness 2/5 · Mostly tamedWhen Dependabot Puts Several Fixes in One PR
Dependabot grouping rules decide which security fixes arrive together. Review the configuration and each affected dependency before merging.
Wildness 2/5 · Mostly tamedTrace Baggage Can Travel to a Third Party
OpenTelemetry baggage can leave an AI service in outbound HTTP headers. Check what a model API receives and limit propagation at that boundary.
Wildness 3/5 · Partly tamedThree Replicas Can Still Land in One Failure Zone
A replica count alone does not spread Pods across failure zones. Kubernetes topology spread constraints let you define the placement you need and the tradeoff when a zone is unavailable.
Wildness 2/5 · Mostly tamedThe Upload That Failed but Kept Charging
An incomplete S3 multipart upload can leave billable parts behind even when no finished object appears. Here is how to find and clear them.
Wildness 3/5 · Partly tamedThe Trace Pipeline Can Lose the Failure
A Collector can accept spans while its exporter falls behind. Its internal metrics show where delivery slows, where data is refused, and when loss becomes likely.
Wildness 2/5 · Mostly tamedThe SQLite Reader That Kept the Log Growing
An open read transaction can keep SQLite’s write-ahead log growing even while automatic checkpoints run. Here is why, and how to find the cause.
Wildness 2/5 · Mostly tamedThe Scratch Volume That Dies With Its Pod
A Kubernetes scratch volume can hold files a model server prepares at startup. Its lifetime makes it a poor home for the only copy of a model or a result.
Wildness 2/5 · Mostly tamedThe Debug Container You Add After Deployment
An ephemeral container gives you a way to inspect a running Kubernetes pod when its application image lacks a shell or diagnostic tools.
Wildness 2/5 · Mostly tamedThe Calls Behind One Agent Answer
A trace can show which model calls and tool runs produced an agent response, where the time went, and how many tokens each call used.
Wildness 2/5 · Mostly tamedStage Model Assets Before the Server Starts
Use a Kubernetes init container and a shared volume to put model files in place before an inference server starts. Plan for retries, storage use, and model loading.
Wildness 2/5 · Mostly tamedReading a 429: rate-limit headers for agents
A 429 can tell an agent when to retry and which limit it reached. The response body also matters: some 429s will not clear with backoff.
Wildness 3/5 · Partly tamedProtect Inference Capacity During a Node Drain
A PodDisruptionBudget can limit how many inference pods a node drain evicts at once. Its allowed-disruptions count shows when the workload has room for another eviction.
Wildness 2/5 · Mostly tamedParadeDB 0.26.0 ships vector pushdown for RRF and a vector tie-break
ParadeDB tagged v0.26.0 on 3 October 2026. The notes include vector pushdown for RRF queries and ORDER BY that can push a vector distance plus a tie-break column. The pull requests merged in July.
Wildness 2/5 · Mostly tamedPriority Can Jump the Queue Without Evicting a Pod
Kubernetes can give urgent Pods earlier scheduling attempts without removing running work. Non-preempting priority still depends on suitable capacity.
Wildness 3/5 · Partly tamednpm trusted publishing can opt in to dist-tag changes
GitHub's 30 September 2026 changelog adds an opt-in Allow npm dist-tag permission on trusted publishing, so an OIDC workflow can move latest, next, or beta without a long-lived token. It defaults to off.
Wildness 2/5 · Mostly tamedFirst Token and Next Token Need Separate Charts
A response can be slow to start or slow to continue. vLLM exposes separate metrics for those delays, making each easier to investigate.
Wildness 2/5 · Mostly tamedWorkers Web Crypto adds ML-KEM and ML-DSA behind a compatibility flag
Cloudflare's 1 October 2026 post adds ML-KEM and ML-DSA to Workers Web Crypto, off until you set webcrypto_modern_algorithms. ML-KEM-512 is absent. SHA-3 and HPKE are not in this change.
