28creation
Newsletter

28creation: Work software, automation and AI, explained.

News Developer tools

On Alpine servers that allow password logins, a password over 256 bytes can open accounts that have none.

Alpine SSH bypass: a 257-byte password opens key-only accounts

  • OpenSSH 10.6p2 and Alpine's patched packages, out November 5, close the hole for every Alpine release from 3.16 to edge.

What you can do with this

On each Alpine machine running sshd, run apk upgrade -U -a, then rc-service sshd restart. If you cannot update today, set PasswordAuthentication no. Either step closes the bypass.

Read the full piece
Guide Automation

Microsoft's own troubleshooting page says Power Automate can duplicate a run's actions because of the at-least-once design underneath it.

Automations that run twice: why rows duplicate, and a tested fix

  • Stripe, Shopify and GitHub retry or redeliver webhooks, and Make runs webhook scenarios in parallel by default, so one event can arrive twice.
  • On made-up test data, a look-up-first check stopped every duplicate with one run at a time, and none with eight at once.

What you can do with this

Give every automation a dedupe key from the sender, such as the event ID, and claim it in one atomic step: a unique column, a Make data store record or our script.

Read the full piece
News Developer tools

Conductor Cloud goes read-only on November 13 and starts deleting user data on November 20.

Conductor joins Meta, deletes cloud data from November 20

  • Conductor, an app for running Claude Code, Codex, Cursor and OpenCode agents in parallel, says it is joining Meta and has stopped new sign-ups.

What you can do with this

If your team used Conductor Cloud, choose Transfer to local on each workspace before November 20, then revoke the agent keys and the Conductor GitHub App it held.

Read the full piece

Get the short reads by email

New analysis and guides on work software, automation and AI. At most one email a week.

Look for an email from newsletter@28creation.com asking you to confirm. What we store.

Guide Work software

GitHub's SPF record used 10 DNS lookups on October 30, 2026, the most the SPF standard allows.

SPF, DKIM and DMARC for a small domain: setup and a checker

  • Gmail, Yahoo and Outlook.com require SPF, DKIM and a DMARC record from bulk senders; Outlook.com's bounce for failing mail is 550 5.7.515.
  • Our checker read 20 company domains on October 30, 2026: all publish DMARC, and 13 still carry pct, a tag RFC 9989 removed.

What you can do with this

Publish one SPF record under 10 lookups, turn on DKIM at 2048 bits, then add DMARC at p=none with a report address. Run the checker after each change to catch a broken record.

Read the full piece
News Work software

CISA has marked its fourth WordPress core flaw of 2026 as exploited; the patch shipped October 28.

WordPress upgrade flaw now exploited, fixed in 7.1.4

  • The bug lets an attacker with no account run code during a full core update. Fixes exist for every branch back to 4.7.

What you can do with this

Open Dashboard, then Updates, and confirm the site runs 7.1.4 or the patched release for its branch, such as 7.0.8 or 6.9.11. That closes the hole attackers are already probing.

Read the full piece
Analysis Startups

A $25 plan cost less on Paddle than on Stripe with tax filing at all three revenue levels we modeled.

Stripe vs Paddle fees: the plan price decides who is cheaper

  • All three merchants of record take their fee on the total including tax; Stripe Managed Payments came to 8.9% on a $25 plan.
  • In our runs, Stripe with Tax Complete beat Paddle only on pricier plans, because Stripe prices its tax tiers by sales count.

What you can do with this

Divide your monthly revenue by your plan price, find the Stripe Tax Complete tier for that sales count, and compare it with Paddle's 5% + 50¢ before you take on tax filing yourself.

Read the full piece
News Developer tools

GitBook says an attacker may have read its customers' Git Sync secrets, API tokens and integration tokens.

GitBook breach exposed Git Sync secrets: what to rotate

  • The attacker reached GitBook infrastructure credentials on November 2. GitBook revoked every personal API token and found no sign that content was changed.

What you can do with this

If you sync GitBook with GitLab, revoke that GitLab access token in GitLab and make a new one. It can write to your repository, and GitBook's own token reset does not touch it.

Read the full piece
Guide Automation

Microsoft says a subscribed calendar in Outlook updates about every 3 to 6 hours and can take more than 24.

Outlook and Google Calendar sync: four methods and their delays

  • Calendar links between Outlook and Google run one way and read-only; only the Google account in new Outlook and Google's plugin sync both ways.
  • Our merge script matched all 137 occurrences in made-up sample calendars; skipping one time zone step moved 34 of them by an hour.

