Blog

Notes from the ops room.

Hosting, infrastructure, development, and SEO — written by the people doing the work.

Latest Nov 12, 2026 Security

CVE-2026-119618: Apache 2.4.71 fixes unauthenticated HTTP/2 RCE

Apache httpd 2.4.55 through 2.4.70 with HTTP/2 enabled can be taken over remotely through a mod_http2 thread-safety bug. Fixed packages are out for RHEL 9, RHEL 10 and Debian 13; Ubuntu has none yet.

Read article

Nov 11, 2026 Security

N-able pulls N-central offline over 33 zero-days, ships fix for seven

A researcher dumped exploit code for 33 alleged N-central flaws on November 8. N-able's Hotfix 2 (build 2026.4.1.26) fix...

Read article

Nov 10, 2026 WordPress

Contact Form 7 6.2.4 fixes CVE-2026-114432 upload flaw; PoC due Nov 19

Contact Form 7 6.2 through 6.2.3 let unauthenticated visitors leave arbitrary files on the server, which run as PHP on s...

Read article

Nov 9, 2026 Tutorials

SPF, DKIM and DMARC setup for Gmail, Yahoo and Outlook rules in 2026

Build an SPF record under 10 lookups, publish 2048-bit DKIM keys, and move DMARC from p=none to p=reject using aggregate...

Read article

Notes from the ops room.

CVE-2026-119618: Apache 2.4.71 fixes unauthenticated HTTP/2 RCE

More articles

N-able pulls N-central offline over 33 zero-days, ships fix for seven

Contact Form 7 6.2.4 fixes CVE-2026-114432 upload flaw; PoC due Nov 19

SPF, DKIM and DMARC setup for Gmail, Yahoo and Outlook rules in 2026

More from the blog

Claude Code approval file left 1,379 secrets in public GitHub repos

CVE-2026-19868: SonicWall SSL-VPN flaw skips SAML MFA, now exploited

CVE-2026-123158: long passwords bypass OpenSSH logins on Alpine Linux

CVE-2026-109518: APT flaw lets a hostile mirror install packages as root

Synology NAS units on outdated DSM hit by C3RB3R ransomware

Set up automatic security updates on Ubuntu 24.04 and AlmaLinux 9

Registrar DNS hijacks hit DebugBear and at least 12 Name.com domains

CVE-2026-119977: WordPress core updater RCE hits 4.7 through 7.1.3

Binance links $6.3B theft to a compromised DevOps engineer laptop

CVE-2026-46300: May Linux kernel bug chained with PHP2Shell for root