DigitalOcean shipped its first Januscape livepatch 45 minutes after the page, closing thousands of hypervisors within 48 hours on kernels where the upstream fix even existed. Then a second, harder AMD issue hit the 1,600 hosts that couldn't be livepatched, forcing a full kernel update and reboot three weeks later. The lesson worth stealing is the long tail: a few hundred 5.10-kernel hosts had no upstream patch, so the team wrote new livepatches from scratch. A credible account of what real fleet-scale security operations look like under pressure.
Your servers' Baseboard Management Controllers run outside the OS, and that's exactly the problem. Researchers warn that flaws in BMC firmware and the aging IPMI protocol let attackers take control below the operating system, surviving reinstallations and ordinary recovery. Standard EDR and antivirus sit above this layer, so a compromised BMC is invisible to the very tools meant to catch it. For GPU clouds and bare-metal fleets with thousands of hosts on shared management networks, one foothold can reach far beyond a single box.
Maka, now incubating at Apache, is a local-first agent workspace that runs models and tools behind a sandbox boundary while leaving sessions, tool calls, and recovery data on your hardware by default. Tools that poke outside the sandbox need your approval, and every turn is written to a durable record you can branch, search, and resume from. One Runtime Host drives the desktop app, a CLI/TUI, and an eval harness, so your data stays yours whichever interface you pick.
An automated scanner didn't stop at flagging a bug in google/agents-cli, it wrote the fix. The arbitrary file write in scaffold create could smuggle credentials out of an agent workspace, and Google merged the patch into v1.4.1. No CVE, no advisory, just a scanner closing the loop from finding to shipped patch. That is the scanner role evolving from reporter to fixer.