Writing
Blog posts covering application security, infrastructure hardening, vulnerabilities, and incident response.
Latest Post
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146) — the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
The sequel to CopyFail: DirtyFrag extends the CVE-2026-31431 exploit chain to container escape. Covers the new attack surface, detection, and mitigations beyond the algif_aead workaround.
CVE-2026-31431 is a Linux kernel local privilege escalation via algif_aead. Covers exploit mechanics, detection, the algif_aead mitigation, and patch status across Ubuntu, Fedora, Debian, RHEL, and more.
How GitHub accidentally leaked webhook secrets via an erroneous HTTP header, what data was exposed, and the exact steps to rotate your secrets now.
Deep dive into the Magento 2 Polyshell remote code execution vulnerability — how it works, how to test if you're affected, and how to apply the patch.
Adobe's new monthly isolated patch approach for Magento creates maintenance burden. Here's how a community meta-package can help restore sanity to security patching.