Writing
Notes on security, infrastructure, software and AI. Written in plain words, from three decades of doing the work.
New
- Security · 27 October 2026
File uploads: the door we keep leaving open
Why “upload a file” is still one of the easiest ways into a web application, and a short checklist that actually holds.
- Infrastructure · 26 October 2026
Put every renewal date in one calendar
Domains, certificates, licences, support contracts and payment cards all expire. Most outages from them are just forgotten dates.
- AI · 23 October 2026
LiteLLM hit again: protect your release pipeline
A malicious LiteLLM release was live for about two hours, published through the project’s own workflow with stolen engineer tokens.
- Software · 22 October 2026
PHP2Shell: update PHP and restart every worker
Two critical bugs in PHP itself allow remote code execution on web servers. Patches are out for 8.2 to 8.5. Older versions need your distribution or an LTS vendor.
- Security · 16 October 2026
BeyondTrust Remote Support was exploited since August
A remote support zero-day was used by suspected espionage actors for weeks before the patch. Self-hosted appliances need patching and checking.
- Software · 14 October 2026
1,413 fixes in one Patch Tuesday
Microsoft’s October update fixes a record number of vulnerabilities, including an exploited Windows Shell bug. Start with that one.
- AI · 8 October 2026
Know what your AI agents did
When an AI agent sends an email or changes a record, you need to be able to see it later. Logging is the boring part that matters.
- Security · 6 October 2026
Phishing tests that teach, not trap
Phishing simulations that shame people make them hide mistakes. Run them to practise reporting, not to catch people out.
- Security · 2 October 2026
FortiMail zero-day: lock down the admin interface
A critical FortiMail bug is being exploited and fixed releases aren’t all out yet. Disable IBE or restrict management access now.
- Security · 29 September 2026
Security awareness month: skip the posters
October is awareness month. Instead of posters and a quiz, do three things that change how people act.
- Infrastructure · 24 September 2026
Wrong clocks break security quietly
Logins, certificates, MFA codes and logs all depend on accurate time. Check that every machine syncs from a reliable source.
- Security · 22 September 2026
When someone leaves: the offboarding checklist
Most access problems start with a departure nobody fully processed. One checklist, run on the last day, fixes it.
- AI · 17 September 2026
Six questions before you buy an AI tool
Every vendor now has AI features. A few direct questions tell you what happens to your data.
- Privacy · 15 September 2026
Email tracking pixels: who knows you opened it?
Most marketing emails, and some personal ones, report when and where you opened them. You can turn most of it off.
- Infrastructure · 10 September 2026
When did you last update your switches?
Routers, switches, access points and NAS boxes run software too, and attackers target them because nobody patches them.
- Software · 8 September 2026
EU Cyber Resilience Act: reporting starts on Friday
From 11 September, makers of software and connected products sold in the EU must report actively exploited vulnerabilities within 24 hours.
- Software · 1 September 2026
Sign your releases so customers can check them
After a year of poisoned packages, being able to prove a release came from your build system is no longer optional.
- Privacy · 27 August 2026
Back to school: set up your kids’ accounts properly
New school year, new apps and logins. Ten minutes of setup protects children’s accounts and the family devices.
- AI · 25 August 2026
AI browsers act with your logged-in sessions
AI browsers and browser agents click around for you, using every site you’re signed into. A malicious page can talk to them.
- Infrastructure · 20 August 2026
DNSSEC: worth turning on?
DNSSEC stops forged DNS answers for your domain. With most DNS providers it’s now one switch. Here’s when it matters.
- Security · 18 August 2026
Give your data warehouse your strongest login
Extortion groups again claim big thefts from cloud data platforms this month, reportedly after phoning staff. Lock those logins down.
- Software · 13 August 2026
Which PHP versions still get security fixes?
PHP 8.1 stopped getting security fixes at the end of 2025, and 8.2 follows this December. Check what your servers run.
- Infrastructure · 11 August 2026
Replace port forwarding with a tunnel
Opening a port on the router puts the service on the whole internet. An outbound tunnel with login in front is safer and often easier.
- Software · 6 August 2026
Path traversal: ../ is still breaking apps
If a filename from the user ends up in a file path, someone will try ../../etc/passwd. Check the final path, not the input.
- Security · 4 August 2026
Stolen sessions skip your MFA
Infostealers grab browser cookies, so attackers log in as you without a password or MFA. Shorter sessions and device checks help.
- Infrastructure · 28 July 2026
The server nobody owns
Every network has a machine that nobody admits to running. It’s usually unpatched, and often the way in.
- Software · 23 July 2026
Rate-limit your login and API endpoints
Without limits, one script can try thousands of passwords, scrape your data or run up your bill. Add limits before you need them.
- Security · 21 July 2026
A CAPTCHA that asks you to run a command is malware
Fake “verify you’re human” pages tell visitors to press Win+R and paste a command. It installs malware. Teach people this one rule.
- Privacy · 16 July 2026
Website analytics without tracking people
You can count visits and popular pages without cookies, cookie banners or sending visitor data to an ad company.
- Infrastructure · 14 July 2026
Microsoft 365 and Google won’t back up your data
Cloud providers keep the service running. Deleted, encrypted or overwritten files are mostly your problem.
- AI · 9 July 2026
AI coding agents can read your .env file
An agent working in your project folder sees the same files you do, including secrets. Keep real keys out of its reach.
- Software · 7 July 2026
Open redirects make phishing links look like yours
A link on your domain that forwards to any URL lets attackers borrow your name. Only redirect to places you choose.
- Security · 2 July 2026
Who’s on call while everyone is on holiday?
Attackers like holidays because nobody is watching. Agree now who answers the phone in July and August.
- Infrastructure · 30 June 2026
Windows 10 got another year. Use it to move
Reports say Microsoft quietly extended free consumer security updates for Windows 10 to October 2027. Don’t treat it as a reason to wait.
- Infrastructure · 25 June 2026
Summer power cuts: test the shutdown
A UPS that has never been tested will surprise you. Check that servers shut down cleanly and come back by themselves.
- Privacy · 23 June 2026
Data brokers sell your details. Ask them to stop
Your phone number, address and relatives are listed on people-search sites. Removal is tedious but works.
- AI · 18 June 2026
Local AI models for sensitive work
Open models now run well on a good laptop or a small server. For some confidential tasks, that’s simpler than any contract.
- Security · 16 June 2026
Travelling with a work laptop this summer
Airports, hotels and borders are where laptops get lost, stolen or inspected. A few steps before you leave make each of those boring.
- Infrastructure · 9 June 2026
Secure Boot certificates expire this month
Microsoft’s 2011 Secure Boot certificates start expiring on 24 June. PCs keep booting, but without the 2023 certificates they stop getting boot-level fixes.
