Hi, I’m Jacques. This is where I write about development, AI, homelab tinkering, and whatever else I’ve been into — technical or not.
1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical. A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
Already Running ISO 27001? Your AI Governance Programme Is Mostly Built
“Do we have an AI policy?” now reaches IT managers from clients, auditors and tender documents. If your organisation already runs an ISO/IEC 27001 information security management system (ISMS), you hold most of the machinery needed to answer it. Two frameworks, two jobs A Kovrr comparison published on Security Boulevard in October 2026 sets out the choice. ISO/IEC 42001 is certifiable through accredited bodies in a two-stage audit. NIST AI RMF is voluntary and free to apply, and it carries no certification.
Copilot Just Became a Utility Bill: Set the Meter Before Microsoft Does
Microsoft moved default usage-based billing for new Microsoft 365 Copilot Business subscriptions bought through the Cloud Solution Provider (CSP) channel from 2 November to 1 December 2026, according to trade coverage of the delay . Reporting attributes the move to partners needing time in sandbox environments that open on 2 November. Those sources date the announcement to the first week of October. Those extra weeks belong to IT. Copilot now has a metered side, and the people who hold the admin controls decide how that meter runs.
Your Trust Store Is Infrastructure: What the eMudhra CA Compromise Exposed
On 17 October a researcher reported that eight eMudhra intermediate certificate authorities had private keys anyone could recover from the public certificates. Mozilla recovered the keys itself less than two hours after the report reached it, according to CSO Online . Google said the keys were generated with “insufficient randomness”. Scott Helme recovered all eight in under a second, and some of the values were as small as 4, 56 and 115. Six of the intermediates issued TLS certificates and two issued code-signing certificates.
The Weather Server Did It: ATNS and the Secondary Systems That Sink You
Air Traffic and Navigation Services (ATNS) manages 10% of the world’s airspace, according to MyBroadband’s report of 2 October 2026 ; TimesLive puts the figure at more than 6%. MyBroadband also reports that preliminary investigations found malware “commonly associated with the early stages of ransomware attacks” in the operational technology (OT) environment at Chief Dawid Stuurman International Airport. Facts as publicly reported at 2 October 2026; the investigation is ongoing and details may change. The reporting names a weather support system as the affected system. It does not establish that system as the origin, and it does not state how access was gained. Avi-Go reports the tender documents are unclear on whether East London Airport was also affected.
Your AI Coding Agent Is a Supply Chain: Plugins, Hooks and MCP Configs Need Governing Too
An AI coding agent is a supply chain. Every plugin, lifecycle hook and MCP server it loads is third-party software that runs with the developer’s access, and most organisations review none of it. In our analysis of agents causing accidental damage , the agent was the source of the failure. This follow-up covers the reverse: the extensions around the agent being turned against the organisation. What October’s AI coding agent threats mean in plain English Adversa AI’s 2 October 2026 roundup lists several disclosures and research findings. AIR Security named one flaw Plugin4Shell: a branch named like a pinned commit SHA silently swaps malicious code into a plugin during automatic updates. Researchers reported trojanised plugin lifecycle hooks succeeding up to 92.5% of the time per harness across ten attacker objectives. A tool called ZCode packaged whole workspaces, Git history included, into encrypted snapshots uploaded to Alibaba Cloud OSS. Separately, Manifold Security disclosed GitSpawn in early September 2026 (1 to 2 September): a git config remote code execution flaw affecting AI coding agents, as covered by The Hacker News.
The Breach a Journalist Had to Report: What Gauteng's e-Panic Button Teaches Us About Section 22
On 21 September, GroundUp told the Gauteng government and the vendor behind its e-Panic Button app that the database behind the app was unsecured. According to GroundUp’s investigation, the exposed data included names, phone numbers, email addresses, vehicle registration numbers, GPS coordinates and movement histories, the contents of crime reports, and more than 5,000 report photographs. Some reports concerned domestic violence and assault. The vendor, Evolve Value Added Services, responded and fixed the reported vulnerabilities. The government’s first public response came on Tuesday 29 September, eight days after the tip-off. It said no citizens’ personal information was compromised. On 30 September the Information Regulator told the Mail & Guardian it had not received a notification from the department. By 3 October the Gauteng Legislature’s e-Government Committee was saying the app was not safe to use and asking for a report on access logs going back to the app’s 2024 launch.
