Notes on security and engineering, from the work we do.
Threat Intelligence
On 29 October 2026, attackers got Binance’s own systems to sign away roughly US$6 billion in minutes, reportedly starting from one compromised DevOps engineer’s laptop. What is confirmed, what is disputed, and the controls every business with production access should check today.
Cybersecurity
The most serious Next.js vulnerabilities of the past year were not in application code but in the layers underneath: the framework, React Server Components, Node.js and image libraries. What was fixed in October 2026, who is affected, and how to check and patch your apps.
Cybersecurity
A flaw in eMudhra’s key ceremony left eight certificate authority keys weak. Browsers shut it down within hours and nobody appears to have been harmed, but Chrome drops an eMudhra root on 27 October. Who is affected, why your DSC is safe, and the 10-minute check to run now.
Threat Intelligence
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Here is who is affected, how to check your exposure in ten minutes, and how to fix it.
