Infrastructure
Everything I’ve written on Infrastructure, newest first.
New
- Infrastructure · 26 October 2026
Put every renewal date in one calendar
Domains, certificates, licences, support contracts and payment cards all expire. Most outages from them are just forgotten dates.
- Infrastructure · 24 September 2026
Wrong clocks break security quietly
Logins, certificates, MFA codes and logs all depend on accurate time. Check that every machine syncs from a reliable source.
- Infrastructure · 10 September 2026
When did you last update your switches?
Routers, switches, access points and NAS boxes run software too, and attackers target them because nobody patches them.
- Infrastructure · 20 August 2026
DNSSEC: worth turning on?
DNSSEC stops forged DNS answers for your domain. With most DNS providers it’s now one switch. Here’s when it matters.
- Infrastructure · 11 August 2026
Replace port forwarding with a tunnel
Opening a port on the router puts the service on the whole internet. An outbound tunnel with login in front is safer and often easier.
- Infrastructure · 28 July 2026
The server nobody owns
Every network has a machine that nobody admits to running. It’s usually unpatched, and often the way in.
- Infrastructure · 14 July 2026
Microsoft 365 and Google won’t back up your data
Cloud providers keep the service running. Deleted, encrypted or overwritten files are mostly your problem.
- Infrastructure · 30 June 2026
Windows 10 got another year. Use it to move
Reports say Microsoft quietly extended free consumer security updates for Windows 10 to October 2027. Don’t treat it as a reason to wait.
- Infrastructure · 25 June 2026
Summer power cuts: test the shutdown
A UPS that has never been tested will surprise you. Check that servers shut down cleanly and come back by themselves.
- Infrastructure · 9 June 2026
Secure Boot certificates expire this month
Microsoft’s 2011 Secure Boot certificates start expiring on 24 June. PCs keep booting, but without the 2023 certificates they stop getting boot-level fixes.
- Infrastructure · 21 May 2026
Let a domain expire and someone else gets your email
Old company domains still receive password resets, invoices and client email. Don’t let them lapse.
- Infrastructure · 5 May 2026
IPv6 is on. Is your firewall watching it?
Many networks run IPv6 without anyone deciding to. If the firewall rules only cover IPv4, devices may be reachable directly.
- Infrastructure · 10 March 2026
SPF, DKIM, DMARC: finish the job
Many domains publish DMARC but stop at p=none, which protects nothing. Here’s how to get to reject without losing real mail.
- Infrastructure · 3 March 2026
Old DNS records can hand over your subdomain
A DNS record pointing to a cloud service you deleted lets someone else claim it, and serve pages under your name.
- Infrastructure · 19 February 2026
What can the internet see? Scan yourself
Most break-ins start with something exposed that nobody remembered. Scan your own addresses before someone else does.
- Infrastructure · 20 January 2026
Poland’s grid attack targeted solar farms
Attackers went after wind turbines, solar farms and heat plants across Poland in December. Small energy sites are now targets.
- Infrastructure · 5 January 2026
Certificates drop to 200 days in March
From 15 March, public TLS certificates can last at most 200 days. If anyone renews yours by hand, fix that now.
- Infrastructure · 2 December 2025
Your domain is the master key. Protect it
Whoever controls your domain controls your email and your website. Six settings worth ten minutes.
- Infrastructure · 7 October 2025
Windows 10 support ends 14 October: what to do
After 14 October 2025, Windows 10 gets no more free security updates. Your three options.
- Infrastructure · 9 September 2025
Stop exposing RDP and SSH to the internet
Bots try your remote desktop and SSH ports all day. Put them behind a VPN and use keys.
- Infrastructure · 18 March 2025
A backup you haven’t restored is only a hope
Backups fail quietly. How to keep one ransomware can’t touch, and prove it works.
- Infrastructure · 17 December 2024
File transfer servers keep getting hit
Accellion, GoAnywhere, MOVEit and now Cleo. File transfer tools hold exactly what attackers want.