Your Vendor's Breach Is Your POPIA Problem: Third-Party Risk in SA's Breach Wave
South African enterprises operate in the middle of an aggressive supply chain breach wave. Major incidents across public and private institutions—including the Companies and Intellectual Property Commission (CIPC), the Department of Justice, major credit bureaus, and national healthcare administrators—demonstrate a consistent attack strategy. Sophisticated threat actors prioritize third-party vendors, IT service providers, and cloud processors. Compromising a single service provider unlocks access to the sensitive customer databases of hundreds of corporate clients simultaneously.
48,000 Files in 103 Seconds: Treat AI Agents Like Privileged Automation
In September 2026, an engineer tasked an autonomous AI coding assistant with an environment cleanup and dependency rebuild. The agent operated with broad shell permissions inside an interactive development session. Within 103 seconds, 48,000 files vanished across the developer’s workstation. The purge swept through parent directories, shared caches, and the local .git/objects store. The destruction of the object database eliminated uncommitted changes and wiped the local Git tree required for immediate repository recovery. Once the disk activity ceased, the terminal presented a polite single-line apology: the agent acknowledged the disruption and offered to help rebuild the workspace.
Constraints Breed Character: Why Older Games Feel More Cohesive Than Modern Bloat
In 1999, the development team at Konami faced a severe technical ceiling while building the original Silent Hill for the Sony PlayStation. The console possessed two megabytes of main system RAM and one megabyte of video memory. Rendering a fully three-dimensional town square with dynamic camera angles overwhelmed the hardware, causing severe frame drops and aggressive geometry pop-in along the horizon. A lesser team would have scaled back the ambition, reverting to pre-rendered static backgrounds. The developers embraced the bottleneck directly. They enveloped the entire town in a dense, suffocating wall of volumetric fog that masked the short draw distance perfectly. What began as a desperate hardware workaround became the defining psychological atmosphere of the entire franchise. The hardware limitation gave the game its immortal soul.
Deliberate Framing: What 20 Years of Photography Taught Me About Software Architecture
A beginner holding a camera for the first time tries to capture everything in front of them. They see a sprawling city street, lift the camera to eye level, and attempt to cram the entire skyline, the moving traffic, the street vendors, and the clouds into a single frame. The resulting image feels chaotic and indistinct. Every element screams for equal attention, leaving the viewer exhausted and indifferent. A seasoned photographer approaches the exact same street corner through ruthless elimination. They step forward, wait for the background light to fall into shadow, and frame a single pedestrian stepping through a beam of afternoon sun. The power of the photograph emerges directly from everything the photographer chose to leave outside the frame.
From Prompts to Autonomous Systems: Practical Agent Workflows in Daily Engineering
Most engineers begin their interaction with large language models inside an open chat window. You type a prompt into an interface, paste an excerpt of code, wait for a stream of generated tokens, copy the suggested fix back into your editor, and run your compiler to see if the changes function. For small utility scripts or localized function refactoring, this manual conversational cycle feels like an acceleration. Once your requirements expand to multi-file refactoring, systemic codebase migrations, or end-to-end bug investigations, conversational chat interfaces collapse under their own architectural weight. The user becomes a manual data conduit, perpetually copying terminal outputs and compiler stack traces back into a text box. More critically, the chat session accumulates hundreds of turns of discarded attempts, stale hypotheses, and rambling conversational pleasantries that dilute the model’s attention.
Your Firewall's Management Console Belongs Off the Public Internet: Lessons from the September KEV Surge
Between 21 and 25 September 2026, the United States Cybersecurity and Infrastructure Security Agency ( CISA ) expanded its Known Exploited Vulnerabilities (KEV) catalogue with a barrage of high-severity flaws across critical edge and enterprise infrastructure. The list reads like a core inventory of enterprise IT deployments: Check Point Management Server and Security Gateways, Microsoft on-premises SharePoint, F5 BIG-IP, Citrix NetScaler, and MikroTik RouterOS. In multiple instances, weaponized exploitation preceded vendor patches, leaving internet-exposed administrative interfaces vulnerable to unauthenticated remote execution.
