Things I build, break, fix, and write about

7 November 2026
Prioritising Microsoft Patch Tuesday August 2026

Microsoft Patch Tuesday August 2026 is one of those releases where the order matters more than the headline count. I would patch the exploited flaw first, then the network-facing RCEs, and only then worry about the tidier backlog.

7 November 2026
Brand abuse detection for checkout page impersonation

Checkout impersonation is often cleaner than people expect, and that is the problem. Once a phishing framework starts swapping content at runtime, the...

7 November 2026
Security Advisory – 07 Nov 2026

Daily security advisory summary for 07 Nov 2026

6 November 2026
SMS lures and exploit trends in triage

SMS lures tell you more than the brand name ever will, and the same goes for threat intelligence newsletters if you read past the noise. I care less...

Latest blog posts you might like

3 June 2026
F_SETPIPE_SZ and soft page quota effects

Soft page quota effects are easy to miss, until a pipe that should be 65536 bytes turns up at 8192 and your spray no longer lands where you expected. I have seen pipe_buffer capacity limits quietly...

3 June 2026
Public GitHub leaked AWS GovCloud credentials

A public GitHub repository should not have been holding AWS GovCloud credentials, yet there they were, alongside backups, passwords and internal deployment files. I spent too long on the dull bit,...

2 June 2026
Audit RFI history offline with CSV export

Cloudflare Security Center CSV export is one of those dull features that matters once you need a clean paper trail. I prefer the file on disk, where I can sort it, cross-check it, and stop relying on...

2 June 2026
React Server Components DoS patterns and WAF limits

Some Next.js Server Components vulnerabilities are crude enough for a WAF to catch, but the awkward ones sit in routing, cache behaviour, and middleware. I prefer patching first, because a broad block...

1 June 2026
Cloudflare WAF rule merges for CVE-2025-53693

Cloudflare is folding a new Sitecore cache poisoning detection into an older Java deserialisation rule, and that is exactly the sort of tidy merge that makes tracking awkward. With Cloudflare WAF rule...

1 June 2026
Cloudflare Managed Ruleset changes in Security Events

Cloudflare Managed Ruleset updates do not always announce themselves politely; the useful clues often turn up first in Security Events. I keep checking there, because a rule can keep the same name...

1 June 2026
Weekly Tech Digest | 01 Jun 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

31 May 2026
CVE-2026-42945: rewrite directive failure mode

nginx rewrite module bugs are the sort I distrust most, because they sit in config that looks harmless until a crafted URI tips it over. I dug through this one and found the usual pattern, stale state...

31 May 2026
Joining R2 Data Catalog tables in R2 SQL

Cloudflare R2 SQL JOINs are useful when the relationship matters more than a single table scan, but I still reach for them with a bit of caution. The syntax is easy enough; the awkward part is keeping...

30 May 2026
Cloudflare Tunnel for local webhook previews

Cloudflare Tunnel is one of those tools I only appreciate after fighting without it. For local webhook previews, a stable hostname matters more than a tidy demo link, and once you need that fixed...