Things I build, break, fix, and write about

6 November 2026
Security Advisory – 06 Nov 2026

Daily security advisory summary for 06 Nov 2026

5 November 2026
Embedded payloads in trojanised PDF viewers

Modified PDF viewers are a neat little delivery trick because they look like ordinary job bait until someone opens them. I keep coming back to the...

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with...

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

Latest blog posts you might like

6 November 2026
Security Advisory – 06 Nov 2026

Daily security advisory summary for 06 Nov 2026

5 November 2026
Embedded payloads in trojanised PDF viewers

Modified PDF viewers are a neat little delivery trick because they look like ordinary job bait until someone opens them. I keep coming back to the same point, the file name is not the danger, the...

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with rented services can do plenty of damage, so I watch...

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

4 November 2026
Linux kernel net/sched UAF constraints on CentOS 9 desktop

Linux kernel net/sched use-after-free looks messy on paper, and on CentOS 9 Desktop it is worse, because the obvious paths are blocked and the useful ones are just awkward enough to miss. I would not...

4 November 2026
AI-assisted pull requests raise review cost

AI-assisted pull requests look cheap until you try to review them properly. I’ve seen tidy code hide a lot of work, and the cost only goes up when a project has to strip it back, rework it, or unwind...

4 November 2026
Security Advisory – 04 Nov 2026

Daily security advisory summary for 04 Nov 2026

3 November 2026
ionCube Loader: offline PHP bytecode decryption

ionCube Loader is not magic, just a native PHP extension with a very hard boundary. Once you trace the entrypoint and the key derivation properly, the supposed mystery turns into a pile of exacting...

3 November 2026
ICC profile retention limits HEIC cleanup in mat2

mat2 HEIC support is useful, but only up to a point. Once an embedded ICC profile shows up, the cleaner stops short, and you are left with a partial scrub rather than the tidy wipe I wanted.

3 November 2026
Security Advisory – 03 Nov 2026

Daily security advisory summary for 03 Nov 2026