Stop Clicking Through Fourteen Menus: Why PowerShell Is the Turning Point for IT Support
At 8:15 AM on a Monday, a helpdesk technician faces a wall of fourteen fresh tickets. The accounting department print spooler has stopped responding. Four remote laptops crawl at a snail’s pace after weekend cumulative updates. An executive account is locked out, and human resources submitted a spreadsheet containing five new hires who need user accounts, cloud security groups, and mailbox access before their 9:00 AM orientation. Resolving that queue through graphical interfaces requires opening remote desktop sessions across slow network tunnels. It demands clicking through services.msc, navigating Task Manager menus, manually verifying event viewer logs, and copy-pasting employee names across administrative browser portals. Each ticket consumes eight to ten minutes of repetitive pointer motion. By the time the morning queue clears, half the workday has disappeared into routine mechanical clicking.
Why I Rebuilt My Personal Site with Hugo and Semantic CSS in 2026
For nearly two years, my personal website was built on modern front-end machinery. It ran on Next.js with the App Router, React 19, Tailwind CSS, PostCSS, and Nodemailer server actions. On paper, this was an industry-standard stack. It gave me server-side rendering, API routes, automated code-splitting, and a familiar developer experience borrowed from large-scale client engagements. In practice, it was an absurd architectural mismatch. A personal website is primarily a publication engine for long-form technical prose, project documentation, and structured career history. It does not handle high-frequency transactional data. It does not require real-time WebSocket connections or multi-tenant database synchronization. Yet every time I wanted to publish a short essay or adjust a typography token, I was spinning up a heavyweight JavaScript toolchain, pulling down hundreds of megabytes of dependencies, and troubleshooting runtime hydration quirks.
Why I Wrote a Book on Prompt Engineering (And Why 'Prompting' Is the Wrong Word)
I have spent the last two years watching engineers argue with autocomplete. They type a question into an LLM, get a wrong answer, and conclude the model “doesn’t understand” the problem. Then they rephrase the same question three more times, hoping the fourth attempt triggers some hidden reasoning circuit. It never does, because there is no reasoning circuit to trigger. There is a statistical engine predicting the next token, and the gap between what people think it does and what it actually does is where every bad prompt comes from.
A Bug Hunter's Lens on Web Application Hardening
Corporate cybersecurity advice often fixates on compliance matrices, annual penetration test reports, and automated dependency scanners. Engineering teams spend days triaging medium-severity alerts for outdated utility libraries while missing the fundamental structural flaws sitting in plain sight inside their own application logic. During offensive security assessments and bug bounty research, automated scanners rarely discover the vulnerabilities that matter. The most devastating findings almost never involve exotic zero-day memory exploits or deep cryptographic breaks.
The 9U Silent Homelab: Raspberry Pi 5, Docker, and a Dead 8TB Drive
The typical homelab showcase on Reddit or YouTube often resembles an enterprise server closet. Enthusiasts rack decommissioned Dell PowerEdge towers, run dual redundant 10-gigabit fiber switches, and proudly display 42U cabinets that draw 800 watts at idle while heating an entire basement. That aesthetic is impressive, but it represents a specific hobbyist obsession. For my daily requirements, computing infrastructure should remain quiet, draw minimal electrical power, and perform its designated tasks without demanding a second full-time job in systems administration.
Why Willpower Fails: Building a Zero-Memory Financial Engine for ADHD Brains
The Executive Function Trap: Why “Set a Reminder” Doesn’t Work for ADHD Brains Every piece of standard bill-paying advice assumes the same thing: that on the day the reminder fires, you will have enough working memory, enough task-initiation energy, and enough tolerance for a boring administrative task to actually act on it. Set a calendar alarm. Use a budgeting app. Just open the envelope when it arrives. None of that is a system. It’s a request for continuous executive function, delivered on a schedule that has no idea what your week actually looks like. CHADD’s overview of executive function skills lists the relevant ones by name: working memory, task initiation, sustained attention, self-monitoring. Paying a bill on time uses all four, back to back, with no room for one of them to be having a bad day.
From Code to Google Play: Shipping MicroQuote as a Solo Developer
Earlier this month, production release versionCode 8 of MicroQuote went live on the Google Play Store . The part that actually surprised me wasn’t the TypeScript, the SQLite schema, or the PDF layout. It was that finding 12 people willing to install an unfinished app and actually use it for two straight weeks turned out to be harder than writing the offline sync logic. The Problem: Quoting Software Wasn’t Built for the Job Site Most software built for small business quoting assumes an idealized environment: high-speed fiber, a desktop monitor, and enough time to sit down with accounting software.