Practical writing on software architecture, mobile engineering, AI in production, and the consultancy work that lives at the intersection. Updated as we have something worth saying.
GitLab patched a critical 9.9 AI Gateway flaw (CVE-2026-90970) affecting self-hosted servers. Here is what it exposes, how to patch, and how to harden any self-hosted AI gateway.
Read the post →iOS 27 opened Apple's Foundation Models framework to any LLM provider, not just Apple's own. What the new session protocol actually changes, and how to build on it without getting burned by its limits.
Read the post →JetBrains' own Cadence service was breached through an unpatched TeamCity flaw. What CVE-2026-63077 means for your CI/CD pipeline security.
Read the post →PostgreSQL 19 faces a record 53+ feature reverts and a pushed-back beta 4. What the unusually rocky cycle means for your production upgrade plan.
Read the post →DeepSeek V4.1-Flash cut its KV cache to 890 bytes per token. What KV cache economics mean for your production AI agent's real inference bill.
Read the post →OpenAI is cutting Cursor off from its models after SpaceX bought it. What the contract clause behind that reveals about vendor risk in your AI coding tools.
Read the post →Kubernetes 1.37 makes HPA scale-to-zero Beta and on by default. What changes for GPU and cloud costs, how it fits with KEDA, and where cold starts still bite.
Read the post →Next.js patched two critical unauthenticated RCE flaws in AVIF image optimization and Windows hosting. What self-hosted teams should do now.
Read the post →OpenTelemetry's GenAI conventions moved to their own repo in June 2026, still unstable. What to instrument now, and how to avoid a rewrite later.
Read the post →AWS's Bedrock AgentCore Web Search reached general availability. How it grounds production AI agents in cited web data, and the trade-offs to weigh.
Read the post →Google's A2A protocol joined MCP inside the Linux Foundation's Agentic AI Foundation. What that neutral governance shift means for teams building multi-agent systems.
Read the post →AWS deprecated the EKS aws-auth ConfigMap, but 81% of clusters still run on it. What EKS access entries change, and a migration path that will not lock you out.
Read the post →Stripe's $7B OpenRouter acquisition put AI model gateways on every CTO's radar. The architecture pattern, the build versus buy trade-offs, and a rollout plan.
Read the post →A compromised maintainer account turned keyv and cacheable into a worm-scale npm supply chain attack with valid signed provenance. What happened, why provenance didn't stop it, and the pipeline changes that actually help.
Read the post →AWS open-sourced Kiro Crew, a persistent multi-agent coding workspace. What always-on autonomous agents mean for engineering process, risk, and governance.
Read the post →Kubernetes 1.34 made Dynamic Resource Allocation stable. Here is what GA means for GPU scheduling, AI workload utilization, and rollout risk in production.
Read the post →Google's Android developer verification requirement starts September 30, 2026, and it reaches past the Play Store into sideloading and enterprise distribution. A practical checklist for signing pipelines and app inventories before enforcement lands.
Read the post →Malicious AI agent skills just hit 1.7 million installs, per Black Hat USA 2026 research. A practical vetting and containment framework for teams adopting them.
Read the post →AI-generated code passes security review only 56% of the time, and hallucinated packages are landing in production undetected. A practical review gate to catch vulnerable patterns and slopsquatting before they ship.
Read the post →The MCP 2026-07-28 spec removes stateful sessions, redesigns Tasks, and ships MCP Apps. What changed, what breaks, and a practical server migration checklist.
Read the post →Non-human identities now outnumber employees inside most enterprises, and AI agents are the fastest-growing category. A practical guide to scoping, authenticating, and governing agent access before it becomes a liability.
Read the post →Multi-agent AI systems burn 15x the tokens of a single call. The orchestration patterns, cost controls, and prompt contracts that hold up in production.
Read the post →MCP adoption outran its security, with dozens of critical CVEs found in reference servers early in 2026. A practical guide to running Model Context Protocol servers in production: blast radius, authentication, gateways, untrusted tool output, and audit.
Read the post →A production RAG system is a pipeline of costs, not one API call. The six cost centres that drive the bill, an illustrative worked example, and the levers that move the total most.
Read the post →Integrating LLMs into a Spring Boot backend the way an experienced JVM team would: service interfaces, streaming over SSE, structured output, pgvector retrieval, Resilience4j, cost controls, and testing the non-deterministic.
Read the post →Context engineering is the discipline replacing prompt engineering in production LLM systems. Here is what it means in practice, and why getting it wrong costs teams real money.
Read the post →Why 88% of AI agent pilots never reach production: the evaluation, governance, and identity gaps that stall them, and what the 12% that ship do differently.
Read the post →The exact framework we use to assess a software acquisition target end-to-end in ten working days — what to ask, what to read, what to ignore, and what to write down for the board.
Read the post →A phased traffic-cut strategy for moving from AEM to a composable headless stack — with the migration sequence, content-mapping pitfalls, and rollback plan we use in practice.
Read the post →Three failure modes we see repeatedly in production retrieval systems — and the architectural shifts that fix them. With real numbers from a 100k-document deployment.
Read the post →A practical guide to setting up reliable @Preview support in Jetpack Compose with ViewModels, state hoisting, and dependency injection. Reproducible from scratch.
Read the post →We publish when we have something concrete to say — not on a content calendar. If you'd like the next post in your inbox, write to info@ktsolutionsltd.com and we'll add you to a small mailing list.
Before we start, please share a few details so we can follow up with you.
End this conversation? Your chat will be emailed to us.