- Infrastructure · 19 November 2024
Never put a management interface on the internet
Palo Alto firewalls are being taken over through their admin web pages. The fix is the same one every time.
- Infrastructure · 1 October 2024
CUPS bugs: your server doesn’t need a printer
A chain of bugs in Linux printing lets an attacker add a fake printer and run code. On servers, just switch it off.
- Infrastructure · 23 July 2024
What the CrowdStrike outage taught us about recovery
A bad update stopped millions of Windows PCs. The companies that recovered fast had one thing ready: their BitLocker keys.
- Infrastructure · 21 May 2024
The UK bans default passwords. Check your office
A new UK law bans default passwords on smart devices. The devices already in your office still have them.
- Infrastructure · 16 April 2024
You can’t protect what you don’t know you have
Most security work starts with a list. A simple asset list you can make in a day.
- Infrastructure · 20 February 2024
Expired certificates still take sites down
An expired TLS certificate is a full outage. Automate renewal and watch every certificate from outside.
- Infrastructure · 9 January 2024
Gmail and Yahoo’s new sender rules start in February
From February 2024, mail without SPF, DKIM and DMARC starts landing in spam or bouncing. Check yours now.
- Infrastructure · 21 December 2023
Terrapin: an SSH bug to fix calmly
A new attack on the SSH protocol sounds scary. In practice it needs a man in the middle and does limited damage. Update anyway.
- Infrastructure · 17 October 2023
HTTP/2 Rapid Reset: what to patch
A flaw in HTTP/2 itself enabled the largest DDoS attacks ever seen. Update your web servers and load balancers.
- Infrastructure · 29 August 2023
Zenbleed and Downfall: firmware updates count too
Two new CPU bugs can leak data between programs. The fix is BIOS and microcode updates, which many teams skip.
- Infrastructure · 11 July 2023
Windows Server 2012 support ends in October
After 10 October 2023, Windows Server 2012 and 2012 R2 get no more security updates. Three months to plan.
- Infrastructure · 20 June 2023
When Microsoft 365 goes down, what do you do?
Outlook and OneDrive outages this month were caused by DDoS attacks. Your plan for a cloud outage can fit on one page.
- Infrastructure · 6 June 2023
MOVEit: patch, then look for the web shell
A zero-day in MOVEit Transfer is being mass-exploited. Patching isn’t enough if they were already in.
- Infrastructure · 7 February 2023
ESXiArgs: ransomware for unpatched VMware hosts
Thousands of ESXi servers were encrypted this week through a bug patched two years ago. Check yours today.
- Infrastructure · 13 December 2022
Rackspace outage: an exit plan for email
Thousands of businesses lost email after ransomware hit Rackspace’s hosted Exchange. Your provider’s outage is your outage.
- Infrastructure · 27 October 2022
OpenSSL critical fix: find your OpenSSL 3
A critical OpenSSL 3.0 fix lands on 1 November. Use the days before to find where you run version 3.
- Infrastructure · 12 July 2022
One network down, a whole country stuck
The Rogers outage cut phones, internet and card payments across Canada for most of a day. Do you have a second path?
- Infrastructure · 21 June 2022
Internet Explorer is gone, except where it isn’t
IE was retired on 15 June. Old internal apps still need it, through Edge’s IE mode. Plan their exit.
- Infrastructure · 7 June 2022
Confluence zero-day: patch it or take it offline
Every supported Confluence Server and Data Center version can be taken over without a login. Act today.
- Infrastructure · 26 October 2021
Windows 11 needs a TPM. That’s the point
Windows 11’s strict hardware list annoyed many people. The TPM and Secure Boot requirements are real security gains.
- Infrastructure · 5 October 2021
Facebook vanished from the internet. Here’s how
A configuration change withdrew Facebook’s routes. DNS went with it, and so did its internal tools and door badges.
- Infrastructure · 21 September 2021
Let’s Encrypt’s old root expires on 30 September
When DST Root CA X3 expires, some older devices and software will stop trusting many websites. Test your clients now.
