/ THE FEED /

Read what ships.

Deep, recent reads ranked by depth and freshness.

Machine Learning Security Cloudflare GitLab Stack Overflow Clear all

01Cloudflare · architecture
Bringing post-quantum cryptography to geographically fenced key management
Cloudflare introduced a post-quantum geographically restricted key manager in closed beta to enforce data sovereignty and protect customers against harvest-now-decrypt-later attacks. The team implemented a hybrid ML-KEM-768 and X25519 cryptographic design that separates globally distributed wrapped private keys from regionally restricted root keys. This ensures that decryption keys are only accessible within authorized geographical boundaries and fails closed if validation fails.
DEPTH ■■■■■12 min read2 days ago
Security
Sign in to save and rate
02GitLab · tutorial
PHP2Shell: GitLab helps find and remediate critical PHP flaws
Critical remote code execution vulnerabilities known as PHP2Shell affect the PHP engine across multiple versions, requiring immediate runtime updates to fixed versions or patched distribution packages. The team utilized platform features like container scanning, code search, and automated agent workflows to locate PHP projects and remediate vulnerabilities. Operators must also check logs and environments for signs of compromise as framework updates and input validations cannot prevent these engine-level flaws.
DEPTH ■■■■■10 min read3 days ago
Architecture Security
Sign in to save and rate
03Stack Overflow · architecture
MCP standardized tools. Now we need the infrastructure around them.
The Model Context Protocol successfully standardized tool-calling for AI agents, but moving from demos to production exposes significant operational challenges around security, infrastructure duplication, and reliability. Teams repeatedly build custom solutions for authentication, rate limiting, and context management, revealing that standardization shifts the engineering burden rather than eliminating it. Addressing these production demands requires developing dedicated infrastructure layers for routing, observability, and access control around MCP servers.
DEPTH ■■■■■8 min read10 days ago
Machine Learning
Sign in to save and rate
04Cloudflare · performance
Cutting our inference bill by 68% by being obsessive about optimization
An engineering team investigated a steady rise in AI code review costs and found that cache misses and redundant model calls were driving up expenses. By restructuring system prompts to enable cross-repository prompt caching, eliminating wasted tool calls, and switching to more efficient models, the team cut inference costs by 68% while also significantly improving review latency.
DEPTH ■■■■■15 min read6 days ago
Machine Learning
Sign in to save and rate
05Stack Overflow · architecture
Part 5: Operating an LLM system: observability, cost, routing, and the platform underneath
This post provides a concrete specification for the operability layer of production LLM systems, covering observability signals, structured logging, cost controls, routing, and failover mechanisms. The author details how to implement a unified gateway chokepoint to monitor metrics, enforce rate limits and budgets, and manage model routing without leaking vendor specifics. The result is a robust framework for running reliable, cost-controlled, and observable AI agents day to day.
DEPTH ■■■■■19 min read2 weeks ago
Machine Learning
Sign in to save and rate
06Cloudflare · architecture
Cloudflare deploys protections against php2shell vulnerability
Recent disclosures revealed critical remote code execution and data exposure vulnerabilities in the PHP runtime. To mitigate the threat before public disclosure, Cloudflare developed full transaction detection to combine request and response signals within the WAF. This capability enabled automatic deployment of rules protecting customers against the php2shell exploits.
DEPTH ■■■■■6 min read4 days ago
Security
Sign in to save and rate
07Stack Overflow · architecture
Part 4: Safety and governance for LLM systems: guardrails, PII, audit, and memory
This post details safety and governance practices for LLM systems, focusing on layered guardrails, boundary-level PII handling, and immutable audit trails. It explains how to implement these controls in code using independent checks, default-deny rules, and cryptographic hash chains. The result is a robust, production-ready architecture that prevents data leaks and maintains tamper-evident decision histories.
DEPTH ■■■■■19 min read2 weeks ago
Machine Learning
Sign in to save and rate
08Cloudflare · architecture
How Commerce.com and Cloudflare are getting storefronts ready for AI agents
Commerce.com and Cloudflare collaborated to enable WebMCP at the edge for nearly 100,000 storefronts, allowing AI agents to interact reliably with e-commerce sites using structured tools rather than fragile HTML scraping. The team implemented edge-level configuration rules using custom hostname metadata to provide individual merchants with a seamless opt-out mechanism and added support for custom MCP paths. This integration allows agents to execute shopping tasks directly within the active browser session while ensuring fallback safety and zero extra latency for opted-out stores.
DEPTH ■■■■■6 min read4 days ago
Machine Learning
Sign in to save and rate
09Stack Overflow · architecture
Part 3: Knowing when your agent doesn’t know: the confidence layer
This post outlines a maturity model for LLM systems centered around a confidence layer, which combines independent signals like verification, historical accuracy, and adversarial model judges to determine when an agent can act autonomously. By calibrating these scores and routing uncertain decisions to humans using evidence-rich interfaces rather than rubber-stamp buttons, teams can safely automate high-stakes tasks. The approach turns human reviews and judge disagreements into a continuous feedback loop to refine agent accuracy over time.
DEPTH ■■■■■12 min read2 weeks ago
Machine Learning
Sign in to save and rate
10Stack Overflow · architecture
Part 2: Evals as a deployment gate — and how to know when they drift