What you can do with this

If a meeting booked today must show up on the other calendar today, skip calendar links: add the Google account to new Outlook, or ask your Workspace admin about Google's Outlook plugin.

Read the full piece
News Work software

Microsoft tells Power Automate users in Manitoba to set their flows to Bogota time for now.

Outlook meetings in BC, Alberta and Manitoba can be an hour off

  • British Columbia, Alberta and Manitoba stopped changing clocks on November 1. Existing Outlook meetings keep the old zone until someone changes them.

What you can do with this

If you have staff in those provinces, have each meeting organizer switch to the new Outlook time zone and re-save recurring series. You avoid people turning up an hour early or late.

Read the full piece
Guide Automation

On 30 sample workbooks we made, the usual two-line pandas merge lost 235 orders and counted 115 twice.

Combine many Excel files into one: a script tested on 30 files

  • The files hid 11 kinds of trap, from title rows and renamed headers to an Excel lock file and a duplicate copy.
  • On the same files, a short script that matches headers by name and writes a report found all 2,303 orders and the exact total.

What you can do with this

Before you merge a folder of exports, list every header spelling the files use and check the merged total against the source files. You catch lost and doubled rows before anyone reports on them.

Read the full piece
News Developer tools

36 of the 100 most-starred GitHub repositories had at least one workflow using pull_request_target on November 3.

GitHub blocks pull_request_target Dec 2; 36% of top repos use it

  • From December 2, GitHub Actions blocks it in public repositories unless a policy allows it. Test blocks run November 9 and 16.

What you can do with this

Open Settings, Actions, Policies, then Policy insights in each public repo before November 9. Allow the workflows you need by path and move the rest to pull_request, so CLA checks and labelers keep running.

Read the full piece
News Work software

Overnight, attackers set supermarket freezers in seven European countries to defrost, some reportedly reaching 50C.

Store fridge hacks reach 7 countries: what to take offline

  • Danfoss says the Dutch units hit used a default password off any secured network, weeks after it told customers to disconnect them.

What you can do with this

Ask whoever services your refrigeration or HVAC whether the controller has a public IP address. If it does, move remote access behind a VPN and change the default password.

Read the full piece
Analysis AI

In our sorting test, the instructions sent with each email added up to more tokens than the 1,000 emails themselves.

LLM API cost per office task: 1,000 emails priced at six vendors

  • We counted tokens on 1,000 generated office emails and priced two tasks at six vendors' list prices, read on October 28, 2026.
  • By our estimate, sorting them costs about 5 cents on the cheapest models and up to $1.62 on Claude Sonnet 5.5, before hidden thinking tokens.

What you can do with this

Set reasoning effort to the lowest level your task allows, cut quoted replies and footers, and send several emails per request. Grouping cut our estimate by 34%, stripping by about a quarter.

Read the full piece
Guide Automation

Teams Workflows webhooks are limited to 25 Flow bot posts per 5 minutes; old connectors allowed 60 in 30 seconds.

Teams webhooks moved to Workflows: migration steps and limits

  • Microsoft switched off Teams connector webhooks from May 18 to 22, 2026. Workflows webhooks replace them, take a different payload and belong to a person.
  • Our converter turned 7 of 11 sample MessageCards into cards that passed the official schemas; we did not post them to a real Teams tenant.

What you can do with this

Search your code and secrets for webhook.office.com and logic.azure.com, rebuild each as a Workflows webhook with a co-owner, and group alert bursts into one card.

Read the full piece
News Developer tools

An attacker read the environment variables of some Trigger.dev customers, the place background jobs keep their API keys.

Trigger.dev breach exposed environment variables: what to rotate

  • Trigger.dev disclosed it on November 1 and says the exploit is blocked. It has not said how many organizations were hit or how.

What you can do with this

If your jobs run on Trigger.dev, revoke each key stored there with the service that issued it, then check its usage logs. In two cases Wiz traced, stolen keys sat idle for days before abuse.

Read the full piece
News Developer tools

DeepSeek's new open-source coding agent runs commands without approval and can read its operator's home directory.

DeepSeek's open coding agent runs commands with full user access

  • DeepSeek published Super-Agent, an MIT-licensed research prototype that takes requests on one GitHub repository, works in its own session and answers with pull requests.

