Practical insights from our experience building custom software, implementing AI and private LLM solutions, and managing cloud infrastructure for businesses in Indonesia.
75 articles8 topics
FeaturedBackend Development10 min read
REST, JSON, XML, and gRPC are often compared as if they were the same kind of thing. They are not. What each one is good at, real payload size measurements, where XML is still required in Indonesia, and a simple way to decide which to use for public APIs, partner integrations, and internal services.
Read articlePractical articles on software development, AI, cloud infrastructure, and DevOps.
Backend Development9 min read
Node.js 26 "Lithium" became the active LTS line on 28 October 2026 and is supported until April 2029. What it brings over Node.js 24, what can break, which versions are running out of support, and a practical upgrade plan for servers, containers, and CI.
Security9 min read
In two weeks Ubuntu shipped fixes for PHP2Shell, the HTTP2Shell Brotli bug, five nginx flaws, a zlib heap overflow, OpenVPN, and a 24.04 kernel update covering more than a thousand CVEs. What each notice means for a typical web server, the package versions to look for, and which services need a restart or a reboot after apt upgrade.
Software Development9 min read
Stock in the book never matches the warehouse, the same order is typed three times, and the monthly report takes a week. The signs that manual record-keeping is costing more than it looks, what an ERP actually changes, ready-made versus custom, and how to move over one module at a time without stopping the business.
Security8 min read
There is no new phpMyAdmin CVE this month, and no new phpMyAdmin version to install. Yet phpMyAdmin 5.2.3 was one of the applications shown to be taken over through PHP2Shell without a login. Where your phpMyAdmin gets its PHP, how to patch it on Debian, Docker, cPanel, Plesk, and Synology, a stopgap that costs almost nothing, and how to check whether it has already been used against you.
Security9 min read
Laravel disclosed a critical authentication bypass in TokenGuard (CVE-2026-114509) and a data destruction bug on 19 October, Livewire fixed an authorization bypass in #[Authorize], and PHP itself needs patching for PHP2Shell. Which applications are affected, the versions to install, and an update routine that does not miss queue workers.
Security9 min read
HTTP2Shell is not an HTTP/2 flaw. It is a memory corruption bug in Google's Brotli decoder, and it reaches any application that decompresses Brotli data it did not create. Which stacks are affected, the fixed version for each, how to find hidden copies of Brotli, and why updating one package is rarely enough.
Security8 min read
Next.js 16.4.1 and 15.5.28 fix two unauthenticated remote code execution flaws rated 9.5 and a Server Actions denial of service. Which applications are actually exposed, why the sharp version matters as much as the Next.js version, and how to confirm the fix reached production.
Security8 min read
Two Go security releases in October fixed sixteen vulnerabilities, from HTTP/2 server crashes and request smuggling to a certificate denylist for the eMudhra compromise. What each fix covers, which services are exposed, and why upgrading Go on a server changes nothing until you rebuild and redeploy.
Security9 min read
Oracle and OpenJDK shipped two out-of-band fixes in four days after the private keys of eight eMudhra intermediate certificates turned out to be weak. Why the October Critical Patch Update builds are not enough, which Java builds to install, how Linux packages and Docker images differ, and what to do if you cannot update today.
Security8 min read
An unauthenticated command injection in the Built-in CODE Server app for Nextcloud has been exploited since September to plant web shells. Who is affected, why disabling the app is not enough, how to upgrade or remove it, and how to look for signs that your server was already compromised.
Security9 min read
Four NetScaler security bulletins in a month, two zero-days exploited for weeks before disclosure, and a fifth fix for PHP2Shell in the management interface released today. Which builds close all of them, why patching does not remove an attacker who is already inside, and how to check an appliance.
Security8 min read
Node.js 22, 24, and 26 received fixes for ten vulnerabilities, four of them rated high, including a Brotli decoder bug that can lead to remote code execution. Which issues matter for typical web applications, which versions to install, and how to upgrade servers, containers, and managed platforms.
Tell us about your project, what you need to build, and the challenges you are facing. We can discuss the technical approach, scope, timeline, and estimated cost.
Start a conversation