- Security · 4 June 2026
A one-hour incident exercise
You don’t need a consultant or a full day. One hour, one scenario and the right five people show where your plan breaks.
- Software · 2 June 2026
Every risky feature needs an off switch
When a feature misbehaves or is being abused, the fastest fix is turning it off, without a deploy.
- Privacy · 28 May 2026
Review what your phone apps can access
Apps collect permissions over the years: location, contacts, microphone, photos. Ten minutes on your phone cleans most of it up.
- Security · 26 May 2026
Who can export your whole CRM?
Extortion groups keep phoning staff and walking out with SaaS exports. Limit and watch bulk exports.
- Infrastructure · 21 May 2026
Let a domain expire and someone else gets your email
Old company domains still receive password resets, invoices and client email. Don’t let them lapse.
- AI · 19 May 2026
The EU AI Act delay: what moves and what doesn’t
EU lawmakers agreed to push back the high-risk AI rules. Transparency duties and the bans stay. And it isn’t law yet.
- Software · 14 May 2026
AI is finding bugs faster. Plan for bigger patch days
Microsoft says its own AI system found bugs fixed this month. Vendors everywhere are shipping more fixes. Your update process has to keep up.
- AI · 12 May 2026
LiteLLM proxy SQL injection: patch your AI gateway
A critical bug in LiteLLM’s proxy lets attackers read its database without logging in. Exploitation started within days.
- Security · 7 May 2026
Passkeys for your staff, not just customers
Most phishing that works today gets past passwords and push MFA. Passkeys on staff accounts stop it.
- Infrastructure · 5 May 2026
IPv6 is on. Is your firewall watching it?
Many networks run IPv6 without anyone deciding to. If the firewall rules only cover IPv4, devices may be reachable directly.
- AI · 30 April 2026
An AI usage policy that fits on one page
Long AI policies don’t get read. One page with clear yes and no answers does more.
- Security · 28 April 2026
Remote support tools are a favourite way in
CISA added more remote management and support tools to its exploited list this month. If your IT provider uses one, ask about it.
- Security · 23 April 2026
Don’t read email with your admin account
If the account you browse and read email with is also a domain or cloud admin, one bad click hands over everything.
- Security · 21 April 2026
Attackers want your developers’ laptops
Poisoned packages and extensions keep targeting developers for their tokens. A developer machine often has the keys to production.
- Security · 14 April 2026
Too many updates? Patch in this order
Patch Tuesday keeps getting bigger. You can’t do everything on day one, so do the right things first.
- Privacy · 9 April 2026
Your photos may carry your location
Photos can include where and when they were taken. Most social apps strip it. Email, chat files and websites often don’t.
- Security · 7 April 2026
Shared passwords belong in a shared vault
Teams still share logins in spreadsheets and chat messages. A team password manager is cheaper than the cleanup.
- AI · 2 April 2026
AI invents package names. Attackers register them
Coding assistants sometimes invent package names. Attackers publish malware under those names and wait.
- Software · 31 March 2026
security.txt: tell people where to report bugs
When someone finds a hole in your site, they need a way to tell you. A two-line file makes that easy.
- AI · 27 March 2026
Backdoored LiteLLM: your AI gateway holds every key
Two LiteLLM releases on PyPI stole credentials, using a token taken in the Trivy compromise. AI tooling is now supply-chain target number one.
- Security · 25 March 2026
Voice phishing is how SaaS data leaves now
This month’s breaches at Crunchyroll and Aura reportedly started with phone calls and phished support staff. Your help desk and vendors are the target.
- Software · 20 March 2026
Pin GitHub Actions to a commit, not a tag
Attackers backdoored the Trivy scanner and rewrote its GitHub Action tags. Pipelines pinned to tags ran the attacker’s code.
- Security · 13 March 2026
Stryker: device management used to wipe the company
Attackers took over an Intune admin account at Stryker and used it to wipe devices across the company. Your MDM can do the same.
- Infrastructure · 10 March 2026
SPF, DKIM, DMARC: finish the job
Many domains publish DMARC but stop at p=none, which protects nothing. Here’s how to get to reject without losing real mail.
- Software · 5 March 2026
Rotate secrets without breaking production
Most teams never rotate API keys because they’re afraid of downtime. Design for two valid keys at once and it becomes boring.
- Infrastructure · 3 March 2026
Old DNS records can hand over your subdomain
A DNS record pointing to a cloud service you deleted lets someone else claim it, and serve pages under your name.
- Security · 26 February 2026
When the hospital goes back to paper
Ransomware closed a US medical centre’s clinics across a whole state this month. Every organisation needs a plan for working without systems.
- Privacy · 24 February 2026
Odido: telecom data published after no deal
Attackers stole data on millions of Odido customers from a contact system and began publishing it. Telecom data feeds SIM-swap fraud.
- Infrastructure · 19 February 2026
What can the internet see? Scan yourself
Most break-ins start with something exposed that nobody remembered. Scan your own addresses before someone else does.
- Security · 17 February 2026
Keep an emergency admin account, and lock it away
If your single sign-on or MFA breaks, you need a way back in. A break-glass account is that way, if it’s protected properly.
- Security · 13 February 2026
Apple’s first exploited zero-day of 2026
iOS 26.3 fixes a bug Apple says was used in an extremely sophisticated attack on specific people. Update your devices.
- Security · 10 February 2026
The European Commission was hacked through its MDM
Attackers used Ivanti mobile management zero-days against EU and Dutch government bodies. The server that manages your phones is a crown jewel.
- Privacy · 5 February 2026
AI meeting notes: who else is in the call?
AI note-takers record, transcribe and store your meetings somewhere. Decide where, and tell people before you start.
- AI · 3 February 2026
Self-hosted AI agents, open to the internet
Tens of thousands of OpenClaw agents were found reachable online, many unpatched. An agent with your keys needs a locked door.
- Security · 29 January 2026
Check your mailbox for forwarding rules
After a mailbox is broken into, attackers often leave a quiet forwarding rule. Changing the password doesn’t remove it.
- AI · 27 January 2026
Shadow AI: find the tools people already use
Your staff already use AI tools you never approved. Banning them doesn’t work. Find them, then offer a safe option.
- AI · 22 January 2026
Before you connect an MCP server
MCP servers let AI assistants use your tools. Each one is code you run with your permissions. Check it like any other software.
- Infrastructure · 20 January 2026
Poland’s grid attack targeted solar farms
Attackers went after wind turbines, solar farms and heat plants across Poland in December. Small energy sites are now targets.
- AI · 15 January 2026
Give AI agents the least access that works
An AI agent with access to your mail, files and admin tools can be talked into using all of them. Start small.
- Privacy · 12 January 2026
Your customers’ data lives at your partners too
Ledger told customers their order details were exposed through its e-commerce partner. Your checkout provider holds the same kind of data.
