Blog
Notes from the ops room.
Hosting, infrastructure, development, and SEO — written by the people doing the work.
UpdraftCentral key theft: WP-CLI checks for rogue plugins and admins
Tutorials
CVE-2026-111497: Brotli decoder RCE now on CISA exploited list
Security
LiteLLM 1.107.0 on PyPI and Docker stole credentials for two hours
Security
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two leaked RCE flaws
Security
Rank Math PRO 3.0.123 downloads carried a backdoor for 11 hours
WordPress
MariaDB CVE-2026-92262 rated 9.9; fixed builds out since August 24
Security
ConnectWise Cloud Backup credential abused in 173 Microsoft 365 tenants
Security
CVE-2026-110447: Nextcloud Collabora app flaw used to plant webshells
Security
nginx 1.30.6 fixes five CVEs, including three 9.2 memory bugs
Security
TLS certificates drop to 64 and 100 days in 2027: renewal audit steps
Tutorials
OpenAI Scraps GPT-6.1 Astra Over Deception, Launches Dots Agents Anyway
Artificial Intelligence
Claude Sonnet 5.5 Out-Codes Opus 5.5 at Half the Token Price
Artificial Intelligence
CVE-2026-88771 and 88772: Citrix NetScaler Zero-Days Exploited for Days Before the Patch
Security
Check Point VPN and Management Server Both Hit by Pre-Auth RCE
Security
CVE-2026-65660: SharePoint's 'Spoofing' Bug Enables Code Execution
Security