Operations | Monitoring | ITSM | DevOps | Cloud

On October 20th, 2026, the PHP Security Team issued an advanced notice and security advisory disclosing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS v4.0 9.2, affecting PHP installations.

On September 4, Rapid7 Labs published research on a Linux espionage toolkit found at two organizations in South Korea. The centerpiece is a backdoor the researchers call "Ted," which was hidden inside a modified HAProxy build running on the victims' load balancers. Rapid7 attributes the campaign to North Korean state-sponsored actors with medium confidence. The same toolkit tampered with multiple tools across the victims' systems, including an SSH keylogger.

The U.S. government has cataloged over 1,700 active AI use cases, and nearly 90% of federal agencies are already using or planning to use AI. The European Commission has disclosed nearly 1,500 AI use cases across EU member states. With over 3,200 combined AI use cases cataloged across the US and EU, public sector IT leaders face an identical roadblock: traditional application delivery controllers were not designed to parse or throttle Layer 7 LLM payloads, leading to backend GPU exhaustion.

Black Hat USA 2026 brought more than 20,000 people to Mandalay Bay in Las Vegas. We were there as a Platinum sponsor at booth 4208, and across two days on the business hall floor we had more than 750 conversations with security engineers and architects. Almost every one of them, whatever it started as, turned into a version of the same question: how do I know? How do I know whether a vendor's AI does what the banner says? How do I know what my agents are doing on the network?

Every time a client connects to your server, a small negotiation happens before a single byte of application data moves. That negotiation, the TLS handshake, is what makes encrypted web traffic possible. It's also at risk of being recorded. Not the content of your sessions, but the handshake itself. And that's enough. A well-resourced attacker doesn't need to break your encryption today.

Liftoff, a mobile advertising company, processes 1.5 trillion bid requests every month. Their platform touches 275 million unique devices daily across 150 geographies. At that scale, the proxy layer is a core part of the business. For years, Liftoff relied on a managed enterprise proxy vendor. It worked, until it didn’t.

Across two AWS Summit events in London and New York City, we had the chance to speak with more than 1,000 engineers. They came from startups building their first production stack, and enterprises managing large AWS and multi-cloud deployments. The energy was exactly what you'd expect: major AWS launches, dozens of new service announcements, wall-to-wall cloud conversations. And HAProxy right in the middle of it.

Clover’s platform handles more than just payments: inventory, employee management, online sales, and customer loyalty programs are all running on a single monolith called the Clover Operating System (COS). Releasing updates to that platform reliably and without disrupting merchants is one of the hardest operational problems a platform team can face. For a decade, Clover ran HAProxy at the center of its infrastructure.

On June 2, 2026, security researchers disclosed a remote denial-of-service (DoS) exploit named the HTTP/2 Bomb. This flaw allows unauthenticated remote attackers to rapidly exhaust server memory, rendering major web servers inaccessible.

HAProxy 3.4 is a milestone release that significantly advances HAProxy’s legendary flexibility, performance, security, reliability, and observability. Dynamic backend management simplifies integration with modern architectures, memory efficiency improves across a broader range of workloads, native cryptographic operations at the proxy layer open new possibilities for API security architectures, and OpenTelemetry support makes HAProxy a first-class participant in distributed tracing pipelines.