12 posts tagged with "Security"

PHP2Shell is the name for two use-after-free flaws in the PHP engine, and PHP shipped the fixes on October 21, 2026. My position: patch on your normal urgent schedule, check the exploit conditions against your own servers, and do not download or run anything a stranger on X calls an exploit or a fix. The bugs deserve a patch, the panic deserved much less, and the exploit and fix scripts shared on social media were worse than useless.

Next.js plans an out-of-band security update on Wednesday, October 14, 2026, for three vulnerabilities in upstream dependencies: two Critical and one High. Out-of-band means outside the regular release schedule. The affected versions arrive only with the update, so my call is to prepare now: list every Next.js app, name an owner, dry-run a dependency-only deploy and write the smoke test before the advisory is published.

Ally shipped an unauthenticated SQL injection to 400,000+ WordPress sites, and exploit traffic arrived before many of them had updated. Plan for that order of events, because the next plugin will repeat it.

GitHub's agentic workflow architecture is a set of promises until CI enforces them, and a promise has never failed a build. For Drupal module and WordPress plugin maintainers, I treat CI as a policy enforcement plane. Its first job is to block risky behavior, and running builds is its second.

Two valid changes to the same service inside fifteen minutes at 2 a.m. is where the outage lives, and single-metric dashboards stay green the whole time. Cloudflare wrote a postmortem about this blind spot: stacked low-signal anomalies that every alert checks alone and nobody checks together. I turned it into an enforceable playbook, so the next on-call learns the pattern from a document and not from an incident.

Passkey credentials should not double as data-encryption keys. The design looks elegant in review, and then a user switches phones and their data stays behind with the old device. The passkeys critique made this failure mode hard to ignore, so these are the guardrails I would enforce in any architecture review before that design reaches production.

If AI agents can open pull requests, secret scanning has to block the merge. A scanner that only reports will write accurate notes about a key that already reached the protected branch. My baseline has three layers: a pre-commit hook for fast feedback, a required CI check for enforcement, and a break-glass path (a controlled emergency bypass) that policy governs and audit logs record.

I reviewed the GitGuardian MCP integration pattern and tested it against agent-generated pull requests. MCP is the Model Context Protocol, a standard way for an AI agent to call external tools. My call: teams shipping AI-assisted code should adopt this now.

Drupal contrib security review needs explicit access decisions, CSRF protection on state-changing routes, output checks and a repeatable release gate. This checklist focuses on those checks and the limits of grep-based searches.

Vault sprawl in multi-team CI/CD usually comes from weak governance, and another tool will not fix it. The model that works has four parts: short-lived identity-based access (OIDC/workload identity), path ownership boundaries, policy as code with review gates, and rotation and usage controls that each team can measure. If you change only one thing, replace stored CI tokens with OIDC and short-lived credentials.

The Wordfence blog feed lists vulnerable plugins, but it cannot tell a team whether its own sites run them. I built a WordPress plugin that adds wp wordfence-audit plugins and answers that question from the current feed. It is a triage step for teams that already read the feed. A full vulnerability database still covers what the feed never publishes.

AI made finding vulnerabilities cheaper, but it did not make fixing them cheaper. The cost lands on an open-source maintainer with limited hours, who now has to sort a flood of security reports into urgent, false positive and later. Drupal AI Vulnerability Guardian works on that sorting step: it scans Drupal modules for 12 vulnerability patterns and gives each finding a score, a CWE ID and an estimate of the work to fix it.

A skill from a public marketplace arrives with code, setup instructions and a download count. The download count is no evidence of safety. I built Skills Sentry, a static scanner that reads a skill bundle without running it and scores its risk before the bundle touches my machine.