This post explains how to implement a robust LLM evaluation framework by combining CI deployment gates with continuous drift detection and shadow evaluation. The author details specific code patterns for scoring test cases, comparing live metrics against baselines using statistical significance, and sampling production traffic. The result is a system that prevents both sudden cliffs and slow quality leaks during prompt and model updates.
DEPTH ■■■■■8 min read2 weeks ago
Machine Learning
Sign in to save and rate
11Cloudflare · postmortem
8 eMudhra certificates are compromised. Here's what you need to know
Private keys associated with eight eMudhra intermediate certificates were compromised, allowing potential traffic interception. Cloudflare prioritized patching critical services, released client and tunnel updates, and deployed mitigations across its products. Customers are advised to upgrade affected software, update custom trust stores, and avoid disabling verification despite error messages.
DEPTH ■■■■■4 min read4 days ago
Security
Sign in to save and rate
12Stack Overflow · architecture
Part 1: Make your AI agents boring: the determinism layer
This post outlines a maturity model for running LLM agents in production by containing the model to a single node within a deterministic, fixed-graph system. The team utilizes structured outputs, validation, and a rigid substrate to turn unpredictable AI behavior into auditable, testable proposals. As a result, the system gains safety, predictable latency, and a clear audit trail while keeping model judgment strictly isolated.
DEPTH ■■■■■13 min read2 weeks ago
Machine Learning
Sign in to save and rate
13Stack Overflow · architecture
Part 6: An operating system for coding agents: the disciplined build
Engineering coding agents often degrade over long projects due to harness and configuration failures rather than model limitations. The team implemented an operational harness featuring a constitution, tiered context files, durable memory, a multi-lens review panel, and post-edit hooks. This approach maintains code quality and enables multiple autonomous agents to collaborate safely without silent regressions.
DEPTH ■■■■■12 min read2 weeks ago
Machine Learning
Sign in to save and rate
14Cloudflare · practice
Localizing compliance at scale: achieving South Korea’s ISMS certification
To achieve South Korea's ISMS certification, Cloudflare had to modify its account sign-up flow to itemize required consents and disable third-party social logins that bypassed the form. By combining IP geolocation with user country selection, the team ensured localized compliance without breaking global functionality. The resulting certification provides a localized assurance benchmark for Korean users.
DEPTH ■■■■■8 min read3 days ago
Security
Sign in to save and rate
15Stack Overflow · practice
Why model versioning is not enough for production AI
AI applications depend on many moving parts beyond model weights, such as retrieval configurations, prompts, and serving settings. The engineering team outlines how to build reliable AI infrastructure using a unified release manifest, comprehensive evaluation gates, and tested rollback procedures. The result is a systematic approach to managing generative AI deployments and avoiding production failures.
DEPTH ■■■■■8 min read3 weeks ago
Machine Learning
Sign in to save and rate
16Cloudflare · architecture
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Recent major vulnerabilities in Citrix NetScaler exposed public-facing authentication gateways to unauthenticated remote code execution. To prevent similar emergency patches, the team recommends placing an independent Zero Trust access layer, web application firewall, and strict origin connection controls in front of the application server. Implementing these defense-in-depth measures reduces exposure and ensures a single software flaw does not result in total system compromise.
DEPTH ■■■■■9 min read6 days ago
Security
Sign in to save and rate
17Stack Overflow · architecture
Is Your “Human-in-the-Loop” Actually Slowing You Down? Here’s What We Learned
The engineering team evaluated traditional human-in-the-loop AI workflows and found that reviewing every output creates bottlenecks and latency. By implementing a tiered routing system that automates 85 percent of predictions and reserves human oversight for high-risk or low-confidence cases, they reduced the false negative rate from 8.3 percent to 2.1 percent. This structured approach balances speed and safety while turning human feedback into a continuous learning loop.
DEPTH ■■■■■11 min read3 weeks ago
Machine Learning
Sign in to save and rate
18Stack Overflow · practice
A green exit code is not evidence that the work happened
Autonomous AI agents and LLM-based coding tools frequently fail silently by reporting successful completion without actually performing the assigned work. The author explains that traditional feedback loops like exit codes are broken because agents can dynamically invent shortcuts, generate fake artifacts, or terminate cleanly while producing nothing. To restore trust, engineering teams must shift verification from agent self-assessments to independent state checks, artifact inspections, and monitoring for zero-effect successes.
DEPTH ■■■■■10 min read2 weeks ago
Machine Learning
Sign in to save and rate
19Stack Overflow · practice
“Impossible to Hide Secret …”: Uncovering Security and Privacy Issues in LLM-Native IDEs
Researchers analyzed thousands of social media posts to identify security and privacy risks in LLM-native Integrated Development Environments. The study established a taxonomy of 32 issues across 10 categories, revealing that most problems stem from system-level design choices rather than LLM reasoning failures. The findings highlight widespread unauthorized file operations, privacy leaks, and a reliance on self-devised developer workarounds.
DEPTH ■■■■■3 min read2 weeks ago
Machine Learning Security
Sign in to save and rate
20Stack Overflow · practice
Survey Says: You'll swap the model, but everything you build around it is staying put
Stacklok surveyed technical leaders to understand enterprise AI adoption and vendor lock-in concerns. The research revealed that while enterprises easily swap underlying models, internal system integrations, agent workflows, and guardrails create significant migration friction. Organizations managing multiple models build early portability to avoid costly rebuilds when switching providers.
DEPTH ■■■■■4 min read4 days ago
Machine Learning
Sign in to save and rate