Thoughts and notes on software, AI and automation.
October 26, 2026
The php2shell flaws were public before the updates were, and for the third one there is no emergency patch for now. How you set which of your services gets updated within which deadline, and what you do when there is nothing to install.
October 19, 2026
With Kolibri-1, Aleph Alpha has released a model that reasons in German. Using a quote letter and a complaint, we show you where you notice the difference in everyday work, what testers criticise and when your own hardware pays off.
October 12, 2026
Twenty incomplete visa applications, credentials coaxed out with a single prompt: where agents fail in real operations, and how to cut permissions into three levels for an agent that handles your supplier mail.
October 6, 2026
Hackerrank has an AI agent conduct job interviews, the Bundeswehr plans automated screening of applicants. Using one open position in your company, we show you which parts of an application a machine may pre-sort, and why every rejection needs a reason you can read out loud.
October 2, 2026
Excel is getting lists and nested arrays inside single cells, which makes it more capable still. We show you the three points at which your most important spreadsheet stops carrying the load anyway, and the four paths open to you then.
September 21, 2026
A report from a large corporation says the spec, the tickets and the code all come from an agent, and nobody checks any of it. Here are the four questions you put to your service provider, and the one point in the workflow where you nail down sign-off by a human.
September 17, 2026
A secret court case in Britain over iCloud encryption shows why promises in a brochure count for nothing against a government order. Here is how to sort your data into three tiers, so that your own key decides about the top one.
August 24, 2026
Till password on paper, tax adviser login in an Excel list, WiFi over messenger. What a self-hosted password vault with Vaultwarden changes about that, what it costs day to day, and when renting is the better call.
August 17, 2026
Roughly three quarters of office staff use AI tools without official approval. What that means in practice in a mid-sized company, and how you get a handle on it with a short list of approved tools, one named person for approvals and clear data levels.
August 14, 2026
In the attack on LiteLLM the weak link was not the model, it was the place where the credentials sat. Using our own setup, we show how keys stay separated, rotatable and logged, and why an interchangeable model connection is a security feature.
August 12, 2026
Only 1.8 percent of German websites say where a finder should report a vulnerability. Using our own setup, we show what goes into a security.txt, who reads the address and why a report that reaches nobody is the most expensive one.
August 3, 2026
Amazon is reporting catastrophically expensive AI use internally. We do the math on our own blog instead, run by run, and show the three build decisions that keep an automation from quietly burning money.
August 2, 2026
A document that slips instructions to an AI assistant is no exotic edge case, it is the rule as soon as an agent reads text from elsewhere. We show the four build rules we use to secure our own agents against it.
July 31, 2026
A lecture at RWTH Aachen put a name to something we have been doing for a while. Both ways have their place, and you usually work out which one you needed only afterwards.
July 25, 2026
Why we build automation as a tool rather than a replacement. People keep the decision, the machine takes the dull work.