Two critical PHP core bugs leaked a day before the embargo. The fix ships on October 21, and most PHP servers on the internet will not get it.
php2shell, Two Critical PHP Bugs Leaked Before the Patch
A New Way to Query HTTP APIs with a Body
You’ve probably shipped a POST endpoint that only reads data, because GET can’t carry a body and the URL got too long. HTTP finally has a method for that.
CLI Authentication, the Right Way
Most CLI auth flows spin up a localhost server and pray your browser cooperates. That model breaks the moment you’re SSH’d into a server. RFC 8628 fixed this in 2019 and a lot of tools still haven’t caught up.
Anyone on the Internet Can Ring Your Doorbell
Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device’s persistent password and lets anyone on the Internet hijack the next live call.
Nginx Ingress Is Dead: Your Complete Guide to What Comes Next
The Kubernetes team has retired the nginx ingress controller. The repo is archived, no more releases, no security patches. Here’s your complete guide to the three migration paths: Gateway API, dual-support controllers, and alternative ingress controllers, with real examples and honest comparisons.
Trivy GitHub Actions Compromised: Full Malware Payload Analysis
On March 19, 2026, the Trivy vulnerability scanner was compromised for the second time in three weeks. Attackers force-pushed 75 out of 76 version tags in aquasecurity/trivy-action to deliver an infostealer that scrapes runner memory, harvests cloud credentials, and exfiltrates everything via encrypted channels. Here’s my full analysis of the malware payload and what you need to do if your workflows were affected.
My Electronic Garden in Obsidian
How I built a plant management system in Obsidian with templating, automation, photo galleries, and interactive dashboards.
Secure Kubernetes Apps with Cert-Manager and Let’s Encrypt
Discover how to secure your Kubernetes applications using cert-manager and Let’s Encrypt. This comprehensive guide covers automated SSL certificate management, HTTPS setup, and best practices for reliable and secure deployments.
Dynamic Environment Variables in Dockerized Next.js: A Flexible Multi-Environment Solution
Learn how to manage dynamic environment variables in Dockerized Next.js applications. This flexible solution uses a custom Docker entrypoint for runtime replacement, ensuring seamless multi-environment deployments. Works for React, NuxtJS, and more!
Generate a Professional CV PDF Using Markdown and Hugo
Learn how to generate a professional CV in PDF format using Markdown and Hugo. This guide walks you through creating a streamlined workflow to manage your content effortlessly, keeping your CV and website consistent and up-to-date.