What you can do with this

If you try it, run it under a separate OS account and a dedicated GitHub account, and keep it in observe mode, so a mistake cannot reach your own files and logins.

Read the full piece
Guide Automation

Microsoft 365 reports a full daily quota with code 5.1.90, which a script can mistake for one bad address.

Email sending limits for scripts: Gmail, Workspace, Microsoft 365

  • Gmail allows 500 emails a day, Workspace 2,000 messages and 2,000 unique outside addresses, Microsoft 365 10,000 recipients and 30 messages a minute per mailbox.
  • Our Python sender paced, stopped and resumed without duplicates in 7 tests on a local server with 25 invented rows, not a real provider.

What you can do with this

Before a script mails a list, set its daily cap below your account's smallest limit and treat only 5.1.1 and 5.1.10 as bad addresses. Anything else should stop the run.

Read the full piece
News AI

OpenAI estimates 5 to 45 Astra messages per five hours on Plus, against 350 to 3,000 on Luna.

ChatGPT and Codex share one limit from December; Instant exempt

  • OpenAI says ChatGPT and Codex will draw from one allowance on Plus, Pro and Business from December; Instant answers do not count.

What you can do with this

If your team uses Codex and ChatGPT on the same seats, default routine work to Terra or Luna and check Settings > Usage weekly, so chat time does not run dry.

Read the full piece
Guide Developer tools

A public TLS certificate issued from March 15, 2029 may last 47 days at most, down from 398 days.

TLS certificates drop to 47 days: the dates and what to automate

  • The next cut, to 100 days, applies from March 15, 2027. Let's Encrypt moves its default from 90 to 64 days on February 10, 2027.
  • In our simulation, rules that renew at a fixed certificate age, such as 60 days, let a 47-day certificate expire.

What you can do with this

Search your cron jobs and timers for fixed renewal ages, move them to renew with a third of the lifetime left, and alert on a share of the lifetime instead of a fixed 30 days.

Read the full piece
Guide Work software

Grouped by exact description, a made-up card export showed only 11 of the 15 subscriptions we planted in it.

SaaS subscriptions in card statements: a script that finds them

  • Our standard-library Python script found all 15 in 25 months of sample data, with two false alarms it marked for checking.
  • With only the last 12 months it missed both annual plans, because a yearly charge appears once.

What you can do with this

Download at least 13 months of card transactions as CSV, run the script, import its calendar file, and decide on each annual plan 30 days before it renews.

Read the full piece
News Developer tools

A Linux kernel bug rated 9.8 of 10 can be reached through any listening IPv4 TCP port, with no login.

Linux TCP flaw CVE-2026-98432: Ubuntu and RHEL still unpatched

  • On October 31, Debian and Amazon Linux had fixed kernels; Ubuntu had builds in progress and Red Hat had none.

What you can do with this

Run uname -r on every Linux server and compare it with the fixed versions below. Where no fix exists, add the nftables rule Red Hat publishes, then patch and reboot when your distro ships.

Read the full piece
Guide Automation

Read entry by entry, a sample year of calendar events totaled 334.5 hours instead of the real 434.75.

Google Calendar to a timesheet: a script tested on a sample year

  • Google Calendar exports .ics files, which store a repeating meeting once with its rule, its skipped dates and its moved instances.
  • Our 152-line Python script expanded the repeats and matched all 48 month-and-project totals in an answer key we built for a made-up year.

What you can do with this

Before you bill from calendar hours, put the project in square brackets in each event title, export the .zip, run the script with your address, and read its check lines.

Read the full piece
News Developer tools

Two AWS keys stolen in a platform breach sat nearly idle for days, then ran up over $100,000, Wiz estimates.

Northflank is the ninth AI dev platform breached in October

  • Northflank told all customers on October 30 to assume their environment variables were decrypted. Wiz counts nine AI developer platforms that disclosed incidents this month.

What you can do with this

Revoke every AI key stored on a hosting platform with the provider that issued it, then check usage back to mid-September. A trickle of calls you did not make is the early warning.

Read the full piece
News Developer tools

Uninstalling the bad Claude Code build can leave its SSH key and startup scripts in place, Cursor and Phorion warn.

Claude Code 2.1.313 in Cursor: uninstalling leaves the backdoor

  • A modified Claude Code 2.1.313, not made by Anthropic, sat in Cursor's marketplace for about 11 hours and reached up to 5,000 users.