Wildness 3/5 · Partly tamedWorkers KV Instant is a private beta on Quicksilver, with a 1 MB cap
Cloudflare's 1 October 2026 post introduces Workers KV Instant, a private beta that replicates keys through Quicksilver. Reads are $0.20 per million, and a namespace tops out at 1 MB.
Wildness 4/5 · Still wildCloudflare Traces follows one request across the platform, in open beta
Cloudflare's 2 October 2026 post opens Cloudflare Traces in beta: one OpenTelemetry timeline for supported security, cache, routing, Worker, and origin steps, exported over OTLP. New ingest pricing starts 1 December.
Wildness 4/5 · Still wildDecide Which Agent Traces to Keep After They Finish
Head sampling controls trace volume early. Tail sampling can retain runs that later fail or become slow, if the pipeline can hold and route their spans.
Wildness 2/5 · Mostly tamedManaged Cloudflare OS opens a waitlist and connects GitHub repositories
Cloudflare's 1 October 2026 post opens a waitlist for a managed Cloudflare OS deployment. Self-hosting remains. The same post says the workspace can now use a GitHub repo and more of Google Workspace.
Wildness 4/5 · Still wildCloudflare's OHTTP Gateway enters a closed beta for apps already on Cloudflare
Cloudflare's 2 October 2026 post adds an OHTTP Gateway in closed beta, as a paid add-on with a waitlist. The older Privacy Gateway relay is renamed OHTTP Relay. The gateway refuses Cloudflare-proxied clients.
Wildness 4/5 · Still wildCloudflare K2 is a public beta for durable event streams on R2
Cloudflare's 1 October 2026 post launches K2 in public beta: an ordered event log stored as files in R2, with competing consumers or fan-out. Cloudflare says produce latency is about 1 second at p99.
Wildness 4/5 · Still wildCloudflare renames its data platform Basin and calls it generally available
Cloudflare's 1 October 2026 post says the data platform from Birthday Week 2025 is now Basin, and that Pipelines, Catalog, and SQL are generally available on Apache Iceberg in R2.
Wildness 4/5 · Still wildCPU Requests Place Pods; CPU Limits Throttle Them
CPU requests guide Pod placement. CPU limits cap a running container's CPU time.
Wildness 1/5 · TamedCPU Is Not the Queue
Inference requests can wait while CPU utilization stays below its scaling target. Measure pending work and queue delay to decide when more workers are useful.
Wildness 2/5 · Mostly tamedBuild Tools Need Not Ship With the Server
A multistage Docker build can compile an application in one stage and copy the finished binary into a smaller final image.
Wildness 1/5 · TamedBefore Giving an AI Agent Production Access, Check the Boundaries
Aviram explains why separate credentials, limited permissions and protected backups matter when AI agents work with real infrastructure.
Wildness 2/5 · Mostly tamedAutoscaling Happens in Steps
A sudden inference surge meets several gates before new Pods serve traffic. Follow the autoscaler's measurement loop, replica rules, Node capacity, and readiness.
Wildness 2/5 · Mostly tamedAn S3 ETag Is Not Always the File's MD5
Multipart uploads and some encryption modes produce ETags that cannot be compared with a file's MD5. Use an explicit S3 checksum when verifying object data.
Wildness 2/5 · Mostly tamedAn Agent Span Has Moments Inside It
A lasting agent operation has a start and an end. Named, timestamped events show when approvals, state changes, and failures occurred along the way.
Wildness 2/5 · Mostly tamedA User ID Is an Expensive Metric Label
A user ID on a Prometheus metric creates series across other label dimensions. Here is how that affects storage and queries, and how to keep useful operational detail.
Wildness 2/5 · Mostly tamedA Signed Build Is a Traceable Build
A build attestation can connect a downloaded binary to its source repository and build workflow. Verification still leaves the decision to trust that code with you.
