Things I build, break, fix, and write about

5 November 2026
Embedded payloads in trojanised PDF viewers

Modified PDF viewers are a neat little delivery trick because they look like ordinary job bait until someone opens them. I keep coming back to the same point, the file name is not the danger, the loader path is; that is where the unwanted code slips in.

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with...

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

4 November 2026
Linux kernel net/sched UAF constraints on CentOS 9 desktop

Linux kernel net/sched use-after-free looks messy on paper, and on CentOS 9 Desktop it is worse, because the obvious paths are blocked and the useful...

Latest blog posts you might like

1 June 2026
Weekly Tech Digest | 01 Jun 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

31 May 2026
CVE-2026-42945: rewrite directive failure mode

nginx rewrite module bugs are the sort I distrust most, because they sit in config that looks harmless until a crafted URI tips it over. I dug through this one and found the usual pattern, stale state...

31 May 2026
Joining R2 Data Catalog tables in R2 SQL

Cloudflare R2 SQL JOINs are useful when the relationship matters more than a single table scan, but I still reach for them with a bit of caution. The syntax is easy enough; the awkward part is keeping...

30 May 2026
Cloudflare Tunnel for local webhook previews

Cloudflare Tunnel is one of those tools I only appreciate after fighting without it. For local webhook previews, a stable hostname matters more than a tidy demo link, and once you need that fixed...

30 May 2026
Cloudflare Artifacts repo-scoped tokens in Wrangler CLI

Cloudflare Artifacts repo-scoped tokens are the bit worth caring about, because they keep Git access tied to one repository instead of a loose account-wide key. I like that. Narrow the boundary, test...

29 May 2026
Cloudflare Radar MRT Explorer in the browser

Cloudflare Radar MRT Explorer keeps the awkward part local, which is usually where it belongs. I prefer that to uploading a route dump to somebody else’s parser and hoping it comes back in one piece.

29 May 2026
Subscribe to repository lifecycle events in Artifacts

Cloudflare Artifacts event subscriptions give you a clean way to react to repository changes without bolting on another watcher. I like that the split between lifecycle and activity events is blunt,...

28 May 2026
Qwen3.7-Max agent workflows with tool bounds

Qwen3.7-Max agent workflows only behave when the tool chain is fenced in, and I trust boundaries more than clever prompts. Let the model read, decide, and draft, but keep secrets, writes, and...

27 May 2026
Browser performance trade-offs for large SVG maps

SVG map rendering looks clean until the DOM grows teeth. I’ve seen a map that felt fine on desktop turn sticky the moment hover, zoom, and labels all started arguing with each other; the file was...

26 May 2026
Indexing prompt injection in search results

Search results are not neutral once retrieval gets involved. I keep seeing prompt injection treated as an edge case, when a single poisoned page can steer an answer if the stack is lazy about source...