AxisOps Labs

CVE-2026-98432: a use-after-free in every supported Ubuntu release back to 16.04

AxisOps Labs — Thu, 29 Oct 2026 09:00:00 +0000

A 9.8 in the kernel's IPv4 TCP path, no fixed kernel for any Ubuntu release and a tracker page that lists no mitigation. The fix you cannot install yet still tells you what the bug needs, and what a bug needs can be taken away.

What a mitigation pack has to prove before it runs

AxisOps Labs — Wed, 28 Oct 2026 09:00:00 +0000

Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.

The one that did not get the meltdown

AxisOps Labs — Tue, 27 Oct 2026 09:00:00 +0000

PHP2Shell and the Brotli decoder bug were patched the same day. One got the emergency response, the other did not, and the quiet one is harder to find on your estate because the obvious version strings lie about it. There is a role you can run to work out what you have.

What led us here

AxisOps Labs — Sat, 24 Oct 2026 09:00:00 +0100

Microkernels, eBPF, WebAssembly, LoRa mesh and confidential computing are usually filed as five unrelated hobbies. They are one argument, running for about a decade, about where you put a boundary and what it costs to cross it.

The patch took an afternoon. The inventory will take the week

AxisOps Labs — Wed, 21 Oct 2026 21:00:00 +0100

Two unauthenticated remote code execution bugs in PHP core, CVSS 9.2, with upstream releases out the same afternoon. The patch is the easy part. CISA's first instruction is to inventory every system running any PHP, and on most estates nobody can do that tonight.

CHERI: putting the bounds in the pointer

AxisOps Labs — Tue, 20 Oct 2026 09:00:00 +0100

The hardware answer to the problem eBPF and WASM solve in software: a pointer that carries its own bounds and permissions, enforced in silicon. Still an unratified RISC-V extension, whatever the coverage implies.

What a microkernel actually costs you

AxisOps Labs — Fri, 16 Oct 2026 09:00:00 +0100

The IPC objection to microkernels is fair, and it is the wrong place to stop the conversation, because what it buys you is a fault boundary that a monolithic kernel cannot sell at any price.

LoRaWAN and mesh are not the same argument

AxisOps Labs — Mon, 12 Oct 2026 09:00:00 +0100

They share a radio layer and almost nothing else. One has a network server and a join procedure; the other has neither, by design. Conflating them makes both sound worse than they are.

Meshtastic: a node is its key

AxisOps Labs — Sat, 10 Oct 2026 09:00:00 +0100

Dismissed as hikers with walkie-talkies. Read the 2.8 release notes as an identity architecture instead: node IDs derived from public keys, packets signed and no registry to ask because there's nothing there to ask.

Post-quantum: key exchange was the easy half

AxisOps Labs — Wed, 30 Sep 2026 09:00:00 +0100

Hybrid key exchange is largely deployed; certificates and signatures are nowhere near. The real bottleneck is crypto-agility, because anything that hard-codes an algorithm or needs a firmware update can't pivot in time.

Error correction is the whole game

AxisOps Labs — Wed, 02 Sep 2026 09:00:00 +0100

Qubit counts make the headlines. The physical-to-logical ratio is the engineering problem, and nearly everything else in the field sits downstream of it.

micro-zero: own the harness

AxisOps Labs — Wed, 29 Jul 2026 09:00:00 +0100

Agentic sessions are where our features get built now, which makes the harness they run in a piece of infrastructure. We are building our own, called micro-zero, and connecting it to the organisation's memory. The zero is where every session starts.

RISC-V: an ISA you are allowed to read

AxisOps Labs — Wed, 22 Jul 2026 09:00:00 +0100

The Server SoC, Boot and Server Platform specifications are ratified. What makes it interesting is the specification being nobody's property, rather than the instruction set itself.

Schedulers, and why the default is usually right

AxisOps Labs — Tue, 10 Feb 2026 09:00:00 +0000

CFS gave way to EEVDF over 6.6 to 6.12. Most people who tune a scheduler are solving a problem that isn't a scheduling problem, and the cases where it really is are narrower than the tuning guides let on.

The context problem is a retrieval problem

AxisOps Labs — Tue, 20 Jan 2026 09:00:00 +0000

An assistant session starts knowing nothing about the organisation, and no context window is ever going to hold fourteen years of decisions. We pointed retrieval at our own vault instead. The idea is a weekend's work to try; whether it holds up in daily use is what we intend to find out.