Wildness 2/5 · Mostly tamedA NetworkPolicy Takes Time to Reach the Pod
Creating a Kubernetes NetworkPolicy does not mean its rules are already enforced. Learn what can happen during the handoff and how to check the result.
Wildness 3/5 · Partly tamedA Namespace Quota Can Reject a Pod at Admission
A Deployment can exist even when its Pods cannot be created. Check namespace quota usage and resource declarations before investigating node placement.
Wildness 2/5 · Mostly tamedA GPU Is an Integer to Kubernetes
Device plugins advertise GPUs as countable resources. That changes how Pods request them and how many workloads a node can schedule.
Wildness 2/5 · Mostly tamedA Failed Rollout Can Keep Retrying
A Kubernetes progress deadline reports a stalled rollout. The Deployment can still complete after the underlying problem is fixed.
Wildness 2/5 · Mostly tamedA Cloud Deploy Without a Stored Cloud Key
A GitHub Actions job can use OpenID Connect to obtain short-lived AWS credentials. The role trust policy decides which job may deploy.
Wildness 2/5 · Mostly tamedStopping a service cleanly: signals, grace periods and PID 1
Docker and Kubernetes ask a container to stop with SIGTERM and then kill it. Why some services never hear the request, and how to make sure yours finishes its writes before the grace period runs out.
Wildness 2/5 · Mostly tamedRead-replicas and the illusion of one database
A read replica lags its primary and is read-only. Code that treats it as the same database can read stale data, or find its queries cancelled mid-flight.
Wildness 1/5 · TamedCloudflare adds a Web Search API to AI Gateway
Cloudflare has launched a Web Search API through AI Gateway with Ceramic.ai, Exa and Linkup. REST and Workers bindings are documented; billing depends on whether a provider key is stored.
Wildness 2/5 · Mostly tamedWhat a container image tag actually promises
A tag like :latest or :2.1 is a name that can be moved to a different image at any time. A digest cannot. What that means for what you run, and how to pin it.
Wildness 2/5 · Mostly tamedA health check that checks the wrong thing
An open port and a running process say little about whether a service actually answers. How to write a health check that asks the real question, in Docker and Kubernetes.
Wildness 2/5 · Mostly tamedSecrets in AI agent workflows: three ways they leak
API keys rarely leak through the vault. They leak through a command line other users can read, a URL that gets logged, and a conversation transcript that gets archived.
Wildness 2/5 · Mostly tamedLogging AI agent runs: what never to write down
Agent logs are tempting to fill with everything: prompts, tool calls, environment, full requests. A short list of what must never land in them, and why scrubbing has to happen before the write.
Wildness 2/5 · Mostly tamedClickHouse Managed Postgres: Direct I/O wal-g backups that spare the page cache
ClickHouse (Oct 2, 2026): Managed Postgres live wal-g backups use WALG_DIRECT_IO plus stripe-sized RAID0 NVMe reads to skip page-cache eviction. Vendor benches only; incremental still prototyping.
Wildness 3/5 · Partly tamedDisk at 97 percent: early warnings on a small server
A full disk breaks everything at once. Where the space usually hides on a small Linux server, and the warnings worth setting before the last few percent go.
Wildness 2/5 · Mostly tamedSupabase is acquiring Turso: Postgres stays, SQLite stays, Glauber leads agentic infra
Supabase (Oct 2, 2026) is acquiring Turso. Supabase continues Postgres; Turso continues SQLite. Glauber Costa joins with Pekka Enberg and the Turso team to lead agentic infrastructure. No deal price is disclosed.
Wildness 4/5 · Still wildSet it aside instead of deleting it: recoverable cleanup for AI agents
When an AI agent is not sure a file is safe to delete, the right move is a recoverable one: move it to a holding folder with a note, and let the owner decide.
Wildness 2/5 · Mostly tamedThe only backup that counts is one you have restored
A backup file you have never restored is a hope, not a backup. A short restore drill for small servers, and the two database mistakes it catches most often.
