Technical watch, field-tested experience and practical guides for sysadmins and DevOps who care about robustness.
101 articles
IOMMU, device groups, a driver that will not let go, the display output, the BIOS ROM: the real obstacles to GPU passthrough, in the order they turn up, and how to identify them.
A UPS with ten minutes of runtime is worth nothing if nobody triggers the shutdown. How to orchestrate powering down several machines in the right order, and why the NAS has to go last.
The advice to disable swap has been going around for twenty years. What it actually costs you, why swappiness does not do what you think, and the rare cases where turning it off is justified.
A service vanishes without a trace in its own logs. How the kernel picks its victim, why that victim is almost never the real culprit, and the settings that protect the processes that matter.
Used space does not match the sum of the files, or writes fail on a half-empty disk. Deleted files still held open, exhausted inodes, reserved blocks, a mount hiding data: the diagnosis, in order.
Three ways to get valid HTTPS internally: a self-signed certificate, an in-house authority, or a public certificate through DNS validation. What each one actually costs, and why one of them no longer works on mobile.
Addresses that change on their own, a bypassed firewall, connections slow to start: the failure modes specific to IPv6 and how to diagnose them. Disabling it is not a solution, it is a deferred problem.
A clean internal domain, resolved locally and from the outside, with no duplicated entries. How split-horizon works, the made-up-domain trap, and why your browser sometimes ignores your DNS.
The site half-loads, SSH freezes right after the banner, a file transfer stalls at 4%. Ping works, DNS answers. It is an MTU problem: how to confirm it in three minutes and fix it for good.
Smart devices, cameras, guests, servers: why a flat network is a problem, and how to carve it up gradually without breaking everything. The three pitfalls that stall every setup.
Checksums, snapshots, growing a volume, RAM requirements: what each filesystem actually brings to a data store, and which one protects you against silent corruption.
Three tools that get pitted against each other for the wrong reasons. Deduplication, encryption, remote destinations, ransomware protection: what each one actually does, and the criterion that settles it.
The overall SMART verdict stays "OK" to the very end. The five counters that genuinely warn you, how to read them, and why a disk can die without crossing a single threshold.
A backup never restored is a hypothesis. Why backups fail silently for months, and how to automate a restore test that actually catches problems.
RAID covers exactly one scenario: a disk failing. Deletion, corruption, ransomware, theft, mistyped commands — it does nothing. And rebuilds are where entire arrays are lost.
You delete 200 GB inside a VM and the hypervisor doesn't see a single byte return. TRIM, discard, unmap: the full chain you have to enable end to end to reclaim space.
Two servers in a cluster, one fails, and the survivor freezes instead of taking over. Why quorum forbids that scenario, and how a simple external witness fixes it.
Regulation (EU) 2026/1744, in force since 27 July 2026, defers high-risk obligations to December 2027 but leaves the 2 August transparency deadline untouched. What is still due, the penalties that apply, and a checklist.
The ZFS ARC takes half your memory by default and reports it as used. When that's normal, when it becomes a real problem on a hypervisor, and how to cap it without wrecking performance.
Snapshot, replication, backup: three mechanisms people treat as interchangeable that protect against entirely different risks. What each one actually covers, and what none of them do.
LXC container or virtual machine? Density, isolation, GPU, network mounts, backups: the criteria that actually settle it, and the cases where the container will trap you.
Publishing a self-hosted service with no port forwarding and no static IP: how an outbound tunnel actually works, what it really protects, and the pitfalls that break an installation in production.
The practical guide to picking your GGUF quant in 2026: bits per weight, perplexity impact, imatrix, and a VRAM/quality table. A Llama 3.1 8B drops from 32 GB in F32 to 4.9 GB in Q4_K_M.
Build a privacy-first RAG assistant on your own documents: embeddings, vector DB, chunking and a local LLM. With qwen3-embedding hitting 70.58 on multilingual MTEB, local finally rivals commercial APIs.
An honest comparison of local LLM inference engines in 2026: vLLM hits ~793 tok/s under concurrent load versus ~41 for Ollama, yet at a single user the gap drops below 10%. When to use each.
