Things I build, break, fix, and write about

8 November 2026
Security Advisory – 08 Nov 2026

Daily security advisory summary for 08 Nov 2026

7 November 2026
Prioritising Microsoft Patch Tuesday August 2026

Microsoft Patch Tuesday August 2026 is one of those releases where the order matters more than the headline count. I would patch the exploited flaw...

7 November 2026
Brand abuse detection for checkout page impersonation

Checkout impersonation is often cleaner than people expect, and that is the problem. Once a phishing framework starts swapping content at runtime, the...

7 November 2026
Security Advisory – 07 Nov 2026

Daily security advisory summary for 07 Nov 2026

Latest blog posts you might like

6 September 2026
Cloudflare WAF rules for Nuxt Server Islands

Cloudflare’s new WAF coverage is useful, but it is still just a filter in front of broken software. I care less about the headline and more about whether Cloudflare WAF rules for Nuxt Server Islands...

6 September 2026
Cloudflare WAF scheduled release: rule ID changes

Cloudflare WAF scheduled release is mostly about rule IDs, and that is where the mess starts. The traffic may not change much, but the logs, suppressions, and reports will. I have seen enough of these...

5 September 2026
Blocking CVE-2026-50522 with Cloudflare WAF Managed Rules

Cloudflare WAF Managed Rules have changed in ways that matter, and I would not trust old labels to tell the full story. The SharePoint RCE rule now blocks by default, while some SSRF entries have...

5 September 2026
Public endpoints on search.ai.cloudflare.com

Cloudflare AI Search starts useful and gets messy the moment the endpoint escapes into logs, browser history, and stale config. I prefer a custom domain and Access in front of it, because public...

4 September 2026
Reading upstream diversity in Cloudflare Radar

Cloudflare Radar AS routing looks tidy until you remember it is built from observed BGP paths, not the whole internet. I trust it most when a chart looks awkward, because that is usually where the...

3 September 2026
Sidecar deployment using cloudflare/mesh in a Pod

I prefer keeping the Cloudflare Mesh container image beside the app, not baked into it. The Pod stays clean, the app stays ignorant, and the irritating bit lives where it can be replaced without...

3 September 2026
Cloudflare AI Gateway unified billing and limits

Cloudflare AI Gateway unified billing is one of those settings that looks minor until the bill starts moving in a different direction. I’ve seen enough homelab nonsense to know the boring controls...

2 September 2026
AI governance boundaries in product organisations

Google DeepMind is a useful place to watch when product pressure meets safety theatre. The interesting bit is not the model release, but who has the nerve, and the authority, to say no when the...

2 September 2026
Token budgeting for agent state in Go

I prefer a Go standard library context engine when the token limit matters, because it forces the awkward bit up front, before the prompt is stitched together. Get the ranking wrong and you do not...

1 September 2026
Privacy boundaries when AI touches government records

AI governance gets awkward fast when government records are involved, because the model is rarely the problem. The problem is the sloppy boundary around it, the sort I have seen quietly turn a...