The Decade-Old Bug Is Now a One-Week Find
AI vulnerability discovery is turning years-old bugs in PHP and Linux into week-long finds. What old code you expose, who owns it, and a checklist.
Writing · Tag
Posts tagged security
31 posts on security, page 1 of 3. Or browse the full writing index →
Posts tagged security
php2shell: What to Do if Your Servers Run PHP
Two critical PHP flaws, php2shell, got fixed on Oct 21. A triage order for anyone with PHP on a server: inventory, patch and restart, mitigate, isolate.
eMudhra Distrust: Why Bumping castore Won't Save Req
Eight eMudhra CA keys were guessable. Browsers blocked them in hours. Req reads CAs from the OS first, so bumping castore usually does nothing. Here's the fix.
Claude Code and SOC 2: The Evidence Your Auditor Wants
Engineers run Claude Code and the auditor wants proof. The managed settings that work as controls, the SOC 2 criteria they support, and the evidence to give.
Your Personal Brand Is an Attack Surface
Every talk, bio, and commit you publish to build a name is also recon and impersonation fuel. A vCISO's founder-scale checklist for hardening your identity.
Would I Trust Agents to QA My Daily Driver?
Omarchy's new Agentic QA swarm tests every release. I run Omarchy on two machines and update within days. Here's what the design catches, and what it can't.
Omarchy on a Company Laptop: The SOC 2 Verdict
An engineer wants to run Omarchy on a company laptop. Here's the verdict a security lead signs off on, control by control, for a SOC 2 Type II shop.
Omarchy Runs Your Coding Agent With the Safety Off
Omarchy's launcher gives every coding agent a skip-approval flag by default. The attack surface a security lead inherits, and what Omarchy gets right.
Model Routers Are Vendors. Review Them Like One.
PRC labs harvested their own users' sessions, many arriving via third-party model routers. The fix is treating the router as a vendor.
Validating LLM Tool Call Arguments With Ecto
Ecto schemaless changesets as the pre-execution trust boundary on LLM tool-call arguments, not another output-shape validator.
Building an LLM Audit Trail That Passes SOC 2
An append-only Ecto schema for LLM calls, the fields an auditor actually samples, and why provider request IDs are what makes an entry defensible.
The Agent Evidence Pack for a Security Review
The two documents an enterprise reviewer wants for your AI agent, the allow-list and the tool-call log, specified field by field and generated from code.