How much VRAM do you really need? QLoRA fine-tunes a 7B on 8-10 GB, a 13B on a 24 GB GPU. We debunk the myths: when fine-tuning beats RAG, and when it falls flat.
The honest break-even math between a 2,600 EUR RTX 5090 and the Claude/GPT API in 2026: hardware amortization, electricity, tokens/month. Spoiler: you need to target 50 to 100 million tokens per month.
AMD XDNA 2, Apple Neural Engine, Intel NPU 5: these chips advertise 38 to 55 TOPS, yet a 7B LLM generates text at only ~7 tok/s on them. A breakdown of what an NPU is actually good for, and what belongs on the GPU.
Whisper running locally, no cloud: models, GPU/CPU performance, real-time vs batch, accuracy (WER) and privacy. With faster-whisper, large-v3-turbo fits in 1.5 GB of VRAM at INT8.
Ollama ships with no authentication by default. Over 300,000 instances are reportedly exposed on the internet in 2026. Model theft, RCE, LLMjacking: here are the real risks and how to harden your server.
Model weights, KV cache, GGUF quantization: the real VRAM formula for a local LLM, with 7B/32B/70B tables and a concrete GPU mapping.
128 GB unified memory, RDNA 3.5 iGPU, three times cheaper than a DGX Spark: real LLM benchmarks of the Ryzen AI Max+ 395 and the 256 GB/s wall.
CVE-2026-50751 (CVSS 9.3): Check Point VPN auth bypass already used by Qilin ransomware; CVE-2026-20245: root on Cisco SD-WAN Manager. Remediation.
Record Patch Tuesday: ~208 CVEs fixed on June 9, 2026, including CVE-2026-45657, a wormable kernel RCE rated CVSS 9.8. Critical flaws and priorities.
CVE-2026-44963 (CVSS 9.4): RCE on Veeam Backup & Replication for any authenticated domain user. Analysis and hardening of a prime ransomware target.
Claude Fable 5: Anthropic's most powerful model — 80.3% on SWE-Bench Pro, 1M-token context, built-in safeguards and a Mythos 5 twin. Full breakdown.
Linux 7.1: writable NTFS, Landlock hardening, i486 removed, Steam Deck OLED audio fix — and the debate over AI-assisted kernel contributions.
At Build 2026, Microsoft unveils MAI: seven models trained from scratch, from MAI-Thinking-1 to MAI-Code-1-Flash in Copilot. Specs and stakes.
React2Shell (CVE-2025-55182): a pre-auth CVSS 10.0 RCE in React Server Components and Next.js. Root cause, exploit chain, affected versions, fixes.
A technical breakdown of Ni8mare, the unauthenticated RCE (CVSS 10.0) that exposes ~100,000 n8n instances. Content-Type confusion, the full exploitation chain up to RCE, the Q1 2026 CVE wave, detection and hardening.
One petaFLOP and 128 GB unified for 4,000 EUR: behind the GB10 marketing, the real numbers — bandwidth, LLM benchmarks, DGX Spark vs RTX Spark.
Kubernetes 1.36 "Haru": User Namespaces GA, In-Place Vertical Scaling, Memory QoS, gitRepo removed, Ingress NGINX retired. What changes and breaks.
CVE-2026-23918 (CVSS 8.8): a double-free in Apache 2.4.66 mod_http2 enabling unauthenticated DoS and RCE. Root cause, exploitation, remediation.
Technical analysis of the YGGtorrent hack: SphinxQL exploitation, lateral movement via SMB, 19 GB of exfiltrated data including 6.6 million accounts, payments and source code.
A complete guide to eBPF for Linux observability: Falco for runtime security, Cilium for networking, bpftrace for kernel monitoring.
A complete guide to managing secrets in production: HashiCorp Vault, External Secrets Operator, Sealed Secrets, SOPS, leak detection and an operational checklist.
A complete guide to Zero Trust architecture: the 5 core principles, plus step-by-step implementation on Linux with mTLS, micro-segmentation and open-source tooling.
