Notebook
Long-form notes on security, software and AI. Subscribe via RSS to get new posts.
Tags
Shodan in Türkiye: Passwordless VNC Screens, the ASKİ Claim and Checking Your Own Server
Shodan lists 2,507 VNC, 22,048 RDP and 3,701 Modbus records in Türkiye. What 'Security Types: None' means in the VNC (RFB) handshake, what itsmelsec's ASKİ claim does and doesn't prove, and how to check your own exposure.
7 min read · #security #shodan #scada #vnc #serverOctober 21 Security Roundup: PHP2Shell's Backstory, Java, HTTP/3, Node, Railway and OVH
How PHP2Shell went from a 2024 audit finding to an emergency patch, how to apply the fix correctly (PHP-FPM, Debian changelogs, EOL branches), plus Java CVE-2026-91403, the HTTP/3 QPACK flaw, Node.js security releases, the Railway environment variable incident and the OVHcloud CLI supply-chain attack.
10 min read · #security #php #java #nodejs #cveTwo Critical RCEs in PHP: CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities that can allow unauthenticated remote code execution. How they work, who is at risk, how to check your server, and the official mitigations until you can update.
11 min read · #php #security #server #cveI Turned My Personal Site Into a Building
Moving from WordPress to a static Astro site, I rebuilt my homepage as a cross-section of a pixel-art building. The mascot, the elevator, day and night rooms, and the technical decisions behind them.
4 min read · #open source #aiI Wrote a Doctor for My Docker
I used Docker every day but had no idea what was inside it. DoctorDock scans your local Docker for security problems, misconfigurations, and reclaimable disk in under a second — entirely offline.
5 min read · #docker #open source #securityReverse Development in the Age of AI
I sat down to write after a long break and noticed something strange: I can't think as well as I used to. What is AI doing to the way we think?
8 min read · #ai #thinking
