<p><strong>TLDR:</strong> A critical remote code execution vulnerability in protobuf.js affects roughly 50 million weekly npm installs — patch now if you’re loading schemas from untrusted sources. On the infrastructure side, PgQue brings the old Skype-era PgQ architecture back to life with zero dead-tuple growth and benchmarks that will make you question why you’re running a separate queue service. The EU’s Digital Omnibus Package is getting serious scrutiny after researchers traced its GDPR amendments article-by-article to Google, Meta, and Microsoft lobbying documents. And the agent harness pricing war between the frontier labs is starting to squeeze the middleware layer hard.</p>
<hr>
<h2>protobuf.js RCE via unsafe schema parsing</h2>
<p>CVE GHSA-xq3m-2v4x-88gg is a bad one. protobuf.js builds JavaScript functions from schema field names using string concatenation and the <code>Function()</code> constructor — no sanitization of schema-derived identifiers. Feed it a malicious schema and you get arbitrary code execution. Affected versions are 8.0.0/7.5.4 and below; 8.0.1 and 7.5.5 are patched. A PoC is already public. If you’re loading schemas dynamically from any external source, treat this as urgent. The fix for the long term is precompiled static schemas — stop generating code at runtime from untrusted input.</p>
<h2>PgQue: zero-bloat Postgres queue without C extensions</h2>
<p>PgQue is a pure PL/pgSQL message queue that revives the PgQ architecture originally built at Skype, now compatible with managed Postgres providers like RDS, Aurora, Supabase, and Neon. The key design choice: instead of <code>SKIP LOCKED</code> with per-row deletes that pile up dead tuples, it uses snapshot-based batching and <code>TRUNCATE</code>-based table rotation. Benchmarks show ~86k events/sec insert and ~2.4M events/sec consumer read rate with zero dead-tuple growth over 30 minutes. The trade-off is ~1-2 second delivery latency, which rules it out for anything needing sub-second guarantees but makes it a serious option for most background job workloads. One SQL file to install, pg_cron to tick.</p>
<h2>EU GDPR rollback traced to 151M euros in Big Tech lobbying</h2>
<p>Corporate Europe Observatory and LobbyControl published research mapping the EU’s Digital Omnibus Package amendments directly to lobbying documents from Google, Meta, and Microsoft — who collectively spent a record 151 million euros on EU lobbying. The proposed changes are significant: narrowing the definition of personal data, creating a statutory legitimate interest basis for AI training data, weakening ePrivacy cookie rules, delaying high-risk AI Act obligations by up to 16 months, and extending breach notification windows from 72 to 96 hours. The EU’s own data protection authorities (EDPB and EDPS) have objected. Given that GDPR serves as a template for privacy law in over 150 countries, the downstream effects of this rollback would extend well beyond Europe.</p>
<h2>Agent harness pricing war is compressing the middleware layer</h2>
<p>The control layer around AI models — orchestration, memory, sandboxed execution, observability — has become the main competitive battleground. Anthropic launched Managed Agents at $0.08 per session hour. OpenAI countered with an open-source Agents SDK charging nothing for the runtime, only model tokens and tool calls. Google and Microsoft meter harness components separately. The strategic logic is clear: OpenAI gives away the harness to drive model consumption; everyone else charges for the runtime in some form. For startups building horizontal orchestration frameworks like LangChain or CrewAI, free open-source from OpenAI is a real problem. The defensible position is vertical depth, compliance, or multi-model control — not generic orchestration plumbing.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Zatat (Rust WebSocket server):</strong> Drop-in Pusher Channels protocol v7 replacement written in Rust; on a €3.99/mo Hetzner VM it handles 10,000 concurrent WebSocket connections vs Reverb’s ~1,000, and processes ~46k HTTP events/sec vs Reverb’s ~2.7k. Single static binary.</li>
<li><strong>DigitalOcean to Hetzner migration:</strong> A team cut monthly costs from $1,432 to $233 migrating 248 GB of MySQL data across 30 databases, 34 Nginx virtual hosts, and GitLab EE with zero downtime using MySQL master-slave replication and a scripted DNS cutover.</li>
<li><strong>Sliplane custom DNS server:</strong> Hit Hetzner DNS record limits and 90-minute propagation delays, built a ~1,000-line Go DNS server using the hidden primary pattern with Postgres LISTEN/NOTIFY as the event bus; propagation dropped to near-instant.</li>
<li><strong>Composer 2.9 security blocking:</strong> Automatic Security Blocking is now built into the dependency resolver itself, removing vulnerable package versions from the candidate pool before the SAT solver runs — no longer opt-in via roave/security-advisories.</li>
<li><strong><a href="http://deleteduser.com" target="_blank" rel="noopener nofollow">deleteduser.com</a> PII leak:</strong> A researcher bought the unowned domain for $15 and received emails from 30+ organizations within 24 hours containing real PII including hotel guest names, delivery tracking info, and password reset tokens — a reminder that placeholder emails at unowned domains actively route PII to strangers.</li>
<li><strong>Effect v4 beta:</strong> Completely rewritten fiber runtime cuts bundle size from ~70 kB to ~20 kB for a minimal program; all ecosystem packages unified under a single version number.</li>
<li><strong>AWS DevOps Agent GA:</strong> Generally available, billed per second of agent activity, claims up to 75% lower MTTR and 94% root cause accuracy in preview; integrates with Datadog, Grafana, Splunk, and PagerDuty.</li>
<li><strong>Pulumi adds Bun runtime:</strong> <code>runtime: bun</code> in Pulumi.yaml now runs entire infrastructure programs under Bun without Node.js; native TypeScript execution, faster CI installs, top-level await. Callback functions and dynamic providers are unsupported.</li>
<li><strong>Claude Mythos / Pentagon standoff:</strong> Anthropic CEO Dario Amodei met White House Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent over a Pentagon blacklisting dispute; a potential compromise would route Mythos access through civilian agencies while excluding the Pentagon.</li>
<li><strong>OpenClaw security concerns:</strong> The 355K-star self-hosted AI assistant has a 17% native defense rate against adversarial attacks, a patched WebSocket RCE (CVE-2026-25253, CVSS 8.8) that left 135K+ instances exposed, and 17% of marketplace skills flagged as potentially malicious.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

A critical RCE vulnerability (GHSA-xq3m-2v4x-88gg) in protobuf.js affects ~50M weekly npm installs — patch to 8.0.1/7.5.5 immediately if loading schemas from untrusted sources. PgQue revives the Skype-era PgQ architecture as a pure PL/pgSQL queue with zero dead-tuple growth, benchmarking at ~86k inserts/sec and ~2.4M reads/sec. EU researchers traced GDPR-weakening amendments in the Digital Omnibus Package directly to Google, Meta, and Microsoft lobbying documents (151M euros spent). The AI agent harness pricing war is intensifying: Anthropic charges $0.08/session hour for Managed Agents while OpenAI open-sourced its Agents SDK runtime, threatening middleware startups like LangChain and CrewAI. Also covered: a Rust WebSocket server outperforming Laravel Reverb 10x, a DigitalOcean-to-Hetzner migration cutting costs 84%, Composer 2.9 security blocking, Effect v4 beta, AWS DevOps Agent GA, and a PII leak via unowned placeholder email domains.

protobuf.js RCE hits 50M weekly downloads, EU GDPR rollback traced to Big Tech lobbying