Blog

Notes from the ops room.

Hosting, infrastructure, development, and SEO — written by the people doing the work.

Latest Nov 10, 2026 WordPress

Contact Form 7 6.2.4 fixes CVE-2026-114432 upload flaw; PoC due Nov 19

Contact Form 7 6.2 through 6.2.3 let unauthenticated visitors leave arbitrary files on the server, which run as PHP on stock Debian and Ubuntu Apache. Update to 6.2.4 or later and lock down wp-content/uploads before WPScan publishes its pro...

Read article

Nov 9, 2026 Tutorials

SPF, DKIM and DMARC setup for Gmail, Yahoo and Outlook rules in 2026

Build an SPF record under 10 lookups, publish 2048-bit DKIM keys, and move DMARC from p=none to p=reject using aggregate...

Read article

Nov 8, 2026 Artificial Intelligence

Claude Code approval file left 1,379 secrets in public GitHub repos

Apiiro found database passwords, SSH logins, and API tokens saved by Claude Code's "don't ask again" approvals in 1,122...

Read article

Nov 7, 2026 Security

CVE-2026-19868: SonicWall SSL-VPN flaw skips SAML MFA, now exploited

SonicWall fixed CVE-2026-19868, which lets a valid password for a non-SAML login skip SAML-enforced MFA on Gen 7 and Gen...

Read article

Notes from the ops room.

Contact Form 7 6.2.4 fixes CVE-2026-114432 upload flaw; PoC due Nov 19

More articles

SPF, DKIM and DMARC setup for Gmail, Yahoo and Outlook rules in 2026

Claude Code approval file left 1,379 secrets in public GitHub repos

CVE-2026-19868: SonicWall SSL-VPN flaw skips SAML MFA, now exploited

More from the blog

CVE-2026-123158: long passwords bypass OpenSSH logins on Alpine Linux

CVE-2026-109518: APT flaw lets a hostile mirror install packages as root

Synology NAS units on outdated DSM hit by C3RB3R ransomware

Set up automatic security updates on Ubuntu 24.04 and AlmaLinux 9

Registrar DNS hijacks hit DebugBear and at least 12 Name.com domains

CVE-2026-119977: WordPress core updater RCE hits 4.7 through 7.1.3

Binance links $6.3B theft to a compromised DevOps engineer laptop

CVE-2026-46300: May Linux kernel bug chained with PHP2Shell for root

CVE-2026-98432: Linux TCP flaw rated 9.8, no Ubuntu or RHEL fix yet

UpdraftCentral key theft: WP-CLI checks for rogue plugins and admins