Archive

Category Archives for "Networking"

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability.

The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers. Cloudflare has deployed the new rules to protect all customers, including those on free and paid plans, as long as their application traffic is proxied through the Cloudflare WAF. The rules were deployed at 17:03 UTC on July 17 2026.

WAF protections reduce exposure while customers update, but they are not a substitute for patching. WordPress has released fixes in version 7.0.2, with backports to affected earlier branches: 6.9.5, 6.8.6, and 7.1 Beta 2 (see release details). Versions earlier than 6.8 are not affected. WordPress is treating this as its highest-severity, highest-priority class of issue and is forcing automatic updates to affected sites, so most sites will be updated automatically. We still recommend confirming that you are on a patched release or the backports for your branch and follow the guidance in the official WordPress Continue reading

HN834: HPE Self-Driving Networks: The Next Evolution of Network Automation (Sponsored)

In this sponsored episode, HPE’s Sunalini Sankhavaram and Jose Tellado discuss the architectural evolution toward self-driving networks. Together with Ethan and Drew, they break down how integrating agentic AI enables an autonomous architecture capable of being proactive and not just reactive. They also discuss the importance of maintaining human trust in autonomous systems and how... Read more »

Mengenal Laba-Laba Ogre Faced dengan Penglihatan Malam Tajam

Laba-laba merupakan salah satu makhluk yang paling menarik dalam dunia hewan, dengan berbagai adaptasi unik yang memungkinkan mereka bertahan dan beradaptasi di lingkungan yang berbeda. Salah satu jenis laba-laba yang saat ini menarik perhatian para ilmuwan dan pecinta alam adalah ogre faced, atau dalam bahasa Indonesia dikenal sebagai laba-laba berwajah ogre. Keunikan utama dari laba-laba ini terletak pada kemampuan berburu menggunakan penglihatan malam yang sangat tajam, sebuah adaptasi yang luar biasa di dunia laba-laba.

Apa Itu Laba-Laba Ogre Faced?

Laba-laba ogre faced adalah jenis laba-laba yang termasuk dalam keluarga Deinopidae. Mereka mendapat nama “ogre faced” karena bentuk wajahnya yang khas dan menyerupai tokoh ogre dalam cerita rakyat, dengan mata yang besar dan menonjol di bagian depan kepala. Mata-mata besar ini bukan hanya untuk penampilan — mereka benar-benar berfungsi sebagai alat utama untuk berburu dalam kondisi gelap atau malam hari.

Adaptasi Penglihatan Malam Pada Laba-Laba Ogre Faced

Salah satu kelebihan utama laba-laba ogre faced adalah penglihatannya yang sangat tajam di malam hari. Mata mereka terdiri dari sejumlah besar mata kecil (merefleksikan adaptasi khusus), yang memungkinkan mereka untuk menangkap cahaya dengan maksimal. Keunggulan penglihatan ini sangat krusial untuk mendapatkan mangsa di lingkungan yang minim cahaya.

Penglihatan malam laba-laba ogre faced tidak Continue reading

Fakta Unik Sable Island, Kuburan Kapal di Laut Atlantik

Pulau Sable adalah sebuah tempat yang penuh misteri dan keunikan, sering kali disebut sebagai “Kuburan Kapal di Atlantik.” Saat ini, pulau ini terus menarik perhatian para peneliti, pecinta sejarah maritim, dan wisatawan berkat kisah-kisah legendarisnya serta kondisi alam yang khas. Artikel ini akan mengupas fakta unik tentang Sable Island dengan konteks terbaru yang berlaku, memberikan gambaran lengkap tentang daya tarik dan pentingnya pulau ini di era modern.

Sejarah dan Letak Geografis Sable Island

Sable Island terletak di Samudra Atlantik, sekitar 300 kilometer sebelah timur pesisir Nova Scotia, Kanada. Pulau ini memiliki panjang sekitar 42 kilometer dan lebar yang sangat sempit, yaitu hanya sekitar 1.5 kilometer. Posisi geografisnya yang terpencil dan berada di jalur perairan utama di Atlantik menjadikan Sable Island sebagai lokasi yang rawan kecelakaan kapal laut.