- Security · 8 January 2026
Start the year by removing access
January is the easiest month to clean up accounts: people who left, contractors who finished, apps nobody uses.
- Infrastructure · 5 January 2026
Certificates drop to 200 days in March
From 15 March, public TLS certificates can last at most 200 days. If anyone renews yours by hand, fix that now.
- Security · 16 December 2025
A year-end security checklist
Quiet weeks are good for boring jobs. Eight things to close before January.
- Infrastructure · 2 December 2025
Your domain is the master key. Protect it
Whoever controls your domain controls your email and your website. Six settings worth ten minutes.
- AI · 18 November 2025
Before you ship code an AI wrote
AI coding tools are fast and often right. Five checks before that code goes live.
- Security · 4 November 2025
The logs you’ll wish you had
When something goes wrong, the first question is “what happened?”. Keep these logs before you need them.
- Software · 21 October 2025
Your dependencies are code you didn’t review
One phished maintainer can push malware into thousands of apps. Simple habits that limit the damage.
- Infrastructure · 7 October 2025
Windows 10 support ends 14 October: what to do
After 14 October 2025, Windows 10 gets no more free security updates. Your three options.
- Security · 23 September 2025
When the phishing page looks exactly like your login
Modern phishing pages are perfect copies. Your password manager is the best detector you have.
- Infrastructure · 9 September 2025
Stop exposing RDP and SSH to the internet
Bots try your remote desktop and SSH ports all day. Put them behind a VPN and use keys.
- AI · 12 August 2025
Prompt injection, explained for decision makers
The text an AI assistant reads can give it orders. You can’t patch it away, so limit what it can do.
- Security · 15 July 2025
Five security basics for a small business
No security team needed. Five things, in the order I’d do them.
- Security · 17 June 2025
MFA fatigue: when “Approve” becomes the attack
Someone with your password spams login prompts until you tap Approve. Four settings stop it.
- Security · 13 May 2025
Security headers in an afternoon
Six response headers, copy-paste values, and the one to roll out slowly.
- Security · 15 April 2025
Secrets in Git: how they leak and how to stop it
Deleting the file doesn’t remove the key. What to do first, and how to stop the next leak.
- Infrastructure · 18 March 2025
A backup you haven’t restored is only a hope
Backups fail quietly. How to keep one ransomware can’t touch, and prove it works.
- AI · 11 February 2025
Using AI at work without leaking company data
Your team already pastes work into AI chatbots. A five-line policy that keeps it safe.
- Security · 14 January 2025
Passkeys: what they fix, and what they don’t
Passkeys kill password phishing. They don’t fix account recovery or stolen sessions.
- Infrastructure · 17 December 2024
File transfer servers keep getting hit
Accellion, GoAnywhere, MOVEit and now Cleo. File transfer tools hold exactly what attackers want.
- Security · 10 December 2024
Even the FBI now says: use encrypted messaging
After the telecom hacks, US agencies told people to use end-to-end encrypted apps. Normal SMS and calls aren’t private.
- Infrastructure · 19 November 2024
Never put a management interface on the internet
Palo Alto firewalls are being taken over through their admin web pages. The fix is the same one every time.
- Security · 5 November 2024
Fake delivery texts before the holidays
“Your parcel is waiting, pay the small fee.” The busiest shopping weeks are the busiest for this scam too.
- Security · 22 October 2024
Internet Archive: the token nobody rotated
31 million accounts leaked, then attackers came back. Reports point to an access token left unrotated for almost two years.
- Infrastructure · 1 October 2024
CUPS bugs: your server doesn’t need a printer
A chain of bugs in Linux printing lets an attacker add a fake printer and run code. On servers, just switch it off.
- Security · 24 September 2024
Your antivirus can change owners overnight
Kaspersky users in the US woke up to a different antivirus. A reminder to know who runs your most trusted software.
- Security · 10 September 2024
NIST says: stop forcing password changes
The new NIST draft drops forced resets and “one symbol, one number” rules. Here’s what to do instead.
- Security · 20 August 2024
Post-quantum cryptography: what to do now
NIST published its first post-quantum standards this week. You don’t need to panic, but you do need a list.
- AI · 6 August 2024
When the boss on the video call isn’t real
An employee sent $25 million after a video call where everyone else was a deepfake. The fix is a process, not a tool.
- Infrastructure · 23 July 2024
What the CrowdStrike outage taught us about recovery
A bad update stopped millions of Windows PCs. The companies that recovered fast had one thing ready: their BitLocker keys.
- Security · 9 July 2024
regreSSHion: update OpenSSH on your Linux servers
A critical OpenSSH bug can give root without a password on many Linux servers. Check your version.
- Software · 27 June 2024
polyfill.io and the scripts you load from strangers
Over 100,000 sites served malware because they loaded a script from a domain that changed owners. Check your pages.
- Security · 11 June 2024
Infostealers: one infected laptop, one data breach
The Snowflake customer breaches started with passwords stolen by malware, some of them years old. How to break that chain.
- Infrastructure · 21 May 2024
The UK bans default passwords. Check your office
A new UK law bans default passwords on smart devices. The devices already in your office still have them.
- Security · 7 May 2024
One remote portal without MFA
Change Healthcare’s attackers walked in through a remote-access portal with no MFA. Check every login page you expose.
- Infrastructure · 16 April 2024
You can’t protect what you don’t know you have
Most security work starts with a list. A simple asset list you can make in a day.
- Security · 2 April 2024
The xz backdoor, in plain words
A backdoor nearly reached millions of Linux servers through a compression library. What to check, and what it teaches.
- Software · 19 March 2024
Your web app doesn’t need the database root user
If the app connects as root, one SQL injection owns everything. Give it its own small user.
- AI · 5 March 2024
Before you turn on Copilot, fix your sharing
An AI assistant sees everything the user can see. Your old oversharing becomes very easy to find.
- Infrastructure · 20 February 2024
Expired certificates still take sites down
An expired TLS certificate is a full outage. Automate renewal and watch every certificate from outside.
- Security · 6 February 2024
Old test accounts are open doors
Microsoft’s own email was read through a forgotten test account without MFA. Go find yours.
- Security · 23 January 2024
Your VPN box is now the front door
The Ivanti attacks are another reminder: firewalls and VPN appliances are a favourite way in. Treat them like that.
- Infrastructure · 9 January 2024
Gmail and Yahoo’s new sender rules start in February
From February 2024, mail without SPF, DKIM and DMARC starts landing in spam or bouncing. Check yours now.
- Infrastructure · 21 December 2023
Terrapin: an SSH bug to fix calmly
A new attack on the SSH protocol sounds scary. In practice it needs a man in the middle and does limited damage. Update anyway.
