Software
Everything I’ve written on Software, newest first.
New
- Software · 22 October 2026
PHP2Shell: update PHP and restart every worker
Two critical bugs in PHP itself allow remote code execution on web servers. Patches are out for 8.2 to 8.5. Older versions need your distribution or an LTS vendor.
- Software · 14 October 2026
1,413 fixes in one Patch Tuesday
Microsoft’s October update fixes a record number of vulnerabilities, including an exploited Windows Shell bug. Start with that one.
- Software · 8 September 2026
EU Cyber Resilience Act: reporting starts on Friday
From 11 September, makers of software and connected products sold in the EU must report actively exploited vulnerabilities within 24 hours.
- Software · 1 September 2026
Sign your releases so customers can check them
After a year of poisoned packages, being able to prove a release came from your build system is no longer optional.
- Software · 13 August 2026
Which PHP versions still get security fixes?
PHP 8.1 stopped getting security fixes at the end of 2025, and 8.2 follows this December. Check what your servers run.
- Software · 6 August 2026
Path traversal: ../ is still breaking apps
If a filename from the user ends up in a file path, someone will try ../../etc/passwd. Check the final path, not the input.
- Software · 23 July 2026
Rate-limit your login and API endpoints
Without limits, one script can try thousands of passwords, scrape your data or run up your bill. Add limits before you need them.
- Software · 7 July 2026
Open redirects make phishing links look like yours
A link on your domain that forwards to any URL lets attackers borrow your name. Only redirect to places you choose.
- Software · 2 June 2026
Every risky feature needs an off switch
When a feature misbehaves or is being abused, the fastest fix is turning it off, without a deploy.
- Software · 14 May 2026
AI is finding bugs faster. Plan for bigger patch days
Microsoft says its own AI system found bugs fixed this month. Vendors everywhere are shipping more fixes. Your update process has to keep up.
- Software · 31 March 2026
security.txt: tell people where to report bugs
When someone finds a hole in your site, they need a way to tell you. A two-line file makes that easy.
- Software · 20 March 2026
Pin GitHub Actions to a commit, not a tag
Attackers backdoored the Trivy scanner and rewrote its GitHub Action tags. Pipelines pinned to tags ran the attacker’s code.
- Software · 5 March 2026
Rotate secrets without breaking production
Most teams never rotate API keys because they’re afraid of downtime. Design for two valid keys at once and it becomes boring.
- Software · 21 October 2025
Your dependencies are code you didn’t review
One phished maintainer can push malware into thousands of apps. Simple habits that limit the damage.
- Software · 27 June 2024
polyfill.io and the scripts you load from strangers
Over 100,000 sites served malware because they loaded a script from a domain that changed owners. Check your pages.
- Software · 19 March 2024
Your web app doesn’t need the database root user
If the app connects as root, one SQL injection owns everything. Give it its own small user.
- Software · 4 April 2023
3CX: when the signed installer is the malware
A real, signed 3CX desktop app shipped with malware inside. What to do, and why “it’s signed” isn’t enough.
- Software · 18 October 2022
Toyota: an access key public on GitHub for five years
Part of an app’s source code, with a server key inside, sat in a public repository since 2017. Check your contractors too.
- Software · 27 September 2022
Optus and the API anyone could call
Data on up to 9.8 million Australians leaked. Reports point to an API that didn’t check who was asking.
- Software · 26 July 2022
The Confluence app that shipped with a password
Installing one Atlassian app created an account with a fixed password, and that password is now public. Check yours.
- Software · 19 April 2022
Stolen OAuth tokens: review your GitHub apps
Attackers used tokens stolen from Heroku and Travis CI to download private GitHub repos. Check who can read your code.
- Software · 5 April 2022
Spring4Shell: check your setup, then patch
The new Spring Framework bug is serious but narrower than Log4Shell. Here’s how to know if you’re affected.
- Software · 9 November 2021
Trojan Source: code that lies to reviewers
Hidden text-direction characters can make code look harmless to a reviewer while the compiler sees something else.
- Software · 19 October 2021
Twitch’s leak came from a server setting
Source code and creator payouts leaked after what Twitch calls a server configuration error. Misconfiguration is a breach too.
- Software · 27 April 2021
Codecov: when your CI script steals your secrets
A tampered Codecov upload script sent CI environment variables to attackers for months. Rotate, then verify what you run.
- Software · 23 February 2021
Dependency confusion: a package name is an attack
A researcher got code running inside Apple, Microsoft and PayPal by publishing public packages with their internal names.
- Software · 26 September 2019
vBulletin zero-day: patch your forum now
A pre-login remote code bug in vBulletin was published without warning, and a patch is out. Forums are under attack.
- Software · 9 July 2019
One bad regex took down Cloudflare
A new firewall rule with a costly regular expression maxed out CPUs worldwide for 27 minutes. Test the boring changes too.
- Software · 4 June 2019
885 million records, one changed number in a URL
First American exposed mortgage documents because anyone could change a document number in the link.
- Software · 30 April 2019
Docker Hub breach: check your build tokens
Data on 190,000 Docker Hub accounts was exposed, including GitHub and Bitbucket tokens used for automated builds.
From the archive
Notes from my old blog on mohamedsharaf.net (2010–2018), rewritten and checked. Some are dated; the dates tell you how much.
- Software · 7 February 2016
Run PhpStorm (or any JetBrains IDE) from a USB drive
Keep the IDE and all its settings in one folder you can carry on a flash drive or sync to the cloud.
- Software · 11 January 2014
Large-scale JavaScript architecture: modules, facade, mediator
Addy Osmani’s classic answer to growing JavaScript apps: independent modules that only talk through a mediator.
- Software · 3 November 2010
PHP vs ASP.NET vs Java EE: the 2010 view, and today’s
How the three big web platforms compared in 2010 on cost, support and hosting, and how much of that still holds.