JetThoughts has been building software since 2008. Book a call, or write to sales@jetthoughts.com. You'll leave the call with a written one-page scope within 2 working days.
A 30-minute call; pick a time.
An AI Agent Deleted a TV Show's Whole Season
Five weeks before its premiere, The Challenge Sverige lost its edited season to an AI agent on the production server. Here's what founders can take from it.
· JetThoughts
Anthropic: AI Worms Are Months Away
Anthropic's red team showed small AI models hopping between $55 Android TV boxes. No rogue worm exists yet. Here's what the experiment does and doesn't prove.
· JetThoughts
MCP's Command Execution Flaw Is 'By Design'
OX Security found 200,000 MCP servers exposed to command execution, and Anthropic says the behavior is intended. Here's what to check if your team runs MCP.
· JetThoughts
Your Dev Shop Says the Code Was Reviewed. By What?
Copilot now takes part in more than one in five code reviews on GitHub. The research says AI reviewers earn their keep - and that the tuning which makes them usable suppressed about a fifth of real vulnerabilities on a standard benchmark.
· Paul Keen
Rails 7 End of Life: Pick Your Exit
Rails 7.1 got no patch for CVE-2026-66066, a CVSSv4 9.5 pre-auth RCE. How to find every app of yours on a dead branch and pick between four realistic exits.
· JetThoughts
Rails CVE-2026-66066: Patch Isn't Enough
CVE-2026-66066 lets an unauthenticated upload read server files via Active Storage. Patching Rails is not enough - libvips must go to 8.13 and secrets rotate.
· JetThoughts
Slopsquatting: The 2025 Supply-Chain Attack
AI assistants suggested 200+ package names that did not exist. Attackers registered them. Your $34K MVP pulled malware. The CI gate that stops it cold.
· JetThoughts Team
Rails CVE-2026-41316: Detection and Patch
CVSS 8.1 universal RCE chain through ERB::DeprecatedInstanceVariableProxy and Marshal.load. Detection, upgrade path, Rails 7.0/7.1 EOL options.
· JetThoughts
9 Seconds: An AI Agent Wiped a Live SaaS
On April 25, 2026, an AI coding agent at PocketOS deleted the production database and its on-volume backups in 9 seconds. Here's what your dev shop should learn.
· JetThoughts
Rails has_secure_password With Argon2: Moving Off BCrypt
Step-by-step guide to enabling Argon2 with has_secure_password in Rails. Migrate from BCrypt with zero downtime using the Hybrid Verifier pattern in production.
· JetThoughts TeamTell us what you need built