Go servers on Linux: a kernel fix to check

A Linux security fix Go server owners should check

🟥 SECURITY . Kernel patch · Go security team · 29 October 2026

If you run a Go server on Linux, check the kernel as well as the Go version. The recently disclosed kernel bug can let a remote attacker run code through a vulnerable server. The demonstrated exploit uses Multipath TCP, which Go 1.24 and later enable by default for Linux listeners. The Go team explains why switching that feature off is only a fragile mitigation: the underlying bug also affects ordinary TCP handling. Their recommendation is to update to a patched kernel.

Two HTML fixes in golang.org/x/net

🟥 SECURITY · HTML parsing · Go security team · 27 October 2026

If your application parses or renders HTML with golang.org/x/net/html, check its module version. Version 0.62.0 fixes repeated string copying that could make crafted input increasingly expensive to parse, plus a rendering bug that could change how a browser interprets the output. This is a dependency update, so upgrading the Go compiler alone won't replace the affected module.

Why a small Go heap can still end in an OOM kill

🟦 PERFORMANCE · Container memory · Gulcan Topcu · Learnkube · 6 October 2026 · Catch-up

Your heap graph looks fine, but Kubernetes keeps killing the container. This guide builds that situation with a small Go service, then compares heap use, goroutine stacks, direct memory mappings and the container's own counters. It also shows why GOMEMLIMIT needs room below the container limit: it's a soft target for Go-managed memory, and memory allocated outside the runtime still counts against the container.

What idle HTTP/2 connections cost in memory

🟦 PERFORMANCE · Idle connections · Mohammad Abdolirad · 24 October 2026 · Go 1.28 development build

A quiet connection can still keep a goroutine and its stack alive. Mohammad measures a Go 1.28 development change that lets the HTTP/2 serving goroutine exit and restart when work arrives. With 5,000 idle connections, enabling it reduced resident memory by roughly 39–41% in his tests. He compared the feature on and off in the same build. The results still come from one workload, so savings will vary.

Renew TLS certificates while the Go server keeps running

🟩 OPERATIONS · TLS renewal · Dushed team · 16 October 2026 · Catch-up

The Dushed team wanted certificate renewal inside its Go application. Their short write-up connects the TLS certificate callback to autocert, which obtains and renews certificates, then keeps certificates on disk and in memory so overlapping deployments can share them. It shows the pieces to connect; the full certificate-management implementation is left out.

Build HMAC once to understand what it does

🟪 INTERNALS · HMAC · Karol Moroz · 23 October 2026

What turns a hash into a message authentication code? Karol works through HMAC's two hashing steps, key padding and XOR in Go, starting with published test vectors and a standard-library baseline. The interactive bit diagrams make the formula easier to follow. Treat this as a learning exercise; Go's crypto/hmac remains the implementation to use in an application.

What Go's channels can learn from Concurrent ML

🟪 LANGUAGE DESIGN · Composable channels · Nikhil Marathe · 16 October 2026 · Catch-up

Imagine returning a description of a channel operation from a function, then choosing when to run it. Nikhil uses Concurrent ML's event model, demonstrated in Racket, to show how that separation helps compose communication and cancellation. The examples compare it with Go's channels and select. This is a longer language-design read, with Racket code to work through, rather than a proposed Go feature.

Wails 3.1 tries desktop builds without a C compiler

🟩 TOOLS · Desktop apps · Lea Anthony · 1 November 2026 · Experimental features

Wails pairs a Go backend with a web interface inside the operating system's WebView. Its new experimental macOS and Linux backends remove the C compiler from the build path, while still needing native libraries when the app runs. The release also introduces Wake for common build and packaging choices. CGo remains the default, and packaging and signing have their own requirements.

TinyGo 0.44 moves more work off the device

🟩 TOOLS · Embedded + Wasm · TinyGo team · 29 October 2026

TinyGo now evaluates more initialization work during compilation, leaving less for a small device to do at startup. This release also brings multicore goroutines to the ESP32-S3 and makes WebAssembly's garbage collector scan only the live part of Asyncify stacks. The release notes explain which targets benefit, alongside new board and Bluetooth support.