Things I build, break, fix, and write about

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with rented services can do plenty of damage, so I watch for early signs, not familiar names, and I patch anything exposed before the attackers get bored.

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

4 November 2026
Linux kernel net/sched UAF constraints on CentOS 9 desktop

Linux kernel net/sched use-after-free looks messy on paper, and on CentOS 9 Desktop it is worse, because the obvious paths are blocked and the useful...

4 November 2026
AI-assisted pull requests raise review cost

AI-assisted pull requests look cheap until you try to review them properly. I’ve seen tidy code hide a lot of work, and the cost only goes up when a...

Latest blog posts you might like

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with rented services can do plenty of damage, so I watch...

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

4 November 2026
Linux kernel net/sched UAF constraints on CentOS 9 desktop

Linux kernel net/sched use-after-free looks messy on paper, and on CentOS 9 Desktop it is worse, because the obvious paths are blocked and the useful ones are just awkward enough to miss. I would not...

4 November 2026
AI-assisted pull requests raise review cost

AI-assisted pull requests look cheap until you try to review them properly. I’ve seen tidy code hide a lot of work, and the cost only goes up when a project has to strip it back, rework it, or unwind...

4 November 2026
Security Advisory – 04 Nov 2026

Daily security advisory summary for 04 Nov 2026

3 November 2026
ionCube Loader: offline PHP bytecode decryption

ionCube Loader is not magic, just a native PHP extension with a very hard boundary. Once you trace the entrypoint and the key derivation properly, the supposed mystery turns into a pile of exacting...

3 November 2026
ICC profile retention limits HEIC cleanup in mat2

mat2 HEIC support is useful, but only up to a point. Once an embedded ICC profile shows up, the cleaner stops short, and you are left with a partial scrub rather than the tidy wipe I wanted.

3 November 2026
Security Advisory – 03 Nov 2026

Daily security advisory summary for 03 Nov 2026

2 November 2026
Testing Microsoft updates before production rollout

Microsoft August Patch Cycle is not the bit to trust on faith, especially when afd.sys and the User Profile Service are in play. I patch the ugly, real endpoints first, because clean lab images rarely...

2 November 2026
Security Advisory – 02 Nov 2026

Daily security advisory summary for 02 Nov 2026