- Security · 12 December 2023
14,000 reused passwords, 6.9 million people affected
23andMe’s breach started with credential stuffing on a small number of accounts. A sharing feature did the rest.
- AI · 21 November 2023
Before you upload company files to a custom GPT
Custom GPTs are easy to build. Their knowledge files are also easy to pull out. Assume users can read everything.
- Security · 7 November 2023
Don’t send live session tokens to support
The Okta support breach worked because customers uploaded HAR files with valid sessions inside. Clean them first.
- Security · 31 October 2023
Citrix Bleed: patch, then kill the sessions
The NetScaler bug leaks session tokens. If you patched without ending sessions, attackers may still be logged in.
- Infrastructure · 17 October 2023
HTTP/2 Rapid Reset: what to patch
A flaw in HTTP/2 itself enabled the largest DDoS attacks ever seen. Update your web servers and load balancers.
- Security · 26 September 2023
One image library, hundreds of apps to update
The WebP bug was fixed in Chrome in days. The same code sits inside Slack, Teams and many other apps.
- Security · 19 September 2023
Your help desk can reset anyone’s MFA
The MGM attack reportedly began with a phone call to the IT help desk. Fix how resets are verified.
- Infrastructure · 29 August 2023
Zenbleed and Downfall: firmware updates count too
Two new CPU bugs can leak data between programs. The fix is BIOS and microcode updates, which many teams skip.
- AI · 15 August 2023
Read the AI clause in your software terms
Zoom’s terms caused an uproar about AI training. Every SaaS vendor is adding AI now. Check what yours says.
- Security · 25 July 2023
The log that caught Storm-0558 was a paid extra
Attackers read government email using forged Microsoft tokens. It was spotted thanks to a premium log most customers didn’t have.
- Infrastructure · 11 July 2023
Windows Server 2012 support ends in October
After 10 October 2023, Windows Server 2012 and 2012 R2 get no more security updates. Three months to plan.
- Infrastructure · 20 June 2023
When Microsoft 365 goes down, what do you do?
Outlook and OneDrive outages this month were caused by DDoS attacks. Your plan for a cloud outage can fit on one page.
- Infrastructure · 6 June 2023
MOVEit: patch, then look for the web shell
A zero-day in MOVEit Transfer is being mass-exploited. Patching isn’t enough if they were already in.
- Security · 23 May 2023
When “invoice.zip” is a website, not a file
The new .zip and .mov domains make links that look like file names. Teach people to check where a link really goes.
- Security · 9 May 2023
Google accounts now take passkeys. Set one up
Since last week you can sign in to Google with a passkey instead of a password. Two minutes, and phishing stops working.
- Security · 25 April 2023
Google Authenticator now syncs: turn it on?
Losing your phone no longer means losing your 2FA codes. But your Google account now holds them.
- Software · 4 April 2023
3CX: when the signed installer is the malware
A real, signed 3CX desktop app shipped with malware inside. What to do, and why “it’s signed” isn’t enough.
- Security · 21 March 2023
The Outlook bug that needs no click
A calendar reminder can leak your Windows password hash before you open anything. Patch now.
- Security · 14 March 2023
After SVB: beware of “new bank details”
Bank news creates the perfect cover for invoice fraud. One rule stops it.
- Security · 21 February 2023
The best part of Reddit’s breach: someone spoke up
An employee fell for a fake login page, then reported it right away. That’s the culture to build.
- Infrastructure · 7 February 2023
ESXiArgs: ransomware for unpatched VMware hosts
Thousands of ESXi servers were encrypted this week through a bug patched two years ago. Check yours today.
- AI · 24 January 2023
Phishing just got better grammar
ChatGPT writes a perfect email in any language in seconds. “Look for spelling mistakes” is no longer useful advice.
- Security · 10 January 2023
The LastPass breach: what to do now
Attackers copied encrypted LastPass vaults. How safe yours is depends on one thing: your master password.
- Security · 27 December 2022
Next year’s security plan: one thing a month
Big security programmes stall. Twelve small, finished improvements beat one big plan that never starts.
- Security · 20 December 2022
Fortinet SSL-VPN bug: patch, then hunt
A pre-login bug in FortiOS SSL-VPN is being exploited. Update, and look for the signs Fortinet published.
- Infrastructure · 13 December 2022
Rackspace outage: an exit plan for email
Thousands of businesses lost email after ransomware hit Rackspace’s hosted Exchange. Your provider’s outage is your outage.
- AI · 6 December 2022
ChatGPT is impressive. Don’t paste secrets into it
A million people tried ChatGPT in its first week. It’s useful, and everything you type may be read and used.
- Security · 29 November 2022
Moving to Mastodon? Three settings first
Millions are trying Mastodon this month. Turn on 2FA, choose your server with care, and verify your identity.
- Security · 22 November 2022
After FTX: beware “we can recover your money”
When an exchange collapses, scammers target its customers twice. Recovery offers are the second hit.
- Security · 15 November 2022
A blue tick isn’t identity
Paid verification on Twitter led straight to fake brand accounts. Check who you’re dealing with another way.
- Security · 8 November 2022
Medibank won’t pay the ransom. Good
Medibank refused the ransom for its stolen customer data. Paying doesn’t guarantee the data gets deleted.
- Infrastructure · 27 October 2022
OpenSSL critical fix: find your OpenSSL 3
A critical OpenSSL 3.0 fix lands on 1 November. Use the days before to find where you run version 3.
- Software · 18 October 2022
Toyota: an access key public on GitHub for five years
Part of an app’s source code, with a server key inside, sat in a public repository since 2017. Check your contractors too.
- Security · 11 October 2022
Four things everyone should do this month
October is Cybersecurity Awareness Month. Skip the posters. These four habits stop most attacks on people.
- Security · 4 October 2022
ProxyNotShell: Exchange zero-days, no patch
On-premises Exchange servers are under attack again. Apply the mitigation, and plan your way off on-prem mail.
- Software · 27 September 2022
Optus and the API anyone could call
Data on up to 9.8 million Australians leaked. Reports point to an API that didn’t check who was asking.
- Security · 20 September 2022
Uber’s breach: MFA spam and a password in a script
A teenager got deep into Uber with stolen credentials, repeated MFA prompts and an admin password in a PowerShell file.
- Security · 13 September 2022
iOS 16 Lockdown Mode: who should turn it on
Apple’s new Lockdown Mode blocks the features spyware abuses. Most people don’t need it. Some really do.
- Security · 6 September 2022
Ransomware loves a long weekend
LA’s school district was hit over the Labor Day weekend. Attackers pick the days nobody is watching.
- Security · 30 August 2022
LastPass source code stolen: what it means for you
LastPass says attackers took source code but no vaults. A good moment to check the one password that protects all the others.