Sejak awal tahun ini, Sable Island masih dikenal sebagai “Kuburan Kapal di Atlantik” karena puluhan kapal karam yang terjadi di sekitarnya sepanjang sejarah. Angin kencang, gelombang besar, serta kabut tebal menjadi penyebab utama banyaknya kecelakaan di daerah ini. Hingga saat ini, pulau ini menjadi objek studi penting untuk memahami dinamika navigasi laut dan cuaca ekstrem.

Fakta Unik Sable Island yang Menarik untuk Diketahui

1. Habitat Kuda Liar yang Langka

Salah Continue reading

Hedge 312: Keys and DNS

The entire technology world has, for decades, treated the IP address as a shorthand host identifier. This is clearly not the way IP was designed, but what are our other choices? In this episode of the Hedge, Scott Robohn joins Russ And Tom to discuss a recent paper arguing cryptographic keys should be the primary host identifier, and another article on the centrality of DNS to the Internet.

download

From intent to enforcement: Lessons from operating Kubernetes controllers at scale

Kubernetes controllers are what make the platform’s declarative model real. They observe the state, reconcile toward the intent, and keep doing so as the system changes beneath them. At larger scales, though, the hardest problems are no longer about writing the reconcile loop. They are about preserving correctness while caches lag, objects churn, and enforcement depends on a complete view of the world. This post distills what we learned from operating two critical controllers in Amazon EKS at scale. Kubernetes provides pods with connectivity, but it leaves fine-grained traffic enforcement to the underlying platform. Inside the cluster, intent such as who should be allowed to talk to whom still has to be translated into rules the datapath can enforce. For a small experiment, openness is convenient. For production traffic, it becomes a problem you need to solve, and you want to express that intent once and have it hold as pods are created and destroyed all day long. In Amazon EKS, two controllers close that gap. The Network Policy Controller governs traffic inside the cluster, deciding which pods may talk to which. The VPC Resource Controller governs how selected pods access AWS resources outside the cluster by assigning them their Continue reading

The RPKI Paradox: why invalid routes keep showing up

RPKI was supposed to be the fix for one of BGP’s oldest problems: nothing stops a network from announcing someone else’s IP addresses, on purpose or by accident. More than a decade into the project, adoption numbers finally look good, and yet RPKI invalid routes haven’t gone away. Route hijacks still happen, leaks still happen, and (this is the part that surprised me when I dug into the research) the tools built to catch all this still cry wolf constantly.
Here’s the short version: RPKI did its job. It just wasn’t as big a job as everyone hoped, and thousands of invalid routes a day are proof that the story doesn’t end at “deployed.”

The good part: RPKI actually got deployed

A Route Origin Authorization (ROA) is a cryptographic statement from an IP address holder saying, “this AS, and only this AS, is allowed to originate this prefix.” Routers that check incoming announcements against ROAs sort them into three buckets (Valid, Invalid, or Not Found) through a process called Route Origin Validation (ROV).

That’s the whole mechanism. Simple in concept, it took the industry years to actually roll it out at scale. It’s happened now: a majority of Continue reading

LIU018: Why You Should Attend Tech Conferences

Alexis and Kevin talk about their experiences attending Cisco Live alongside return guest Melina Bertholf. They offer different perspectives about the event while highlighting the importance of building professional relationships and community through in-person gatherings. They also share personal anecdotes and advice for those looking to maximize their social and professional networking efforts at tech... Read more »

Worth Reading 071526


Reports of AI corporate implementation failures have continued to mount over the last year.

 


AI assistants now hand you a single, ready-made answer, and a harder question comes with it: who decides what we get to know, and what never makes it into the reply?

 


Vendors are trying to position “confidential computing” as the technical backbone of Europe’s sovereign cloud ambitions. But new research shows that a security protocol used to prove cryptographic trust in the system may have a fundamental architectural flaw.