Analysis of CVE-2026-2441, a Chrome zero-day under active exploitation. Use-after-free in the Blink CSS engine: impact, fix, and mitigation measures.
Docker Compose v5, rewritten in Go, exposes a native SDK. Automation, CI/CD integration, migrating from v2, and new deployment patterns.
Two critical zero-days in Ivanti EPMM exploited to compromise European government systems. Technical analysis, IOCs and response plan.
Mistral 3 brings together a family of Apache 2.0 open-source models: Small, Medium, Large. Benchmarks, local hosting, API and positioning against GPT-4o.
A technical breakdown of OpenCode, the open source terminal-native AI agent. Installation, LSP, multi-session, and how it compares with Claude Code and Cursor.
Kimi Code by Moonshot AI drives the Kimi K2.5 model inside an Apache 2.0 open source CLI. Benchmarks, the PARL architecture, a head-to-head comparison and the geopolitical stakes.
A complete analysis of Perplexity Comet, the agentic AI browser: features, architecture, security, CometJacking vulnerabilities and implications.
Analysis of CVE-2026-1731, a CVSS 9.9 flaw in BeyondTrust Remote Support. Pre-auth OS command injection, active exploitation, discovered by AI.
Analysis of CVE-2026-21643 (CVSS 9.1), a critical SQL injection in FortiClientEMS 7.4.4. Exploitation, RCE impact, the fix, and hardening measures.
The RPC backend in llama.cpp lets you spread inference across multiple hosts, but it is still shipped as a fragile, insecure proof-of-concept on open networks.
MLX ships distributed primitives and a low-latency JACCL backend built for Thunderbolt 5. Here's how to architect a Mac cluster the right way.
Ollama's official README now highlights direct integrations with Codex, Claude Code and OpenClaw. A breakdown for a productivity-focused local stack.
A local-LLM-focused comparison of the Mac Studio M4 Max and M3 Ultra based on Apple's official specs: unified memory, bandwidth and clustering capacity.
Qwen3, DeepSeek-R1, Gemma 3, Llama 3.3, DeepSeek-V3: a concrete guide to picking the right local models in 2026 and avoiding sizing mistakes.
A hands-on guide to building a Mac Studio cluster and running larger local models: sizing, Thunderbolt topology, software, limits and security.
On February 5, 2026, OpenAI announced GPT-5.3-codex in Codex and the API. This model targets medium- and long-running software engineering tasks, with improved agentic behavior.
Since February 9, 2026, OpenAI has been testing ads inside ChatGPT on the Free and Go plans, with regional limits and contextual targeting.
In its January 2026 recap, Google announces the expansion of Deep Search, new Gemini-driven Gmail actions and an AI-enriched shopping mode.
According to Reuters (February 12, 2026), Anthropic raised $3 billion, led by Lightspeed, at a valuation of roughly $183 billion. A breakdown of what it means for the AI market.
A full analysis of MiniMax M2.5, the Chinese open-weight AI model. MoE architecture, SWE-Bench benchmarks, pricing 20x cheaper than Claude Opus 4.6, and use cases for agents and office productivity.
System76 ships COSMIC Desktop 1.0.6 with file manager fixes, a native clipboard and configurable terminal hotkeys. An ambitious roadmap: Vulkan renderer, HDR and gaming.
CachyOS pushes Arch Linux performance to its limits with its BORE scheduler, x86-64-v3/v4, PGO and LTO. Discover the distribution that outperforms Ubuntu by 11.6% and is preparing a hardened server edition for 2026.
Kubernetes 1.35 moves DRA to beta for GPUs, marking K8s' pivot toward AI factories. Configuration, migration and Prometheus monitoring.
Linus Torvalds announces Linux 7.0 for mid-April 2026. Live Update Orchestrator, PCIe encryption, 4x network gains: a complete breakdown of what's new.
Docker Kanvas automatically converts your Compose files into Kubernetes manifests. Built on Meshery (CNCF), it takes on Helm and Kustomize with a visual approach.