- Security · 16 August 2022
Same phishing texts, two different endings
Twilio and Cloudflare were hit by the same SMS phishing campaign. Hardware security keys made the difference.
- Software · 26 July 2022
The Confluence app that shipped with a password
Installing one Atlassian app created an account with a fixed password, and that password is now public. Check yours.
- Infrastructure · 12 July 2022
One network down, a whole country stuck
The Rogers outage cut phones, internet and card payments across Canada for most of a day. Do you have a second path?
- Infrastructure · 21 June 2022
Internet Explorer is gone, except where it isn’t
IE was retired on 15 June. Old internal apps still need it, through Edge’s IE mode. Plan their exit.
- Infrastructure · 7 June 2022
Confluence zero-day: patch it or take it offline
Every supported Confluence Server and Data Center version can be taken over without a login. Act today.
- Security · 31 May 2022
Follina: a Word file that runs code, no macros needed
A new Office zero-day abuses the Windows support tool. There’s no patch yet, but there is a workaround.
- Security · 10 May 2022
Big Tech promises to drop the password
The three giants agreed to support passwordless sign-in across devices. What it means, and what to do while we wait.
- Software · 19 April 2022
Stolen OAuth tokens: review your GitHub apps
Attackers used tokens stolen from Heroku and Travis CI to download private GitHub repos. Check who can read your code.
- Software · 5 April 2022
Spring4Shell: check your setup, then patch
The new Spring Framework bug is serious but narrower than Log4Shell. Here’s how to know if you’re affected.
- Security · 29 March 2022
Lapsus$: no zero-days, just people
The group that hit Nvidia, Samsung, Microsoft and Okta used MFA spam, SIM swaps and paid insiders. Defend those.
- Security · 1 March 2022
“Shields Up”: a small company’s week
Security agencies are warning of more cyber attacks. The checklist is short, and it’s the same basics as always.
- Security · 15 February 2022
Office will block internet macros. Get ready
Office will soon block VBA macros in files from the internet by default. Good news, if you plan for the files that break.
- Privacy · 1 February 2022
The data you don’t keep can’t leak
Every field you collect is something to protect forever. Collect less, keep it shorter, delete on schedule.
- Security · 25 January 2022
That QR code on the parking meter might be a sticker
Fake QR stickers on parking meters are sending people to payment scams. QR codes are links you can’t read.
- Security · 11 January 2022
Log4Shell, one month on: where it still hides
You patched the obvious Java apps in December. Log4j also hides in vendor products, fat JARs and old containers.
- Security · 14 December 2021
Log4Shell: what to do this week
A bug in the Log4j logging library lets attackers run code with a single line of text. Find every Java app you have.
- Security · 7 December 2021
Before the holidays, check your checkout page
Card skimmers hide in online shops’ checkout code. A short list to make sure yours only runs what you expect.
- Security · 23 November 2021
GoDaddy’s WordPress breach: change those passwords
Data on up to 1.2 million Managed WordPress customers was exposed, including some passwords in plain text.
- Software · 9 November 2021
Trojan Source: code that lies to reviewers
Hidden text-direction characters can make code look harmless to a reviewer while the compiler sees something else.
- Infrastructure · 26 October 2021
Windows 11 needs a TPM. That’s the point
Windows 11’s strict hardware list annoyed many people. The TPM and Secure Boot requirements are real security gains.
- Software · 19 October 2021
Twitch’s leak came from a server setting
Source code and creator payouts leaked after what Twitch calls a server configuration error. Misconfiguration is a breach too.
- Infrastructure · 5 October 2021
Facebook vanished from the internet. Here’s how
A configuration change withdrew Facebook’s routes. DNS went with it, and so did its internal tools and door badges.
- Infrastructure · 21 September 2021
Let’s Encrypt’s old root expires on 30 September
When DST Root CA X3 expires, some older devices and software will stop trusting many websites. Test your clients now.
- Infrastructure · 7 September 2021
Patch Confluence: exploitation started in days
A Confluence bug patched on 25 August is now under mass attack. Self-hosted servers on the internet are being taken over.
- Privacy · 24 August 2021
T-Mobile’s breach: your carrier holds your identity
Data on tens of millions of people, including ID numbers, was stolen. Lock your mobile account and credit.
- Security · 10 August 2021
ProxyShell: the Exchange patches came months ago
Attackers are scanning for Exchange servers missing the April and May updates. If you’re behind, you’re a target now.
- Security · 27 July 2021
Pegasus: what normal phone users can do
The Pegasus investigation showed zero-click spyware on fully updated phones. Most people aren’t targets, but a few habits help.
- Security · 13 July 2021
Kaseya: when your IT provider’s tool is the way in
Ransomware spread to around 1,500 businesses through their IT providers’ remote management software.
- Security · 6 July 2021
PrintNightmare: switch off the Print Spooler
A Windows print spooler bug lets attackers run code as SYSTEM, even on domain controllers. Disable it where nothing prints.
- Security · 22 June 2021
RockYou2021: 8 billion leaked passwords in one file
A huge password list is circulating online. It’s mostly old leaks, which is exactly why unique passwords matter.
- Security · 15 June 2021
The password that shut down a pipeline
Colonial’s CEO says attackers used an old VPN account with no MFA. One leaked password was enough.
- Infrastructure · 10 June 2021
Fastly’s outage: a big part of the web went dark
One customer setting triggered a bug that took down major websites for an hour. Know your single points of failure.
- Security · 25 May 2021
The US cyber executive order, for vendors
Biden’s order on cybersecurity sets new rules for software sold to the US government. Expect them to spread.
- Infrastructure · 11 May 2021
Colonial Pipeline: ransomware reaches the fuel pumps
A ransomware attack on IT systems led to the shutdown of the largest US fuel pipeline. Separation and planning matter.
- Software · 27 April 2021
Codecov: when your CI script steals your secrets
A tampered Codecov upload script sent CI environment variables to attackers for months. Rotate, then verify what you run.
- Security · 22 April 2021
Pulse Secure zero-day: VPNs under attack again
A new Pulse Connect Secure bug is being exploited before a patch exists. Apply the workaround and check the integrity tool.
- Privacy · 6 April 2021
533 million Facebook numbers: smarter scams
Old scraped data is now free online. Your number, name and job make phishing much more personal.
- Security · 30 March 2021
Turn off legacy authentication in Microsoft 365
Old mail protocols skip MFA, and password-spraying attacks love them. Most companies can block them in an afternoon.
- Infrastructure · 23 March 2021
Verkada: 150,000 cameras, one admin login
Hackers viewed live feeds from hospitals, schools and factories through a single exposed super-admin account.
- Infrastructure · 16 March 2021
A data centre burned. Where were the backups?