- Infrastructure · 7 September 2021
Patch Confluence: exploitation started in days
A Confluence bug patched on 25 August is now under mass attack. Self-hosted servers on the internet are being taken over.
- Infrastructure · 10 June 2021
Fastly’s outage: a big part of the web went dark
One customer setting triggered a bug that took down major websites for an hour. Know your single points of failure.
- Infrastructure · 11 May 2021
Colonial Pipeline: ransomware reaches the fuel pumps
A ransomware attack on IT systems led to the shutdown of the largest US fuel pipeline. Separation and planning matter.
- Infrastructure · 23 March 2021
Verkada: 150,000 cameras, one admin login
Hackers viewed live feeds from hospitals, schools and factories through a single exposed super-admin account.
- Infrastructure · 16 March 2021
A data centre burned. Where were the backups?
Fire destroyed an OVHcloud data centre in Strasbourg. Some customers lost everything because backups sat in the same place.
- Infrastructure · 16 February 2021
A water plant, TeamViewer and a shared password
Someone remotely changed chemical levels at a Florida water plant. Reports point to shared TeamViewer access and Windows 7.
- Infrastructure · 29 September 2020
When ransomware hits hospitals
A major US hospital chain is back on paper after a ransomware attack. Downtime procedures are part of security.
- Infrastructure · 25 August 2020
The breach without a hacker: open databases
Researchers keep finding databases with millions of records and no password. Nobody broke in; the door was open.
- Infrastructure · 28 July 2020
Garmin went dark for days
A ransomware attack took down Garmin’s fitness services, call centres and pilot apps. Customers felt it immediately.
- Infrastructure · 23 June 2020
Ripple20: hidden bugs in millions of devices
One small network library inside printers, medical devices and industrial gear has serious bugs. Patching won’t be easy.
- Infrastructure · 9 June 2020
Ransomware paused Honda’s factories
A cyberattack hit Honda’s internal network and stopped production at some plants. Factories need network separation.
- Infrastructure · 28 April 2020
Your home router is now an office router
Remote work moved company traffic onto home networks. Ten minutes on the router makes a real difference.
- Infrastructure · 3 March 2020
Let’s Encrypt is revoking 3 million certificates
A bug means millions of certificates will be revoked tomorrow. Check yours and renew today, or visitors will see errors.
- Infrastructure · 7 January 2020
Windows 7 support ends next week
From 14 January, Windows 7 gets no more free security updates. What to do with the PCs still running it.
- Infrastructure · 15 October 2019
sudo -u#-1: a bug in an unusual config
A sudo bug lets some users run commands as root. It only affects one kind of rule, but check yours.
- Infrastructure · 30 July 2019
Capital One: a firewall setting and cloud credentials
Data on about 106 million people leaked through a misconfigured firewall that could reach cloud credentials.
- Infrastructure · 18 June 2019
Exim mail servers are being taken over
A critical Exim bug disclosed this month is now mass-exploited. Many cPanel and Linux mail servers run it.
- Infrastructure · 19 February 2019
runc bug: a container can take over its host
A flaw in runc, used by Docker and Kubernetes, lets a malicious container gain root on the host. Update this week.
- Infrastructure · 29 January 2019
DNS hijacking: protect the account behind your domain
Attackers redirected government domains by logging into DNS accounts. A US emergency directive lists four steps anyone can take.
From the archive
Notes from my old blog on mohamedsharaf.net (2010–2018), rewritten and checked. Some are dated; the dates tell you how much.
- Infrastructure · 12 June 2014
Blocking Facebook on a home or office network
Find which domains an app really uses, then block them at the router or with DNS filtering.
- Infrastructure · 7 September 2013
Hard disk failure: what the symptoms tell you
No spin, a burning smell, clicking: what each sign usually means, and the one rule when data matters.
- Infrastructure · 20 October 2012
Free public DNS servers worth using
Fast, free DNS resolvers you can use instead of your ISP’s, including family-safe options.