Daily research notes on sovereign cloud, community infrastructure, and the tools that make it real.
Kube3 — eight universities in Baden-Württemberg, Bavaria, and North Rhine-Westphalia building shared Kubernetes-as-a-Service so small IT teams stop having...
In March 2026 Germany's IT-Planungsrat made the Sovereign Cloud Stack standards binding across every level of German public administration — over 50 named...
A June 2026 Connect Humanity study of Brazil's 11,853 small ISPs found that free and open source software is already the default operating choice for...
CERT Polska confirmed active exploitation of a MikroTik RouterOS chain — CVE-2026-67276 (SSH authentication bypass) plus CVE-2026-86060 (crafted-username...
Gitea 1.27.3 (August 29) fixes 26 CVEs in a single patch release — three of them bypasses of the fork pull-request approval gate, the exact control this...
On September 8, Palantir named Nebius its "preferred sovereign AI infrastructure partner" and promised to bring Nebius compute "inside the Palantir...
California's legislature closed its session on August 31 and sent Governor Newsom six privacy and AI bills, including SB 690 — CIPA reform that would strip...
Mastodon 4.7.1 (September 1) fixed three security holes backported across every maintained branch. The headline bug is blunt: on servers using LDAP, PAM, or...
On June 29 the US Supreme Court held the FTC's independence unconstitutional. The EU's adequacy decision relies on that independence 259 times. The decision...
On August 19, Keycloak 26.7.2 fixed the password-reset account takeover this site called upgrade-immediately urgent. Twelve days later, 26.7.3 shipped fixes...
On September 1, Proxmox published PSA-2026-00043-1: a single HTTP request — no password, no second factor — mints a full root@pam ticket on Proxmox VE 7.0...
Belgium's BEAM messenger — built for roughly 750,000 civil servants and military — is a fork of Element's AGPL-licensed Matrix stack, and BSC published its...
Meta's DMA-mandated third-party chats are finally reaching general Android builds — announced November 2025, two niche partners, one-on-one chats only,...
On July 9, the European Parliament reversed its own March rejection and extended the ePrivacy derogation — the legal cover that lets platforms scan private...
FITKO — Germany's Federal IT Cooperation — is piloting Neo, a Matrix-based communication infrastructure for government-to-citizen (G2C) exchanges....
Mecklenburg-Vorpommern is replacing Microsoft SharePoint with a self-hosted Nextcloud deployment running on AGPLv3 software. 5,000 public-sector workers are...
Bill C-22 compels interception capability. Bill C-36 reformulates privacy obligations. Bill C-34, the Safe Social Media Act, is the third leg: it creates a...
Keycloak 26.7.2, released August 19, fixes CVE-2026-18963 — a CVSS 9.1 unauthenticated account takeover via password reset state validation bypass. An...
Canada's federal private-sector privacy law has been PIPEDA since 2000 — a law written before smartphones, social media, and modern data brokering. Bill...
NYC Mesh received $898,000 from New York State to expand its volunteer-run mesh network into Central Brooklyn, where 25% of households lack internet access....
In September 2026, two incident reporting regimes land within weeks of each other. The EU Cyber Resilience Act's vulnerability reporting obligations take...
In 2016 Microsoft built Azure Germany — a sovereign cloud where Deutsche Telekom held the keys and Microsoft's own staff couldn't get in. It was the most...
Proxmox VE 8.4 receives its last security updates in August 2026. The upgrade path to 9.x runs through pve8to9, and 9.2 is the version worth landing on —...
Nextcloud Hub 26 Spring shipped Euro-Office 1.0 on June 9 — a browser-based office suite built on a clean-room OOXML implementation by a European tech...
On July 23, 2026, India's cybercrime agency gave GitHub three hours to remove three BitChat repositories. The notice named no illegal content — it targeted...
On June 15, 2026, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act. If enacted, it replaces PIPEDA — Canada's...
AWS spent €7.8 billion building a "European Sovereign Cloud" in Brandenburg — a German GmbH with EU staff, euro billing, and separate certificates. It's...
On June 12, 2026, the US government ordered Anthropic to cut off foreign access to Claude Fable 5 and Mythos 5. Anthropic couldn't verify nationality in...
OpenStack 2026.1 (Gazpacho) shipped April 1 — the 33rd release from a community of 500 contributors across 100 organizations delivering 9,000 code changes....
On July 17, the Hoopa Valley Public Utilities District opened a data center on tribal land in Humboldt County, California. The facility houses the...
On August 12, researchers confirmed active exploitation of CVE-2026-59310 — a CVSS 9.8 directory traversal in VMware vCenter's Syslog server. APT actors...
On August 2, 2026, Article 50 of the EU AI Act became enforceable. The high-risk obligations got delayed to December 2027 — but transparency, GPAI...
FOSSY 2026 ended August 9 in Vancouver. The Software Freedom Conservancy's fourth annual conference surfaced three themes that matter for community...
On August 5, five teams in the Rust project adopted a policy governing LLM use in contributions to rust-lang/rust. The line is narrow and specific: LLMs are...
As of August 2026, 19 US states have comprehensive consumer privacy laws. There is no federal privacy law. Three new state laws took effect January 1...
Oracle is halving its Always Free ARM tier on August 18 — 4 OCPU / 24 GB becomes 2 OCPU / 12 GB, and anything over the new limit gets terminated...
Proxmox VE 9.2 shipped official Arm64 support on August 5 — full feature parity across KVM, LXC, ZFS, and Ceph, best-effort on UEFI-based ARMv8 hardware,...
Shared Services Canada's 2026-27 Departmental Plan names "Digital Sovereignty" as one of three key priorities. $2.36 billion in planned spending. A...
Keycloak 26.7 shipped SCIM user provisioning, Shared Signals Framework for real-time security events, AuthZen for standardized authorization, MCP...
The enterprise security market is shaped by two interlocking gatekeeping systems — analyst rankings and compliance certifications — that often reward...
On September 11, 2026, the EU Cyber Resilience Act's first compliance deadline lands. Manufacturers of products with digital elements placed on the EU...
A category-by-category inventory of Canadian sovereign cloud infrastructure finds no Canadian CDN, no Canadian DBaaS, no Canadian DNS, no Canadian...
Matrix federation works technically, but most users are on matrix.org. The Homeserver Decentralisation Working Group just graduated to official Foundation...
Matrix 1.19 shipped July 8 with encrypted room history sharing (MSC4268) and custom emoji (MSC2545). Encrypted history sharing was removed five years ago...
On June 29, the US Supreme Court ruled in Trump v. Slaughter that the FTC is not independent of the President. The EU-US Data Privacy Framework relies on...
ITIF published a paper arguing that "control, not sovereignty" is the right frame for cloud policy — that server location and domestic ownership are weak...
Octelium is a FOSS zero-trust access platform that replaces Cloudflare Tunnels, ngrok, and commercial ZTNA with a self-hosted Go binary. AGPL-3.0....
Synapse is in maintenance mode. Dendrite is in maintenance mode. Conduit is archived. Continuwuity — the community fork of conduwuit — shipped v26.6.0 on...
Bill C-22 passed the House of Commons in June. Its definition of "electronic service provider" is broad enough to capture community infrastructure...
The EU's Tech Sovereignty Package puts "autonomy across the cloud stack" into policy. The tools to actually build that autonomy shipped the same quarter....