Writing
Articles on integrating security into DevOps workflows, covering secure pipelines, tooling, and operational best practices.
Latest Post
Two new Linux kernel LPE exploits (DirtyFrag and Copy Fail 2: Electric Boogaloo) abuse the esp4 and esp6 IPsec modules. Same class of threat as CVE-2026-31431. Here's what Magento operators need to do right now.
CVE-2026-31431 is a straight-line logic flaw in the Linux kernel's AF_ALG crypto API that's been exploitable on every major distro since 2017. Magento hosts are high-priority targets. Here's what you need to do right now.
GitHub accidentally included webhook secrets in HTTP headers between September 2025 and January 2026. Here's what happened, who's affected, and what you need to do about it.
How to guide on checking if your Magento 2 store is safe from the Polyshell vulnerability. And guidance on how to patch and secure your site if it is not.
Learn how to integrate Sansec Ecomscan into Magento 2 CI/CD pipelines to detect malware, enforce security patches, and secure build artifacts. Step-by-step guides for GitHub Actions and Bitbucket Pipelines included.
How to guide on checking if your Magento 2 store is safe from the Session Reaper (CVE-2025-54236) exploit. And guidance on how to patch and secure your site if it is not.
Magento 2 Trojan Orders (CVE-2022-24086) are back, lets talk about how to patch so we are safe. And other identifiers aside from addAfterFilterCallback
A quick and easy two line fix configuration fix for the Polyfill.io Magento 2 Malware
Free validator tool to check if your Magento 2 store is vulnerable to CosmicSting (CVE-2024-34102) — 6,500+ stores tested, 2,300+ found vulnerable. Step-by-step patching guide included.
A simple guide for anonymizing Magento 2 databases in Warden to either pass off to other developers or move forward into staging/ephemeral environments