F5 has reclassified a BIG-IP APM denial-of-service (DoS) vulnerability as a critical-severity remote code execution (RCE) flaw, warning that attackers are exploiting it to deploy webshells on unpatched devices.

https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/

Redundancy and resilience

If it's important, don't ask the team to try harder. Instead, create the conditions for ordinary effort to produce redundant outputs that reduce crises. If quality is a problem, look at the system, not the people.

https://seths.blog/2026/03/redundancy-and-resilience/

Interesting to see Copilot injecting ads into PR descriptions. Although there are a handful of older instances of this, if GitHub search is working properly, it looks like this started happening at scale around 10 days ago with more than 1k injections of this particular ad per day since then (if you search for other ad strings, you can find the rate of other ads)

https://github.com/search?q=%22%E2%9A%A1+Quickly+spin+up+copilot+coding+tasks+from+anywhere+on+your+macOS+or+Windows+machine+with+Raycast%22&type=pullrequests&s=created&o=asc&p=1

What will they think of next?

This week on the newsletter: "How not to mandate device-based age assurance"

https://educatedguesswork.org/posts/device-based-age-assurance/

In this post, we examine a number of enacted or proposed requirements for device-based age assurance and some of the ways they can go wrong.