Wildness 2/5 · Mostly tamedMany AI agents on one machine: ports, claims, and who owns what
Several AI coding sessions sharing one server will collide over ports, checkouts, containers and disk. Four small habits that keep them out of each other's way.
Wildness 3/5 · Partly tamedPgpool-II JVN#22475874: seven CVEs; lead OOB write CVSS 8.7/8.8
JVN#22475874 (2026-09-29): seven Pgpool-II CVEs; lead CVE-2026-92867 authenticated OOB write (CVSS 4.0 8.7 / 3.0 8.8)—process termination and arbitrary code execution. Fixed in 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21.
Wildness 5/5 · WildPostgreSQL 19 REPACK (CONCURRENTLY): what Marek’s benches cost
Radim Marek (boringSQL, Sep 28) benches PostgreSQL 19beta4 core REPACK (CONCURRENTLY) vs pg_repack/pg_squeeze: WAL, disk, cluster-wide VACUUM hold-back, ~105M change ceiling, and MVCC caveats—author benches only.
Wildness 4/5 · Still wildRedis CVE-2026-81934: TLS pending-data use-after-free (High 7.5)
Redis advisory CVE-2026-81934 (Aug 28, 2026): authenticated TLS pending-data use-after-free; public CVSS revised 9.8→7.5 High. Upgrade OSS/Software builds; Cloud Essentials patched, Pro underway.
Wildness 5/5 · WildRedis Software for Kubernetes: Active-Active updates wiped passwords
Redis operator 7.22.2-45 (Sep 2026) fixes a high-severity Active-Active bug: GitOps/config updates could send an empty password—DB stayed healthy while accepting unauthenticated clients. No CVE for this bug.
Wildness 5/5 · WildAlloyDB PostgreSQL for agents: Preview isolated query compute
Google Cloud AlloyDB “PostgreSQL for agents” (docs updated Sep 24, 2026) is Preview only: agents query live transactional data with isolation from core systems and can scale compute to zero when idle.
Wildness 4/5 · Still wildClickHouse in Fabric: workload preview and OneLake Iceberg read GA
ClickHouse (Sep 29, 2026): Fabric workload in public preview; OneLake Iceberg read GA via Table APIs; Iceberg write in public preview with credential vending; Azure BYOC on the Microsoft Marketplace.
Wildness 4/5 · Still wildchDB Durable Layer: flush, checkpoint, and object-storage agent memory
ClickHouse’s chDB Durable Layer (Sep 28, 2026): local MergeTree plus object storage via flush()/checkpoint(). chDB 4.4+ with chdb[durable]; chdb-core 26.7.3; single-writer. npm [email protected] differs from the Python package.
Wildness 5/5 · WildMySQL, PostgreSQL, or SQLite for an AI app? Start with where your data lives
MySQL and MariaDB now document native vector features, PostgreSQL can use pgvector, and SQLite can add search through extensions. Here is how to choose by deployment shape and retrieval needs.
Wildness 5/5 · WildPgBouncer 1.26.0: three DoS CVEs fixed + pool_idle_timeout
PgBouncer 1.26.0 (Sep 23, 2026) fixes CVE-2026-19888, CVE-2026-6668, and CVE-2026-6669 (DoS only: crash, infinite loop, unbounded login work; no RCE or CVSS). Also: pool_idle_timeout and query_wait_timeout; -R removed.
Wildness 5/5 · WildPlanetScale Neki: cooling hot shards when tenant_id sharding breaks
PlanetScale’s hot-shards post (Sep 28, 2026) walks multi-tenant AI SaaS through vertical scale, whale isolation, and online table-level Reshard on Neki—without taking the app offline. The post gives no Neki GA date beyond “since the launch of Neki.” The Slack Vitess analogy is third-party; Slack does not run on Neki. “Fastest cloud Postgres” is PlanetScale’s own claim.
