Mat Caniglia

Why a deploy broke, what a cloud bill hides, what SRE misses. 18 years in platform engineering. The Platform Radar: daily news with sources. CEO, Clouditive.

[Mat Caniglia @matcaniglia]

Network appliances belong in the same inventory as your app dependencies. CISA added two exploited Ivanti Connect Secure flaws to KEV on Oct 30. Search that inventory for Connect Secure and find who owns each box. https://t.co/XwKRLbpkcW

#VulnerabilityManagement

[Mat Caniglia @matcaniglia]

OS patch audits won't catch compromised eMudhra certs in JetBrains IDEs. Check IDE versions against the fixed list. https://t.co/jv7i9AxCni

#JetBrains

[Mat Caniglia @matcaniglia]

A marketplace pull does nothing for laptops that already have the extension. Cursor says a malicious Claude Code extension sat in its marketplace on October 29, potentially affecting up to 5,000 users. List every machine that had it. https://t.co/e02R2TGUM0

#SupplyChainSecurity

[Mat Caniglia @matcaniglia]

Audit logs that name a trusted client prove little on an unpatched LXD host. An unauthenticated attacker can authenticate as any trusted client via a crafted certificate chain. Match recent VM changes to the people who made them. https://t.co/uD0TXhAzPz

#LXD

[Mat Caniglia @matcaniglia]

A patch push aimed only at Java developers misses most of the IDEs this CVE names. CVE-2026-118696 also lists PyCharm, PhpStorm, RubyMine and WebStorm. Check the IDE versions on your Python and PHP machines too. https://t.co/2D9lsyC0f8

#JetBrains

[Mat Caniglia @matcaniglia]

List every AI agent with write access to your repos. Write one human name next to each. Any blank row is your accountability gap.

#AIAgents

[Mat Caniglia @matcaniglia]

Specializing a multimodal model moves the hard work from prompting to evaluation. Liquid AI's LFM3 post is pitched at building those models. First, score the current general model on a few hundred labeled real inputs. https://t.co/LQGYdMRAdw

#LFM3

[Mat Caniglia @matcaniglia]

@Pragmatic_Eng @MattPocock The part I'd want to hear is what happened the month after. Something built outside the roadmap still needs an owner, someone paged at night and a review path. That's where I'd look to see if the autonomy was backed or just tolerated.

[Mat Caniglia @matcaniglia]

@BleepinComputer A crash bug on the VPN box hurts more when that box is also the only way the team gets in to fix it. I'd check there's an out of band path before the patch window, not during it.

[Mat Caniglia @matcaniglia]

@swyx @antigravity @saranormous A top index score and holding up through a long agent session are different tests. I'd watch whether it stays on track after an hour of tool calls in a messy repo, and what each finished task actually costs, before reading much into the rank.

[Mat Caniglia @matcaniglia]

@GergelyOrosz Launch volume tells me little until teams put these things on real work. I'd watch which ones are still in use a month later, and what people quietly dropped to make room for them.

[Mat Caniglia @matcaniglia]

@mitchellh Opening server testing to everyone could bury the FreeBSD reports under Linux volume, and those may be the hardest to reproduce in house. Are you tagging reports by OS and release so the smaller platform still gets a clear signal?

[Mat Caniglia @matcaniglia]

@IEEESpectrum I'd want to know if the higher duty also applies to finished transformers. If it only hits the steel, importing whole units gets cheaper than building them in Europe, which works against the local capacity the transition needs.

[Mat Caniglia @matcaniglia]

@BleepinComputer The part I'd watch is what happens to the address space now. If those ranges get handed to legitimate tenants later, blocklists built on them start dropping real traffic, so I'd give those entries an expiry date.

[Mat Caniglia @matcaniglia]

@GergelyOrosz The skill I'd worry about is reading, not typing. Spotting a subtle bug in a diff is mostly learned by writing and breaking code yourself, so if new engineers never hand code, what trains their review judgment?

[Mat Caniglia @matcaniglia]

@GergelyOrosz The risk I'd watch is that subjective interviews quietly reward people who talk like the interviewer. If coding rounds go, I'd want a written rubric and two interviewers scoring the same session separately before comparing notes. Otherwise unpredictable just means inconsistent.

[Mat Caniglia @matcaniglia]

@BleepinComputer I'd check which model versions a tool like this actually calls, and whether that can change without notice. Side by side answers only help if you know what you're comparing. I'd also read how it stores your prompts.

[Mat Caniglia @matcaniglia]

@BleepinComputer I'd want to know if this applies to old messages too. Public support channels often hold pasted logs and config, sometimes with live tokens, written by people who assumed search engines would never see them.

[Mat Caniglia @matcaniglia]

@BleepinComputer I'd want to know if account PINs or support verification answers were in there. With an ISP, that data lets someone call support as the customer, and resetting those is a lot harder than rotating a password.

[Mat Caniglia @matcaniglia]

@BleepinComputer If the exploit itself stays hidden, I'd stop betting on catching it and watch what the device does next. New outbound connections and admin tools running at odd hours are harder to disguise. Does the writeup say what the framework leaves in logs?