Parrot OS 7.1 arrives with the Linux 6.17 kernel, critical GRUB fixes, and a massive update of its security toolset (Metasploit, Burp Suite, Airgeddon).
Anthropic unveils Claude Opus 4.6 with Agent Teams, a 1M-token context window and game-changing code review capabilities. Here's what changes.
Technical analysis of Seedance 2.0, ByteDance's AI video generation model. Diffusion Transformer architecture, comparison with Sora 2 and Veo 3, use cases and implications for creators.
Technical analysis of AgreeToSteal, the first malicious Outlook add-in found in the Microsoft Store. Vercel subdomain takeover, phishing via the Telegram Bot API and the theft of 4,000 credentials.
Apple patches CVE-2026-20700, a zero-day in dyld under active exploitation. A technical breakdown of the flaw, its attack vectors and the protective measures admins should take.
Discover GRP-Obliteration, the technique that hijacks GRPO to misalign LLMs. A 93% success rate, with major implications for the security of AI deployments.
Analysis of CVE-2026-25049, a critical CVSS 9.4 flaw in n8n enabling RCE through a sandbox escape. Affected versions, technical exploit and hardening.
341 malicious plugins identified on ClawHub, OpenClaw's marketplace. A closer look at a new breed of supply chain attack targeting AI agents.
6 actively exploited Microsoft zero-days, plus Apple, Cisco and Ivanti flaws: a rundown of the critical February 2026 fixes to apply immediately.
From Clawdbot to OpenClaw: a look back at the open source AI agent that racked up 145,000 GitHub stars in a matter of weeks. Architecture, how it works, and what it means.
A practical guide to hardening the SSH configuration of your Linux servers. ED25519 keys, 2FA, fail2ban, port knocking, auditing and advanced logging.
The AISURU/Kimwolf botnet launched a 31.4 Tbps DDoS attack, an all-time record. Analysis of the attack and protection measures for your infrastructure.
OpenAI is sunsetting GPT-4o on February 13, 2026 in favor of GPT-5.2. Impact on APIs, migration strategies and alternatives for developers.
NanoClaw boils an AI agent down to 500 lines of TypeScript with container-based isolation. A technical look at this security-first alternative.
A complete guide to the critical Linux metrics to monitor in production: CPU, memory, disk, network, processes and alerting. Commands, thresholds and best practices for sysadmins.
AI agents are transforming security operations centers. 30% of SOC workflows will be automated by the end of 2026. Impact, tools and risks for security teams.
Anthropic's Claude Code reshapes software development with an agentic AI assistant living right inside your terminal. An overview of its features and use cases.
From ss to journalctl by way of lsof, these commands will save you precious time in day-to-day system administration.
Vibe coding is reshaping software development in 2026. How AI tools like Claude Code and Copilot are changing the way we write code, and what it means for developers.
MoltBook is the first social network exclusively reserved for AI agents. 2.5 million bots registered, humans can only watch. An analysis of an unprecedented phenomenon.
A complete guide to setting up a robust backup strategy on a Linux server with rsync, rsnapshot, borgbackup and cron automation.
From OpenClaw to CrewAI, autonomous AI agents are booming in 2026. Frameworks, open source projects, security challenges: a complete overview of the ecosystem.
Vulnerabilities in OpenClaw, an exposed MoltBook database, prompt injections: AI agents introduce a whole new class of risks. A practical guide to securing them.
Fail2ban is a good start, but it only protects against brute force. Discover the complementary security layers that are essential for a production server.
DeepSeek, Llama, Mistral: open source LLMs now rival proprietary models. A guide to understanding the ecosystem and hosting your own AI.
A complete guide to optimizing Nginx in production: workers, compression, caching, buffers, HTTP/2, rate limiting and monitoring. Battle-tested, ready-to-deploy configurations.
Root containers, unpatched images, badly mounted volumes... A rundown of the classic mistakes and how to avoid them in your Docker deployments.
A practical Ansible guide for system administrators: inventory, playbooks, essential modules, roles and best practices to automate your Linux infrastructure with confidence.
An actionable checklist of 10 essential security checks to run on any production Linux server.