Posts

This is the first post of a beginner series, Go Fundamentals. The plan is to cover the language basics here, and then move on to a second, backend-oriented series: HTTP services, databases, concurrency in real systems. I already used Go in an earlier post on NATS JetStream, but that one assumed you could read Go. This series starts from zero. Today we install Go, create a module, and learn the handful of commands you will type every day. Everything below was run with Go 1.26.0 on macOS (arm64). ...

On 19–20 October 2026 the Go team released Go 1.27.3 and 1.26.10. They contain one security fix, CVE-2026-111943 (Go issue 82345): crypto/x509 now rejects chains that contain a small set of intermediate certificates from the CA eMudhra (emSign), because their private keys are compromised. The advisory doesn’t say which certificates, so I looked. If you ship Go binaries, updating Go on your machine is not enough. Every binary has to be rebuilt with a fixed toolchain. ...

At the end of the previous post I promised two topics: running more than one worker, and watching how far behind the workers are. One worker is fine until messages arrive faster than it can process them. This post answers two questions: how do I add workers without processing anything twice, and how do I know the queue is backing up? Everything below ran against an embedded nats-server (JetStream enabled, temp store dir) and nats.go v1.54.0, on Go 1.26. The outputs are from those runs. ...

On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too. If you run a self-managed GitLab, update first and read the rest later. Summary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab’s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability. ...

On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases. If you run PHP, update first and read the rest later. Summary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction. ...

In the previous post we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost. This post adds three things: Limiting attempts with MaxDeliver Spacing out attempts with BackOff and NakWithDelay Routing “poison” messages to a dead-letter stream I tested every behavior below against an embedded NATS server (with JetStream) and the nats.go client, and the outputs come from that run. ...

When I want to really understand a concept, I build the smallest runnable example of it. This time it was NATS JetStream. The result is go-nats-demo: a publisher, a worker and NATS itself, all wired together with Docker Compose. Why JetStream? Core NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. JetStream adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them. ...

Welcome to My Blog! This is the first post I’m publishing on my personal website. Why Did I Create This Site? To share my experiences and knowledge To learn more To connect with people interested in similar topics To Be Continued… I will publish more articles soon. Stay tuned!