The LinkLoot Blog

6/28/2026 5 min

Use Cloudflare PACT to prepare for a web with fewer CAPTCHAs

Cloudflare, Mozilla, Google, Microsoft, and Shopify are developing Private Access Control Tokens, a privacy-preserving way for sites to distinguish legitimate visitors and authorized agents from abusive automated traffic.

Restrict Copilot plugin installs before agent tools reach production

GitHub added strictKnownMarketplaces for Copilot CLI and VS Code, giving enterprises a public-preview control for approved plugin marketplaces before users connect agent tools.

Use GitHub Desktop 3.6 to keep agent branches out of each other's way

GitHub Desktop 3.6 adds Git worktrees, Copilot-assisted merge conflict resolution, repo-aware commit messages, model choice, and BYOK support for developer workflows that already rely on parallel branches and coding agents.

6/28/2026 5 min

Harden Ghost sites: Cloudflare WAF now blocks the CVE-2026-26980 SQL injection path

Cloudflare added managed WAF protection for Ghost CMS CVE-2026-26980, a critical Content API SQL injection fixed in Ghost 6.19.1. Patch first, then use edge rules as a mitigation layer.

Patch Node.js now: June security releases fix TLS, WebCrypto, HTTP/2, and permission flaws

Node.js published June 2026 security releases for 22.x, 24.x, and 26.x, including two high-severity issues and several medium and low flaws.