https://hsiangtechs.com/en/Decisions, questions, and things worked out along the way.enhttps://hsiangtechs.com/en/posts/zeabur-credential-rotation/https://hsiangtechs.com/en/posts/zeabur-credential-rotation/Sun, 25 Oct 2026 08:50:34 GMTZeabur and 91APP both published investigations in the past two weeks. In both cases, the attacker used keys that should have been replaced already, or that never belonged where they were stored.https://hsiangtechs.com/en/posts/php2shell-week/https://hsiangtechs.com/en/posts/php2shell-week/Sun, 25 Oct 2026 08:50:34 GMTFrom an advance notice of the patch to leaked details and a warning from Japan's prime minister, PHP2Shell showed how dangerous the gap between announcement and fix can be. Node.js and Go also shipped updates the same day.https://hsiangtechs.com/en/posts/new-release-cooldown/https://hsiangtechs.com/en/posts/new-release-cooldown/Sun, 25 Oct 2026 08:50:34 GMTThe malicious LiteLLM release stayed on PyPI for 1 hour 44 minutes; pnpm and GitHub both default to a one-day cooldown for new versions, and this is why