 


The Internet should stop asking only who was in the room. It should ask who can bind the party bearing the loss.

 


America won’t beat China by banning AI. We’ll win by building the world’s best open models and letting innovation—not government—lead the way.

NVIDIA OpenShell Secures the Agent. Who Governs the Fleet?

In short: At GTC 2026, NVIDIA released OpenShell, an open source runtime that sandboxes autonomous AI agents with kernel-level policy: what files they can touch, what processes they can spawn, where their traffic can go. It is a serious piece of engineering and it validates something we have argued all year: agent security belongs in the environment, not in the prompt. But agent identity, agent-to-agent governance, and cross-sandbox communication all sit outside its scope today. This post covers what OpenShell does, where it stops by design, and three integration patterns that close the gap with Tigera Lynx.

Most attempts to control AI agents work at the model layer (alignment, system prompts) or the application layer (guardrail libraries, output filters). Both share a flaw: the thing being secured is also the thing doing the securing. A sufficiently confused or sufficiently compromised agent can talk its way past its own instructions.

OpenShell takes a different position, and it is the right one. Put the controls in the environment, where the agent cannot negotiate with them. An agent inside an OpenShell sandbox cannot leak a credential it never received, and cannot call an endpoint the kernel refuses to route.

If that argument sounds Continue reading

Content: New Parameter in Multiple something_config Ansible Modules

Last December, I wrote a pretty ranty post explaining how Ansible release 12 broke (some?) network device configuration playbooks. The inevitable anonymous troll (why are they always anonymous?) couldn’t resist asking whether I opened an issue on GitHub. I didn’t (more about that later), but when the solution to that rant was “we’re deprecating using templates in src” parameter, I opened an issue arguing why that’s not a good idea.

Read more …

What happens when your VPN meets 200 AI agents

Providing secure access for your human staff is no simple task. For one, traditional VPNs often grant unnecessarily broad access, so you may have replaced that aging technology with a newer zero-trust network access (ZTNA) solution. And you may have hammered your human-centered privileged access management (PAM) tools into working order, so your engineers are just as happy as your security auditors. But what happens when you add dozens or hundreds of AI agents to the equation? We know that today’s enterprise is racing to become agentic. Or what if you want to run continuous integration (CI) and continuous deployment (CD) jobs? After all, you want a modern DevOps stack! You’ll learn quickly that the tools you built and tuned for human access come up short. Checking identity upfront isn’t enough to securely control access. You need to be able to tailor access based on need, not merely identity. And you’ll need to be able to revoke access when work is completed and provide an audit trail to boot. Even more, you don’t want to run separate access architecture for humans and agents.  To support both human and agentic network access, companies need a unified architecture that can handle Continue reading

A broken DNSSEC rollover took down .al. Now 1.1.1.1 tells you when validation is bypassed

On July 3, 2026, the Albanian communications authority (AKEP), the operator of the .al country-code top-level domain (TLD) of Albania, attempted a DNSSEC key rollover. Something went wrong, resulting in DNSSEC validation failures. Any validating DNS resolver receiving these signatures was required by the DNSSEC specification to reject them and return errors to clients. That includes 1.1.1.1, the public DNS resolver operated by Cloudflare.

The .al TLD is the online home of Albanian government services, banks, and media; it ranks #191 on Cloudflare Radar's TLD ranking. Anyone trying to visit those sites, using a validating resolver, found them unreachable during the incident. The failure had the potential to affect every .al domain, regardless of where it was hosted or which authoritative nameservers served it.

Just two months earlier, a similar incident struck .de, the TLD of Germany. As we described in our blog post on the incident, our response was to install a Negative Trust Anchor (NTA) for .de, temporarily suspending DNSSEC validation in 1.1.1.1 to keep domains reachable while the registry resolved the issue. We did the same for .al.

NTAs restore resolution, but silently. A client receiving a Continue reading

1 … 4 5 6 7 8 … 3,526