How to Set Up a Private Droplet and Bastion Host with Cloud Firewalls

Run Codex in the cloud – DigitalOcean for Codex is now available

DigitalOcean giới thiệu plugin Codex Public Preview, cho phép nhà phát triển tạo Droplet (máy ảo đám mây) trực tiếp từ OpenAI Codex bằng ngôn ngữ tự nhiên. Plugin tự động cấu hình môi trường với Codex CLI, công cụ ngôn ngữ phổ biến, SSH keys và trả về liên kết truy cập, giúp quản lý dự án, cài đặt phụ thuộc, điều khiển máy ảo hay theo dõi tác vụ agent từ ứng dụng ChatGPT di động.

Là lập trình viên muốn tiết kiệm thời gian và công sức thiết lập môi trường phát triển trên cloud mà vẫn có thể sử dụng AI hỗ trợ như Codex mà không phải lo về cấu hình thủ công.

libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface

A critical heap overflow vulnerability (CVE-2026-55200, CVSS 9.8) in libssh2 allows a malicious SSH server to exploit connecting clients before authentication, with no credentials required. The flaw in ssh2_transport_read() involves a 32-bit integer wrap that shrinks a heap allocation to as little as 19 bytes, enabling a full payload write into that buffer. A public PoC dropped June 29, but no official tagged release includes the upstream fix (merged June 12). Debian has patched trixie and sid; Ubuntu and other distros are still evaluating. Embedded systems and appliances may wait months for firmware updates. The broader concern is that outbound SSH clients — curl, Git, PHP's SSH extension, CI runners, backup tools — are widely trusted but systematically underpatched because developers don't think of them as attack surfaces. Mitigation involves applying distro patches or cherry-picking commits 97acf3d and 1762685 from upstream.

SSH Connections Are Moving to JetBrains Daemon in the Toolbox App 3.6 EAP

JetBrains Toolbox App 3.6 EAP introduces a change where SSH connections to remote environments now use the JetBrains Daemon (jetbrainsd) by default. This shift makes jetbrainsd a shared background service for JetBrains tools, aiming to improve reliability and reduce dependency on Toolbox-App-specific implementation. Users experiencing issues can disable the new SSH client via settings or revert to the stable release, and are encouraged to file bug reports with logs attached.

Multi-Model API Cost Governance with the Inference Router

DigitalOcean's Inference Router (part of Inference Engine, public preview since April 2026) lets you route LLM API calls to different models based on task complexity, reducing inference costs without changing application code. The tutorial builds a three-path router for a SaaS support backend: a cheap classifier path using openai-gpt-oss-20b, a quality-sensitive Q&A path using Claude Sonnet 4.6 with Manual Ranking, and a reasoning path using GPT-5. All paths are invoked via a single OpenAI-compatible endpoint. Per-request cost signals are readable from response headers. At a traffic split of 700K classify, 250K Q&A, and 50K reasoning requests/month, the routed setup costs $2,850/month vs. $4,716 for a hardcoded Claude Sonnet 4.6 baseline — a 39.6% saving. The tutorial also covers session pinning with X-Model-Affinity for KV-cache warmth across multi-turn conversations, observability via the Analyze dashboard, and common troubleshooting scenarios including credential team mismatches and reasoning token budget issues.