Fire destroyed an OVHcloud data centre in Strasbourg. Some customers lost everything because backups sat in the same place.
- Security · 9 March 2021
ProxyLogon: patch Exchange, then look for web shells
Four Exchange zero-days are being mass-exploited. Patching closes the door but doesn’t remove anyone already inside.
- Software · 23 February 2021
Dependency confusion: a package name is an attack
A researcher got code running inside Apple, Microsoft and PayPal by publishing public packages with their internal names.
- Infrastructure · 16 February 2021
A water plant, TeamViewer and a shared password
Someone remotely changed chemical levels at a Florida water plant. Reports point to shared TeamViewer access and Windows 7.
- Security · 2 February 2021
Emotet is down. Its habits aren’t
Police took over Emotet’s servers last week. The tactics it made popular, like reply-chain phishing, will continue.
- Privacy · 19 January 2021
Switching to Signal? What actually changes
WhatsApp’s new privacy terms sent millions to Signal this month. Both encrypt messages. The difference is the data around them.
- Security · 12 January 2021
Ubiquiti says change your password. Do more
Ubiquiti asked customers to reset passwords after unauthorised access. Your router account deserves MFA too.
- Security · 5 January 2021
SolarWinds: when the update is the attack
Trojanised Orion updates reached thousands of networks. What to check if you run it, and what it means for everyone else.
- Security · 22 December 2020
A year of remote work: what to keep
2020 forced a huge experiment in working from anywhere. What worked for security, and what to fix in 2021.
- Security · 15 December 2020
Running SolarWinds Orion? Act today
Some Orion updates from this year contain a backdoor. US agencies were told to disconnect it. Here’s what to do.
- Security · 10 December 2020
FireEye was hacked, and its tools are out
A state-backed attacker stole FireEye’s red-team tools. FireEye published rules to detect them. Use them.
- Security · 24 November 2020
Holiday shopping: watch out for fake shops
With shops closed, everyone is buying online, and fake stores are everywhere. How to check before you pay.
- Security · 10 November 2020
Capcom: ransomware that steals before it encrypts
The games company was hit by ransomware, and the group says it took data too. Backups don’t solve the leak.
- Security · 27 October 2020
Browser zero-days: update, then restart
Chrome fixed a font-library bug already used in attacks. The update only works after the browser restarts.
- Security · 13 October 2020
Microsoft goes after TrickBot
Microsoft and partners used a court order to disrupt TrickBot’s servers. The malware will try to come back.
- Infrastructure · 29 September 2020
When ransomware hits hospitals
A major US hospital chain is back on paper after a ransomware attack. Downtime procedures are part of security.
- Security · 15 September 2020
Zerologon: patch your domain controllers now
A bug in Netlogon lets anyone on the network become domain admin in seconds. The August patch fixes it.
- Infrastructure · 25 August 2020
The breach without a hacker: open databases
Researchers keep finding databases with millions of records and no password. Nobody broke in; the door was open.
- Privacy · 11 August 2020
Blackbaud paid the ransom for a promise
A software provider to charities and universities paid attackers to delete stolen data. Its customers are now notifying donors.
- Infrastructure · 28 July 2020
Garmin went dark for days
A ransomware attack took down Garmin’s fitness services, call centres and pilot apps. Customers felt it immediately.
- Security · 21 July 2020
The Twitter hack: social engineering and admin tools
Famous accounts tweeted a bitcoin scam after attackers fooled employees with access to internal tools.
- Security · 16 July 2020
SIGRed: patch your Windows DNS servers
A 17-year-old bug in Windows DNS Server is rated 10/10 and wormable. Domain controllers are usually DNS servers too.
- Security · 7 July 2020
F5 BIG-IP bug: patch and hide the admin page
A critical bug in the BIG-IP management interface is being exploited. It should never have been on the internet.
- Infrastructure · 23 June 2020
Ripple20: hidden bugs in millions of devices
One small network library inside printers, medical devices and industrial gear has serious bugs. Patching won’t be easy.
- Infrastructure · 9 June 2020
Ransomware paused Honda’s factories
A cyberattack hit Honda’s internal network and stopped production at some plants. Factories need network separation.
- Privacy · 26 May 2020
EasyJet breach: expect travel phishing
Data on 9 million easyJet customers was accessed, including travel details. That makes refund scams very believable.
- Security · 12 May 2020
Thunderspy: physical access still matters
A researcher showed how a Thunderbolt port can unlock a laptop in minutes. Encryption and settings decide the damage.
- Infrastructure · 28 April 2020
Your home router is now an office router
Remote work moved company traffic onto home networks. Ten minutes on the router makes a real difference.
- Privacy · 21 April 2020
Contact tracing apps: what to look for
Apple and Google’s design for exposure notification keeps data on phones. Not every country’s app works that way.
- Security · 14 April 2020
Relief payment scams are everywhere
Governments are sending emergency money, and scammers are sending fake “claim your payment” messages.
- Security · 31 March 2020
Zoombombing: lock your meetings
Uninvited guests are crashing video calls, from classes to company meetings. A few settings stop most of it.
- Security · 17 March 2020
Everyone works from home now. A quick checklist
Offices are closing overnight. Here’s what to sort out first so remote work doesn’t become remote risk.
- Security · 12 March 2020
SMBGhost: patch Windows 10 file sharing today
A wormable bug in Windows 10’s SMBv3 compression leaked before a fix. Microsoft has now released the patch.
- Infrastructure · 3 March 2020
Let’s Encrypt is revoking 3 million certificates
A bug means millions of certificates will be revoked tomorrow. Check yours and renew today, or visitors will see errors.
- Privacy · 25 February 2020
MGM’s guest data is online. Expect the calls
Details of 10.6 million MGM hotel guests, from a 2019 breach, were posted on a hacking forum. Old data, new scams.
- Security · 11 February 2020
Phishing follows the news: coronavirus emails
Fake health warnings and “WHO” emails carrying malware are spreading as fast as the news. How to spot them.
- Security · 28 January 2020
Travelex: a month offline after ransomware
A currency exchange giant has been running on pen and paper since New Year’s Eve. Reports point to an unpatched VPN.
- Security · 21 January 2020
CurveBall: the Windows bug the NSA reported
A flaw in how Windows checks certificates could let fake software and websites look trusted. Patch it this week.
- Security · 14 January 2020
Citrix ADC bug: apply the mitigation tonight
Exploit code for the Citrix ADC and Gateway bug is public, and attacks have started. Patches are still days away.
- Infrastructure · 7 January 2020
Windows 7 support ends next week
From 14 January, Windows 7 gets no more free security updates. What to do with the PCs still running it.
- Privacy · 17 December 2019
Ring cameras: reused passwords, no 2FA
Strangers spoke to families through hacked Ring cameras. Ring blames reused passwords. Turn on two-factor authentication.
