Two weeks of madness pulling together 12k+ student environments are now over, at least for 2026. IBM TechXchange Atlanta wrapped up and Posse with IBM Bob was a lifesaver. The main things I used the Posse for was quick updates on the Lab Builder tool, a tracker I had built to interface and correlate data between our event database and our main working platform, IBM TechZone.
Another big win was a whole lot of powershell to manage the lab machines, which were windows and so I had the posse write a whole bunch of powershell for setup, resets and a scheduled reset system which more or less worked great. And who wants to write Powershell? not me.
We had some other side projects, including a quick update of the runtime to use IBM Bob On-premise which is a nemotron model using our own internal inferencing stack. This worked great, and I was able to use the posse without the usual limits to add not only completed labs, but deprovisioning as well.
After the event was over, we setup the posse to clean the lab guides for post-event use, and then used the lab builder tool to determine what if any environments needed deprovisioning.
Almost all of this is leveraging AI to build deterministic tools ad hoc against anchoring data sets. Almost all because there were some one off questions that werent captured in the tool and rather than update the tool with a whole build, when I knew I had the data, I call this now an ad hoc and have the chief of staff, get a quick answer from available data.
Event Takeaways
I ran out of my allotment of tokens, and being able to use an internal inferencing stack is a huge unlock.
Having the harness/chief of staff model works. I have built up enough trust in the multi-agent harness to run between 2-3 running projects at once, without losing track. It takes a toll, but very doable. I havent tried to push beyond this, as with 2-3 I do have to keep refocusing and chatting with the Chief of staff.
Beads or some kind of issue tracking is an absolute must, this is the project anchor and keeps everything regularized without mission drift. You will need to prune and compact orders from time to time, and thats what I’ll be working on next.
What I didnt do was setup a cloud sandbox or local box with tailscale, still running everything with Herdr and running around with an open laptop like it was still early 2026. Ran out of time was only excuse.
Black October
Of course while all this was going on at IBM, we had a little bit of madness last couple of weeks.
PHP2Shell (CVE-2026-109618, CVE-2026-109619). On October 21, PHP shipped emergency fixes for two remote-code-execution flaws, both rated CVSS 9.2, in a language that runs about 70% of websites.
Brotli / “Node2Shell” (CVE-2026-111497). OpenAI’s Codex Security team found an out-of-bounds write in Brotli, the compression library behind much of the web’s traffic. The upstream fix had sat in public for about eight months before anyone flagged it as a security issue. The patches:
Firefox 159: 167 fixes in one 27 release patched 167vulnerabilities, 108 of them rated high. OpenAI’s Codex Security is credited with 34,
Bitcoin Core: an AI-speed disclosure policy. On October 28, Bitcoin Core disclosed three bugs, two of them found by Procanner.
Industrial control in under four hours. An autonomous agent called Cipher, from Causal Security, found four new bugs in EPICS, the control toolkit used at particle accelerators and fusion labs. One of them is a critical remote-code-execution bug. Finding all four and validating the exploits took 3 hours and 49 minutes.
Whats next?
Getting my tailscale environment up and running.
Finally got access to Rex (from Superlogical) so soon the posse will be able to work in either Rex or herdr.dev.
Overhaul of the Ranger360.ai site,
And hopefully some more work and client real world projects.