Hi, I’m Roham 👋

On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too. If you run a self-managed GitLab, update first and read the rest later. Summary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab’s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability. ...

On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases. If you run PHP, update first and read the rest later. Summary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction. ...

In the previous post we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost. This post adds three things: Limiting attempts with MaxDeliver Spacing out attempts with BackOff and NakWithDelay Routing “poison” messages to a dead-letter stream I tested every behavior below against an embedded NATS server (with JetStream) and the nats.go client, and the outputs come from that run. ...

When I want to really understand a concept, I build the smallest runnable example of it. This time it was NATS JetStream. The result is go-nats-demo: a publisher, a worker and NATS itself, all wired together with Docker Compose. Why JetStream? Core NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. JetStream adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them. ...

Welcome to My Blog! This is the first post I’m publishing on my personal website. Why Did I Create This Site? To share my experiences and knowledge To learn more To connect with people interested in similar topics To Be Continued… I will publish more articles soon. Stay tuned!