- Privacy · 3 December 2019
The FBI’s advice on smart TVs
Before the holiday shopping season, the FBI warned about smart TV cameras and microphones. Here’s the short version.
- Security · 19 November 2019
Disney+ accounts sold within days of launch
Thousands of new Disney+ accounts appeared for sale. The likely cause: passwords reused from other leaks.
- Security · 5 November 2019
BlueKeep is now being exploited
The Remote Desktop bug from May is being used to install crypto miners. Unpatched machines are also crashing.
- Security · 22 October 2019
Avast: a forgotten VPN profile without MFA
Avast was breached through a temporary VPN profile that was left enabled and didn’t require two-factor authentication.
- Infrastructure · 15 October 2019
sudo -u#-1: a bug in an unusual config
A sudo bug lets some users run commands as root. It only affects one kind of rule, but check yours.
- Software · 26 September 2019
vBulletin zero-day: patch your forum now
A pre-login remote code bug in vBulletin was published without warning, and a patch is out. Forums are under attack.
- Security · 10 September 2019
Hacked websites were infecting iPhones
Google Project Zero found sites that silently attacked every iPhone visitor for two years. Keep iOS updated.
- Security · 3 September 2019
SIM swapping: why SMS codes aren’t enough
Twitter’s CEO lost control of their account after the phone number was taken over. Move important accounts off SMS.
- Security · 27 August 2019
Your VPN is being scanned: Pulse and Fortinet
Attackers are scanning for Pulse Secure and Fortinet VPN bugs that leak passwords. The patches have been out for months.
- Security · 20 August 2019
22 Texas towns hit through one provider
A coordinated ransomware attack hit 22 local governments in Texas. Reports point to a shared IT provider.
- Infrastructure · 30 July 2019
Capital One: a firewall setting and cloud credentials
Data on about 106 million people leaked through a misconfigured firewall that could reach cloud credentials.
- Security · 16 July 2019
Zoom’s hidden web server on Macs
A website could switch on your Mac’s camera through Zoom’s local web server. Apple removed it. Check what your apps install.
- Software · 9 July 2019
One bad regex took down Cloudflare
A new firewall rule with a costly regular expression maxed out CPUs worldwide for 27 minutes. Test the boring changes too.
- Security · 25 June 2019
A Florida city paid 600,000 dollars in ransom
Riviera Beach voted to pay attackers after an employee opened an email. Paying is a decision best made before an attack.
- Infrastructure · 18 June 2019
Exim mail servers are being taken over
A critical Exim bug disclosed this month is now mass-exploited. Many cPanel and Linux mail servers run it.
- Software · 4 June 2019
885 million records, one changed number in a URL
First American exposed mortgage documents because anyone could change a document number in the link.
- Security · 28 May 2019
Baltimore: three weeks without city systems
Ransomware stopped Baltimore’s email, payments and property sales. The city refused to pay, and is rebuilding.
- Security · 21 May 2019
BlueKeep: patch Remote Desktop, even on Windows XP
Microsoft says this Remote Desktop bug is wormable, and patched even Windows XP. Close RDP to the internet now.
- Security · 14 May 2019
WhatsApp: a missed call could install spyware
A WhatsApp bug let attackers install spyware just by calling, even if nobody answered. Update now.
- Software · 30 April 2019
Docker Hub breach: check your build tokens
Data on 190,000 Docker Hub accounts was exposed, including GitHub and Bitbucket tokens used for automated builds.
- Security · 16 April 2019
Wipro: when your IT outsourcer is the way in
Attackers phished their way into one of India’s largest IT firms and used it to reach its clients.
- Security · 2 April 2019
ShadowHammer: ASUS’s updater shipped a backdoor
Attackers pushed a signed, trojanised ASUS Live Update to many PCs, targeting a few hundred. Update tools are prime targets.
- Security · 28 March 2019
Facebook kept passwords in plain text logs
Hundreds of millions of passwords were readable in internal logs. Logs need the same care as databases.
- Security · 26 March 2019
Norsk Hydro: how to handle ransomware in public
The aluminium maker switched to manual operations and gave daily updates. It shows how to respond with honesty.
- Security · 12 March 2019
Citrix was breached through password spraying
The FBI told Citrix attackers got in by trying common passwords against many accounts. Simple attack, simple defences.
- Security · 26 February 2019
WinRAR’s 19-year-old bug: update or uninstall
A flaw in WinRAR’s ACE support lets a crafted archive drop malware into your Startup folder. WinRAR doesn’t update itself.
- Infrastructure · 19 February 2019
runc bug: a container can take over its host
A flaw in runc, used by Docker and Kubernetes, lets a malicious container gain root on the host. Update this week.
- Security · 5 February 2019
QuadrigaCX: when only one person has the keys
A crypto exchange says it can’t reach most of its customers’ funds after its founder died. A lesson in key management.
- Infrastructure · 29 January 2019
DNS hijacking: protect the account behind your domain
Attackers redirected government domains by logging into DNS accounts. A US emergency directive lists four steps anyone can take.
- Security · 22 January 2019
Collection #1: 773 million emails and their passwords
A huge list of leaked emails and passwords is circulating. Check yours, and stop reusing passwords for good.
- Privacy · 8 January 2019
Marriott: 5 million passport numbers, unencrypted
Marriott’s updated breach numbers include millions of unencrypted passport numbers. Data you must keep, you must protect.
From the archive
Notes from my old blog on mohamedsharaf.net (2010–2018), rewritten and checked. Some are dated; the dates tell you how much.
- Servers · 25 December 2018
Run a Laravel app on cPanel by linking public_html
Serve a Laravel project on shared cPanel hosting without exposing the whole app folder.
- Servers · 19 December 2018
How old is that server disk? Check its power-on hours
Read a drive’s real age from its SMART data with smartctl, and turn the hours into days.
- Databases · 15 August 2018
UUID_TO_BIN and BIN_TO_UUID for MySQL 5.6 and 5.7
Store UUIDs in 16 bytes, time-ordered like MySQL 8, on older MySQL versions and Amazon RDS.
- Servers · 3 August 2018
Keep iptables rules after a reboot on CentOS
Why your firewall rules disappear after a restart on CentOS, and the settings that keep them.
- Security · 18 May 2017
How Russia faced the WannaCry ransomware that scared the world
From the archive (2017): Russia’s unusual answer to the ransomware that stopped companies around the world for days.
- Security · 21 June 2016
Is that phone genuine? Check its IMEI
Two quick checks before buying a phone: its IMEI and its warranty status with the manufacturer.
- Software · 7 February 2016
Run PhpStorm (or any JetBrains IDE) from a USB drive
Keep the IDE and all its settings in one folder you can carry on a flash drive or sync to the cloud.
