The Engineer

The Rollup RCE Hits Every Vite Project

The most broadly impactful vulnerability this week is Rollup CVE-2026-27606 — a path traversal → arbitrary file write → RCE affecting all three major release lines (v2, v3, v4). If you use Vite, you transitively depend on Rollup. Your CI pipeline is the attack surface: building code from external contributors or consuming npm packages with Rollup plugins can trigger the exploit. Fix: bump to 2.80.0 / 3.30.0 / 4.59.0. Run npm ls rollup across every project today.

This is particularly consequential given last week's vinext story — Vite is consolidating as the build tool default, which means the blast radius of Rollup vulnerabilities is expanding, not shrinking.

Kubernetes Container Escape Without Escaping the Container

CVE-2025-62878 (CVSS 9.9) allows PersistentVolume creation pointing at arbitrary host paths via parameters.pathPattern manipulation. This bypasses container isolation through the Kubernetes API itself — no runtime exploit needed. Multi-tenant clusters without admission controllers validating PV specs are fully exposed.

If you mount the host filesystem through the Kubernetes API, you've escaped the container without ever touching the container runtime.

Run kubectl get pv -o json | jq '.items[].spec.hostPath.path' and deploy OPA/Gatekeeper policy to block arbitrary hostPath PVs immediately.

Vitess, OpenSSL, and Caddy Complete the Picture

Vitess CVE-2026-27965 (CVSS 9.9) allows arbitrary code execution during backup restoration — meaning a compromised backup storage turns every restore into a production compromise. This fundamentally changes the trust model for your DR runbook. Upgrade to 23.0.3 or 22.0.4 and implement backup integrity verification independent of Vitess.

OpenSSL has a stack buffer overflow in CMS AuthEnvelopedData parsing affecting every active release line (3.0–3.6). Prioritize patching services that accept external cryptographic messages: email gateways, document signing, S/MIME.

Caddy before v2.11.1 has case-sensitivity handling bugs (CVSS up to 9.8) that bypass path-based access control. If your Caddy reverse proxy routes /api/admin through auth but /api/Admin falls through, you have an auth bypass. Upgrade and run mixed-case path tests against every protected endpoint.

The 0.0.0.0 Binding Pattern in Your Own Code

Juniper's CVE-2026-21902 (CVSS 9.8) is a four-request unauthenticated RCE chain caused by binding a Python REST API to 0.0.0.0:8160 with zero auth, piping user input to subprocess.run() as root. This is the most basic service misconfiguration pattern — and it's almost certainly in your stack. Grep for bind('0.0.0.0'), INADDR_ANY, host='0.0.0.0' across Python, Go, and Node services, especially monitoring agents and debug endpoints.

CyberStrikeAI Makes MCP a Dual-Use Protocol

CyberStrikeAI — an open-source AI attack kit combining MCP integration with 100+ offensive tools — is now live on GitHub. An attacker can use a language model to dynamically select, parameterize, and chain tools against your infrastructure using the exact same protocol your helpful coding assistant uses. This isn't theoretical; it's downloadable.

Every MCP server endpoint you've stood up is now a potential attack surface that offensive AI agents know how to talk to.

The defensive implication is immediate: every MCP server needs authentication, input validation, rate limiting, and audit logging at the same rigor as a public REST API. Most MCP implementations treat security as an afterthought because the protocol was designed for trusted local tool use. That assumption is now broken.

Four Agent Observability Startups Acquired in One Wave

The independent agent observability layer just collapsed. In rapid succession:

What's architecturally interesting is who acquired them — a database, an observability platform, a model provider, and a security company. Agent observability isn't becoming its own category; it's being absorbed as a feature by adjacent infrastructure layers. If you're coupled directly to any of these vendors' SDKs, you're accumulating migration debt.

The 'Identity Dark Matter' Problem

MCP-connected agents are creating ungoverned non-human identities that bypass your IAM stack. If your team has connected any AI agents to internal data stores via MCP, those agents almost certainly have broader access than intended, no credential rotation, no audit trail your IAM tooling understands, and no human sponsor accountable for their actions. Okta has launched 'Okta for AI Agents' — identity management specifically for non-human agent identities — which validates the problem even if the solution is immature.

The smart architectural move: build a thin internal tracing interface that emits structured trace events and routes them to whatever backend survives the consolidation. OpenTelemetry semantic conventions for GenAI are still experimental, but they're the directionally correct abstraction.

Netflix's 7.5x CPU Win via JDK Vector API

Netflix's Ranker service dropped serendipity scoring CPU from 7.5% to ~1% per node — a 7.5x improvement — through what's fundamentally a memory layout and instruction-level optimization. The antipattern they fixed is pervasive: iterating over arrays of objects, computing pairwise dot products with scalar math in nested loops.

The fix was two-fold:

1. Restructure data into flat contiguous buffers — the Array-of-Structures to Structure-of-Arrays transformation that game engine developers have known for decades. This alone dramatically improves cache-line utilization.
2. Leverage the JDK Vector API for SIMD — doing 4–8 multiplications per instruction instead of one.

Net result across the service: 7% total CPU drop, 12% latency reduction, 10% CPU/RPS improvement. If you have any JVM service doing embedding similarity, feature scoring, or ranking computations, audit your hot paths for this exact antipattern. Netflix using the JDK Vector API at this scale is a strong production-readiness signal.

PgJitter: JIT Finally Makes Sense for OLTP

PgJitter replaces PostgreSQL's LLVM JIT with lightweight alternatives (sljit, AsmJIT, MIR), cutting compilation time from milliseconds to microseconds. LLVM's JIT has millisecond-scale compilation overhead that makes it actively harmful for short OLTP queries — which is why most production PostgreSQL configs set jit = off.

If you've tuned your PostgreSQL configs with jit = off because compilation overhead exceeded execution time, PgJitter reopens that optimization.

This is immediately evaluable if you're running PostgreSQL with JIT disabled. The compilation-to-execution ratio has flipped from net-negative to net-positive for typical OLTP workloads.

Code Mode: The Next Pattern for Agent Tool Orchestration

The default MCP pattern is sequential: the LLM calls Tool A, gets a result, reasons, calls Tool B. Each round-trip consumes context window and adds latency. Code mode inverts this: the LLM writes a script that imports tools as libraries and composes them programmatically, then executes in a sandbox (Deno or Firecracker).

The token economics are dramatically better — one generation cycle instead of N. The latency is better — one execution cycle instead of N round-trips. The trade-off: you need a sandboxed runtime, and debugging a failed generated script is harder than debugging a failed tool call. This pattern will likely become standard for workflows with >10 tools; evaluate it now before your tool catalog makes sequential calling untenable.