Operating open source in production, data sovereignty in Switzerland and the EU, and private AI inside your own perimeter.
7 November 2026
CVE-2026-98432 patch: four clocks from kernel fix to your server
The CVE-2026-98432 patch reached Debian in a day and RHEL in 17 days; Ubuntu's is in -updates with no notice yet. The four clocks and what to do by when.
6 November 2026
vSphere 8 end of support in Switzerland: 11 October 2027 holds
vSphere 8 end of support stays 11 October 2027 in Switzerland: Broadcom's extension to 2028 covers the EEA only. The renewal options and a dated exit plan.
4 November 2026
Self-hosted LLM cost: what Revolut's bill does and does not prove
Revolut puts its self-hosted LLM cost at 30 cents per million tokens and its bill at a tenth of what it paid before. What that proves and what sets the cost.
3 November 2026
Microsoft 365 exit cost: what the Swiss study really says
A Swiss study puts the Microsoft 365 exit cost at CHF 9m to 30m or more one-off, led by training time, with running costs about the same. How to go gradually.
29 October 2026
Google Cloud London outage: what it means for your exit plan
The Google Cloud London outage of 20 October 2026 lasted 6 hours 8 minutes. What the final report shows, what DORA and FINMA require, and how to test an exit.
27 October 2026
eMudhra CA compromise: what servers and images still trust
eMudhra CA compromise: Chrome and Firefox blocked the keys on 17 October 2026; servers, runtimes and images trust them until rebuilt. What to check, by when.
24 October 2026
openDesk partners and Open Productivity: who will run the suite
The openDesk partner programme and Open Productivity Software GmbH change who runs the suite. What the terms mean for Swiss and EU buyers, and what to do.
24 October 2026
PHP2Shell: the fix shipped on 21 October. Is it on your servers?
PHP2Shell (CVE-2026-109618, CVE-2026-109619) was fixed on 21 October 2026. Patch or isolate exposed PHP, rebuild images, restart workers and keep the evidence.
23 October 2026
Cour des comptes on Microsoft: office costs per workstation
Cour des comptes on Microsoft: EUR 87 a workstation a year on office tools; open-source cloud tools could avoid EUR 130 million a year against Microsoft 365.
23 October 2026
Geneva votes for an open-source pilot: what it needs to survive
On 1 October 2026, the Geneva parliament asked for an open-source pilot in public administration. How to design one that ends in a decision, not a quiet stop.
22 October 2026
Data Act switching charges end on 12 January 2027: what to check
Data Act switching charges, egress included, end on 12 January 2027. What the ban covers, what it leaves out and what to check in cloud contracts before then.
22 October 2026
EFK audit: a Microsoft 365 backup independent of Microsoft
Microsoft 365 backup in Switzerland: the EFK found the federal stopgap depended on Microsoft. What a restore without the vendor needs, and what to check.
21 October 2026
Swiss Government Cloud tender: what the three lots tell buyers
The Swiss Government Cloud tender buys three sovereignty tiers over 14 years. What each lot requires, the dates to 2027 and how to tier your own workloads now.
13 October 2026
Atlassian price increase October 2026 and the end of Data Center
Atlassian price increase October 2026: partners report 7-10% on Jira and Confluence, overages on most meters bill from 3 December, and Data Center ends in 2029.
12 October 2026
US sanctions on the ICC: what they mean for your cloud services
ICC sanctions and cloud services: what the OFAC licences of 9 October 2026 allow, what ends on 7 April 2027, and why EU hosting does not change who decides.
9 October 2026
Microsoft 365 data residency in Switzerland from 14 December 2026
Microsoft 365 data residency in Switzerland rests on one admin setting: left Off, data may move to EU/EFTA storage from 14 December 2026. Decide before then.
8 October 2026
The Swiss federal open-source workplace, next to Microsoft 365
The Swiss federal government plans an open-source workplace beside Microsoft 365 from the end of 2027. What the pilot found and what a parallel setup needs.
6 October 2026
CRA reporting obligations: what to ask your software suppliers
Cyber Resilience Act (CRA) reporting obligations have applied since 11 September 2026, with no fixed deadline to tell customers. What to ask suppliers and when.
1 October 2026
Swiss Cybersecurity Act: what is coming for cloud providers
Swiss Cybersecurity Act: a draft is due by June 2027, but Swiss cloud providers already face a 24-hour reporting duty. What is planned and what to ask now.
24 September 2026
Private AI: what stays inside your perimeter and what does not
Private AI keeps prompts and documents on machines you control, but some traffic still crosses the boundary. An honest map of what stays inside and what leaves.
22 September 2026
AI Act 2 December 2026: the dates that bind deployers
On 2 December 2026 the AI Act adds two bans and ends a marking grace period for older generative AI. Article 50 deployer duties apply; high-risk starts in 2027.
17 September 2026
EMBAG and open source in the Swiss federal administration
What the EMBAG requires on open-source software in the Swiss federal administration, what it does not, and what it means for running the software.
10 September 2026
A backup is not a backup until you have restored it
Why a successful backup job proves little, what a real restore test checks, and how monthly restore tests turn recovery from a hope into a record.
What we write about
The blog is where we write down what operating open source for other organisations teaches us. Three subjects keep coming back: what it takes to run an app in production for years rather than deploy it once, what data sovereignty means in Swiss and EU law rather than in a sales deck, and what private AI keeps inside your perimeter and what it does not.
The articles are for the people who make the decision and the people who live with it afterwards: heads of IT, security and data protection officers, and the engineers who will be on call for the result. Each one is meant to be forwarded, so it says what it means, names the trade-off, and leaves out the adjectives.
For a longer read on a single question, the guides go further. For a move off a specific SaaS, the migration guides go step by step. And to see what we operate rather than what we write about, start with the apps.
Tell us what you need to run.
Thirty minutes with an engineer, a written plan and a fixed price for the first workload.