- Servers · 14 January 2016
Restore many cPanel backups in one go
A small loop that restores every cPanel account backup in a folder, one after another.
- Servers · 3 January 2016
A few cPanel commands I keep using over SSH
Install cPanel, back up one account, and force a full backup run, straight from the command line.
- Servers · 15 November 2014
Installing cPanel on a Xen virtual machine from a local ISO
Notes from building cPanel servers as Xen VMs from an ISO stored on the host, and what changed since.
- WordPress · 8 November 2014
Delete orphaned post meta in WordPress
Clean up custom-field rows left behind by deleted posts, with one SQL query and a backup first.
- Databases · 8 November 2014
Pivot rows into columns in MySQL, dynamically
Turn key/value rows into one column per key when you don’t know the keys in advance.
- WordPress · 21 October 2014
Custom post type plugins for WordPress: a 2014 comparison
A look back at which plugins people used to build custom post types, and what most sites use now.
- Infrastructure · 12 June 2014
Blocking Facebook on a home or office network
Find which domains an app really uses, then block them at the router or with DNS filtering.
- Web · 2 May 2014
Speeding up your website: Yahoo’s classic rules
The famous Yahoo performance rules in short, and which of them still matter today.
- Security · 11 January 2014
The 10 Immutable Laws of Security, still true
Microsoft’s famous list of security truths that no software update can fix, and why they still hold.
- Software · 11 January 2014
Large-scale JavaScript architecture: modules, facade, mediator
Addy Osmani’s classic answer to growing JavaScript apps: independent modules that only talk through a mediator.
- WordPress · 14 November 2013
Writing secure WordPress plugins and themes
The handful of habits that prevent most WordPress plugin vulnerabilities.
- Infrastructure · 7 September 2013
Hard disk failure: what the symptoms tell you
No spin, a burning smell, clicking: what each sign usually means, and the one rule when data matters.
- Web · 30 August 2013
Cut long text with “…” in CSS
Fit long text into a fixed-width box with an ellipsis, on one line or on several.
- Windows · 23 May 2013
Stop Windows Update from restarting your PC while you work
The Group Policy setting that stops automatic restarts while someone is signed in.
- Databases · 24 February 2013
One big table or two identical ones?
When two sets of data have the same structure, why one indexed table usually beats splitting them.
- Databases · 5 December 2012
How YouTube scaled MySQL in 2007
Lessons from Paul Tuckfield’s keynote on keeping YouTube’s databases ahead of its growth.
- PHP · 10 November 2012
Enable the intl extension in XAMPP (and fix the missing ICU DLL error)
Turn on PHP’s intl extension on Windows and get past the “icuuc*.dll is missing” error.
- Zend Framework · 30 October 2012
The order of events in a Zend Framework 2 request
Which events fire, in what order, from loading modules to sending the response.
- Zend Framework · 29 October 2012
Zend Framework 2: return a response without a view or layout
Two ways to skip rendering in a ZF2 controller action: return the response, or render without the layout.
- Infrastructure · 20 October 2012
Free public DNS servers worth using
Fast, free DNS resolvers you can use instead of your ISP’s, including family-safe options.
- Web · 3 August 2012
HTTP request methods in plain words
GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS and TRACE: what each one is for.
- PHP · 28 July 2012
Recognising a returning visitor in PHP: sessions, not fingerprints
The reliable way to recognise a visitor is a session cookie; “fingerprinting” is fragile and invasive.
- Windows · 28 July 2012
Fixing “ERR_NAME_RESOLUTION_FAILED” on Windows
When every site says the address can’t be found, reset Windows networking in three commands.
- Zend Framework · 20 May 2012
A REST server in Zend Framework in three lines
How Zend Framework 1 exposed a PHP class as a REST service, and what to use today.
- Zend Framework · 29 April 2012
Database transactions in Zend Framework
When a group of database changes must succeed or fail together, and how to write it in Zend Framework 1.
- Databases · 27 April 2012
Create a view in MySQL
Save a query under a name and use it like a table.
- Zend Framework · 27 March 2012
The life of a request in Zend Framework 1
Where plugins and helpers run while Zend Framework 1 turns a URL into a response.
- Web · 12 February 2012
Make an iframe as tall as its content
Resize an iframe to fit what it shows, and why it only works directly on pages from your own site.
- Security · 25 January 2012
PHP security: the basics that still matter
XSS, SQL injection, CSRF, file uploads, includes and passwords: the short list every PHP developer needs.
- Zend Framework · 23 January 2012
Forcing HTTPS on login and checkout in Zend Framework
How we sent only sensitive pages over HTTPS in 2012, and why today the answer is simply “everywhere”.
- WordPress · 23 May 2011
Disable or limit post revisions in WordPress
Stop WordPress from storing endless copies of every post, with one line in wp-config.php.
- WordPress · 18 May 2011
Give your WordPress custom post type its own menu icon
Replace the default pin icon in the WordPress admin menu with one that fits your content.
- Windows · 8 May 2011
Free up disk space after Windows 7 Service Pack 1
One command that removed the backup files SP1 left behind and gave back a couple of gigabytes.
- PHP · 4 May 2011
Underused PHP functions worth knowing
A short tour of handy PHP features from a classic Nettuts+ list, updated for modern PHP.
- WordPress · 4 May 2011
Useful wp-config.php settings for WordPress
The settings that live in wp-config.php, not in the admin panel, and the ones worth knowing.
- Zend Framework · 12 April 2011
Layouts in Zend Framework 1: one template around every page
How Zend_Layout wrapped every page in a single shared template, and how to switch or turn it off.
- Servers · 9 March 2011
Copy an EasyApache profile to another cPanel server
How to reuse the same Apache/PHP build on several cPanel servers instead of clicking through it again.
- Servers · 5 March 2011
Wildcard subdomains on a cPanel server
Make anything.yourdomain.com reach your site, so your app can decide what each subdomain shows.
- Servers · 4 March 2011
Delete a whole directory over SSH
The one-line command to remove a folder and everything inside it on Linux, and the care it deserves.
- Web · 1 January 2011
Adding a favicon to your site
The small icon in the browser tab: which files you need today and the lines that add them.
- WordPress · 6 November 2010
WordPress custom taxonomies, explained
Categories and tags are only the start: how custom taxonomies let you organise content your own way.
- WordPress · 6 November 2010
WordPress custom fields: what they are and how to show them
Store extra details on a post, like a rating or a price, and display them in your theme.
- Software · 3 November 2010
PHP vs ASP.NET vs Java EE: the 2010 view, and today’s
How the three big web platforms compared in 2010 on cost, support and hosting, and how much of that still holds.
- Servers · 1 November 2010
Connecting two Windows Server 2003 domains
Two domain controllers, two separate domains: the two realistic ways to bring them together.