Things I build, break, fix, and write about

12 October 2026
Weekly Tech Digest | 12 Oct 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

28 September 2026
Removed SSRF beta detections in Cloudflare WAF

Cloudflare WAF Managed Rules have a habit of changing underneath you, and old SSRF names can linger long after the protection has gone. I prefer to...

28 September 2026
Weekly Tech Digest | 28 Sep 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's...

27 September 2026
Cloudflare WAF metadata changes for WordPress XSS

Cloudflare WAF WordPress XSS detection now has a cleaner CVE label, but the behaviour has not changed; the rule still blocks the same traffic, just...

Latest blog posts you might like

25 August 2026
Patching TrueConf Server 5.3.x before 5.3.9

An exposed TrueConf server is not just a nuisance, it can become a delivery point for poisoned client installers. I would patch first, then check every file it has been serving, because TrueConf...

25 August 2026
Sandboxing agentic AI to block unsafe web actions

Sandboxing agentic AI is less about the model than the exits. If frontier AI evaluations can browse, submit or copy data, the only thing between a test run and a mess is the permission boundary, and I...

24 August 2026
Testing frontier AI for sensitive data handling

frontier AI evaluations are easy to get wrong when the model only sees tidy prompts and harmless files. I care more about where the data ends up, in logs, caches, memory, or a tool call, because that...

23 August 2026
Testing agent boundaries before tool access widens

Frontier AI evaluations are only useful if they fail in the right places. If a model can keep itself safe until the last gate, then the gate is doing the work, not the model, and I would rather find...

22 August 2026
Skia integration for Rust image decoding

Chromium image codecs are where browser safety gets real, because malformed images arrive before anything else useful has happened. I like the Skia route for that reason; it keeps the ugly parsing...

22 August 2026
Styled output in macOS Terminal can leak data over DNS

macOS Terminal ANSI escape codes are one of those details I keep tripping over, because the wrong sequence can do more than colour text. I like this kind of bug precisely because it is small, ugly,...

21 August 2026
Tool boundaries in incident response for AI agents

When an autonomous AI intrusion lands, I care less about the model’s output and more about whether my tools still work. If a hosted service refuses the forensic workload, your response path is already...

21 August 2026
Flatpak pipewire escape through module loading

Flatpak PipeWire sandbox escape sounds tidy until you look at the PulseAudio path properly, where a length check passes for authentication and module loading stays open. Give a Flatpak...

20 August 2026
Founder-led startups and the cost of replacing generalists

AI can make founder-led startups look busier than they are, which is exactly why I distrust it when the team is already thin. The easy wins are real, but once you remove the generalist, you often...

20 August 2026
RCU and refcount faults in Linux kernel net/sched

RCU and refcount faults in the Linux kernel net/sched path are the sort of bug I like least, because the refcount check arrives after the damage is already done. On a busy CentOS 9 box, the race is...