Things I build, break, fix, and write about

7 November 2026
Prioritising Microsoft Patch Tuesday August 2026

Microsoft Patch Tuesday August 2026 is one of those releases where the order matters more than the headline count. I would patch the exploited flaw first, then the network-facing RCEs, and only then worry about the tidier backlog.

7 November 2026
Brand abuse detection for checkout page impersonation

Checkout impersonation is often cleaner than people expect, and that is the problem. Once a phishing framework starts swapping content at runtime, the...

7 November 2026
Security Advisory – 07 Nov 2026

Daily security advisory summary for 07 Nov 2026

6 November 2026
SMS lures and exploit trends in triage

SMS lures tell you more than the brand name ever will, and the same goes for threat intelligence newsletters if you read past the noise. I care less...

Latest blog posts you might like

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not proved consent, you have just accepted a tuple and...

14 September 2026
Chaining logic bugs in Microsoft Edge sandbox escape

Microsoft Edge sandbox escape chains do not need memory corruption if the trust checks are loose enough. Orange Tsai’s Pwn2Own chain was nasty precisely because each bug looked small, then the browser...

14 September 2026
Runtime guardrails for multi-agent reproduction

Multi-agent reproduction is useful until state leaks make a neat-looking result lie for you. I prefer hard runtime boundaries, separate containers, and a patched build kept out of reach until...

14 September 2026
Weekly Tech Digest | 14 Sep 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

13 September 2026
Tracing ransomware detection gaps in incident response

Ransomware rarely announces the whole story at once; the ugly part is the quiet between alerts, when EDR stops at the first host and logs age out. I keep coming back to ransomware detection gaps,...

13 September 2026
Prompt logs on compromised endpoints in Claude Code

Prompt logs on a compromised machine tell a better story than the final code ever will. I trust those scraps more than polished output; they show how cloud AI coding assistants were pushed, where they...

12 September 2026
Monitoring priorities after AI agent sandbox escapes

When an agent slips its cage, the first mistake is pretending the tidy report will do. I’d keep the raw prompt logs, session artefacts, and every trace I can get hold of, then rebuild the AI sandbox...

12 September 2026
Lateral movement risks inside operational technology

Operational technology network segmentation is often where the good intentions stop and habit takes over. I’ve seen enough flat OT layouts to know that once one workstation falls, the rest of the...

11 September 2026
URLPattern out-of-bounds read in workerd

Cloudflare workerd memory corruption is the sort of bug I dislike most, because the JavaScript looks fine while the C++ glue quietly wanders off the edge. If you run Workers or Code Mode, patching is...

11 September 2026
Hardening PHP YAML parsing against untrusted input

The Symfony YAML component is tidy until you point hostile input at it. I am more interested in the bits that fall over, recurse until PHP gives up, or wander into object handling, because those are...