What you can do with this

On every machine that runs Cursor, search ~/.ssh/authorized_keys for svc-telemetry. If it is there, run Cursor's cleanup script and rotate the keys and tokens that machine holds.

Read the full piece
Analysis AI

AI notetakers and recording law: 14 states and the Otter ruling

  • Federal law lets one participant consent. We read 14 state laws that can ask for more, from everyone's consent to a recorded announcement.

What you can do with this

Before a bot joins a call with outside people, say in the invite and out loud at the start that the meeting is recorded and transcribed, and turn off auto-join for sensitive meetings.

Read the full piece
Guide Automation

Killed twice during a 50-row test on a sample form, our script resumed both times and saved no row twice.

Web forms filled from a spreadsheet: a script tested on 50 rows

  • On a sample form we built, a Playwright script entered 44 of 50 made-up customers in 36 seconds and logged why the other 6 failed.
  • A dry run that fills each form without sending it caught 5 of our 7 planted data problems before anything was saved.

What you can do with this

Log each row as submitting before the script clicks and as saved after the reply. Check any row left at submitting by hand instead of resending it, so a crash never creates a duplicate.

Read the full piece
News Work software

CISA gave US federal agencies three days, until November 1, to fix a Cisco firewall flaw that attackers already use.

Cisco ASA VPN zero-day: CISA sets a November 1 patch deadline

  • CVE-2026-76418 lets an attacker with no login force Cisco ASA and FTD firewalls to reload, if SSL VPN uses secondary authentication.

What you can do with this

Search the running config for secondary-authentication-server-group. If it appears and SSL VPN is on, upgrade to Cisco's first fixed release this weekend, or turn secondary authentication off until you can.

Read the full piece
News Developer tools

GitHub Enterprise users can now get Copilot with no seat fee, but every AI credit is billed from first use.

GitHub Enterprise now includes Copilot: the $19 break-even

  • At list prices, the new Copilot access costs less than a $19 Business seat whenever average use stays under $19 a developer.

What you can do with this

Divide last quarter's Copilot credits by active seats. Under 1,900 a head, ask your account team about Copilot access. Set a budget with room to grow first: Chat stops when it runs out.

Read the full piece
Analysis Work software

Cookie banners: when a small site needs one, and how to check

  • A site storing only what the requested page strictly needs requires no banner. In the EU, analytics usually does not count as strictly needed.
  • Since February 5, 2026, UK law exempts first-party statistics and display preferences if visitors are told and can object for free.

What you can do with this

Open your site in a fresh browser profile and list every cookie, storage key and outside request made before any click. In the EU, anything not strictly necessary generally needs consent first.

Read the full piece
Guide Automation

Compared cell by cell, two 300-row price lists showed 1,445 differing cells; only 40 real changes were in them.

Compare two Excel sheets by ID: 4 methods tested on 40 changes

  • On sample files we made, a lookup formula keyed on the ID found 38 of 40 changes and raised 8 false alarms.
  • A Python script that matched rows on the ID and columns on their names found all 40 and listed 8 cosmetic differences apart.

What you can do with this

Before you compare two exports, pick the column that identifies a row, such as a SKU or invoice number, and match on it. Never compare by position unless both files are sorted the same.

Read the full piece
News Developer tools

Alpine Linux upgraded GitLab twice and was still exposed to a 10.0 flaw, because the fix lives in Ruby.

Alpine GitLab attack: the regex fix also needs a patched Ruby

  • An attacker crashed Alpine's GitLab workers 8 times in October through CVE-2026-97229. Alpine found no sign of success but rebuilt the server anyway.

What you can do with this

If your GitLab is self-compiled or packaged by someone other than GitLab, upgrade Ruby to 3.3.13, 3.4.12 or 4.0.9 as well as GitLab. Then search puma_stderr.log for Ruby [BUG] crash reports.

Read the full piece
Analysis Work software

Delete a user in Google Workspace and an admin has 20 days to undo it, against 30 in Microsoft 365.

Google Workspace vs Microsoft 365: when deleted data is gone

  • Google gives admins 25 days on a purged Gmail message or Drive file; a SharePoint or OneDrive file stays restorable for 93 days.
  • Google's data terms treat a deletion the customer cannot undo as an order to erase it; neither vendor promises a restore after that.

What you can do with this

Raise Exchange's deleted-item retention from 14 to 30 days and the deleted-user OneDrive retention above 30. Both take minutes and widen the windows you get without paying for a backup.