Wildness 3/5 · Partly tamedMongoDB Atlas Agent Engine public preview — runtime, memory, governance
MongoDB launched Atlas Agent Engine in public preview (press Sep 29, 2026): unified execution, memory, and governance on Atlas with Voyage AI retrieval. Not GA, and no GA date is given. Preview pricing subject to change. Not a substitute for Atlas Vector Search; separate from the Voyage/Atlas $rerank deep dives. Framework names are used in Atlas’s framing only.
Wildness 4/5 · Still wildRedis 8.4: XREADGROUP CLAIM for single-shot Streams recovery
Redis 8.4 adds optional CLAIM min-idle-time on XREADGROUP—claim idle PEL entries then read new ones in one command (shared COUNT). Idle ms + delivery count come back when CLAIM is used; XACK still required. ~22.5× vs XAUTOCLAIM is Redis-reported on their stress setup.
Wildness 4/5 · Still wildQdrant Constella research preview: hot-swap query encoders
Qdrant’s Constella research preview (Sep 29, 2026): index docs once with Stella (400M English), then query with Zero, Nano, or Stella against the same collection—no re-embedding. Research preview, not GA. Encode-speed and nDCG figures are vendor-reported.
Wildness 5/5 · WildAzure SQL DiskANN vector index & search GA
DiskANN approximate vector indexes are GA in Azure SQL Database, Azure SQL Managed Instance (Always-up-to-date), and Fabric SQL (Hoffman Sep 29; Thota Sep 28). Vectors sit next to operational rows under the same T-SQL/security model—no separate vector store. SQL Server 2025 / MI on SQL Server 2025 policy stay preview.
Wildness 4/5 · Still wildDatabricks Lakebase Search GA: Postgres ANN + BM25 hybrid
Databricks GA’d Lakebase Search on AWS/Azure (blog 2026-09-28): lakebase_vector (ANN) + lakebase_text (BM25) in the same serverless Postgres OLTP—hybrid via RRF, no separate search cluster. VectorDBBench/Conexiom figures are vendor-reported.
Wildness 5/5 · WildAurora PostgreSQL: query Iceberg and Parquet via embedded DuckDB
AWS GA’d direct Iceberg/Parquet lake queries from Aurora PostgreSQL (2026-09-30) via embedded DuckDB and aurora_analytics—no ETL. Join live ops rows (incl. uncommitted) with the lake. PG 17.11+/18.6+; no extra feature fee (compute + S3).
Wildness 4/5 · Still wildAmazon S3 Vectors: metadata pre-filtering in ENHANCED index mode
AWS S3 Vectors (Sep 30, 2026) adds ENHANCED index mode that filters metadata before similarity search, plus $startsWith. AWS claims up to 5× more matching vectors on highly selective filters—vendor figure, not house-verified. No extra cost; CLASSIC until you upgrade.
PostgreSQL can cover an AI app's search and data needs
pgvector, JSONB, full-text search and row security can support an AI app in one PostgreSQL database, with practical limits to measure before you scale.
Wildness 4/5 · Still wildAI code reviews left 88 GB of build folders in /tmp, with no cleanup rule
A nearly full disk on a machine running AI review sessions: what was using the space, the explanation I checked first, and the rule that would have prevented it.
Wildness 3/5 · Partly tamedRedis for AI apps: where shared state helps
A practical guide to using Redis for response caches, request limits, agent queues, session memory and vector retrieval, with the correctness and licensing trade-offs to check first.
Wildness 4/5 · Still wildAWS ships a Well-Architected Agent API, and the Rust SDK has it on day one
AWS's Rust SDK release of September 25 carries the Well-Architected Agent, a generative AI service that reviews an AWS environment and ranks fixes for cost, security, performance and resilience.
Wildness 3/5 · Partly tamedMicrosoft's new Surface PCs drop the Copilot+ PC name, two years after its launch
Microsoft's September 23 Surface launch never says Copilot+ PC, and a Surface executive told Windows Central the new machines are not called that, though Microsoft has announced no formal retirement.
Wildness 4/5 · Still wild