Read the full piece
News Developer tools

Clients reporting macOS 27.2 made 769 connections in a day to test servers signed with broken eMudhra keys.

macOS 27.2 ships without eMudhra fix for curl, git and python3

  • Apple's October 26 updates did not change the file that curl, git and python3 trust, and the disclosure site says 27.2 undid the manual fix.

What you can do with this

On every updated Mac, run /usr/bin/curl against the disclosure site's test host. If it connects, repeat Apple's cert.pem steps, so git and scripts stop trusting forged certificates.

Read the full piece
Guide Automation

In our test, 25,000 order IDs with 19 digits shrank to 18 distinct values once cut to Excel's 15 digits.

JSON to Excel without losing fields: four routes tested

  • On a sample export we made, DuckDB's default sample missed a late field and two line-item routes dropped 6,500 orders with no items.

What you can do with this

Before you share a converted JSON export, compare row count, one money total, one long ID and the column list with the source. Store IDs as text.

Read the full piece
News Developer tools

At 05:40 UTC on October 28, Tailscale's stable Docker image was still 1.104.2, the version with the root flaws.

Tailscale fixes SSH root flaws in 1.104.4; Docker image still old

  • Tailscale 1.104.4 fixes four flaws; the worst let a device allowed to SSH into a server reach root on it through SSH forwarding.

What you can do with this

Open the Machines page, filter Version by Update available, and update every server to 1.104.4. On containers, set TS_SSH_DISABLE_FORWARDING=1 until a 1.104.4 image appears.

Read the full piece
News Automation

Outside AI agents will be able to read and edit Keynote, Pages and Numbers files, but only on macOS 27.

Apple opens Pages, Numbers and Keynote to AI agents via MCP

  • Apple's November beta adds MCP and an assistant built on Apple and OpenAI models; Apple lists both under features for $12.99-a-month Creator Studio subscribers.

What you can do with this

Check which of your Macs can run macOS 27, and run first agent edits on copies of your sheets and decks, so a wrong edit costs you a duplicate, not the original.

Read the full piece
Analysis Automation

A new AI by Zapier step defaults to the Premium tier: 5 tasks a run before any tool call.

Zapier costs climb with tasks: where they go, how to cut them

  • Zapier bills each successful action as a task, and the smallest Pro tier costs $26.65 per 1,000 tasks against $5.78 at 50,000.
  • In our hypothetical example, three fixes from Zapier's own rules cut 17,400 tasks a month to 6,100, and $189 a month to about $113.

What you can do with this

Open Zap history, select the Task usage tab and fix the top Zap first: set its AI step's tier, put filters before actions, and move one-off steps out of loops.

Read the full piece
Analysis Work software

At Microsoft, Google and Atlassian, a full 4-hour outage earns the same SLA credit as a 1-hour one.

SaaS uptime SLAs: what a 4-hour outage earns at six vendors

  • By our math, 4 hours fully down earns 25% of a month's fee at Microsoft, 10% at Atlassian, 3 days at Google.
  • Slack's public SLA names no uptime figure, and Zoom's terms publish none.

What you can do with this

Put each vendor's claim deadline in your calendar: 15 days after month end at Atlassian, 30 days after quarter end at GitHub. Keep your own outage log, because no credit is paid without a claim.

Read the full piece
News AI

For 13 days, 155 Workers AI responses carried data from other customers' requests, all from requests over 681,280 tokens.

Cloudflare GLM-5.3 bug put other customers' data in 155 replies

  • Cloudflare says a known gap between GLM-5.3's context window and its cache pool met an SGLang bug that returned stale cache pages with HTTP 200.

What you can do with this

If you sent GLM-5.3 prompts over 681,280 tokens from August 27 to September 9, ask Cloudflare if yours were among the 155, so you know what was exposed. Self-hosting SGLang? Upgrade to v0.5.22.

Read the full piece
News AI

OpenAI's GPT-6.1 Terra charges $5 per million output tokens, down from $12 on GPT-5.6 Terra.

GPT-6.1 Terra cuts output price 58%, to $5 per million tokens

  • OpenAI released GPT-6.1 Terra on October 26 at $1 in and $5 out per million tokens, aimed at computer use and writing.

What you can do with this

If you run GPT-5.6 Terra, price one week of your logs at the new rates and test your own prompts first. Output-heavy jobs save the most.

Read the full piece

That was the 40 newest

Every article and note, as a plain list: