Contracts have a force majeure clause for unforeseeable events. Additionally, they need a farce majeure clause, for the obvious ones.

Rapid7 puts the average gap between a high-severity disclosure and active exploitation at three days. Plenty of enterprise patch policies still run a 30-day cadence and change board that meets on Thursdays.

Three security stories this week... CA's private keys were single-digit numbers. PHP had an RCE that fires before any app code runs. Hijacked Tor relays harvested SSH passwords. Each one sat in a previously trusted layer.

Eight private keys, all between 4 and 237. My money's on a key generation script with a test default?

PHP2Shell hits every PHP build back to v5.4. Fix ships for v8.2 through v8.5. Anyone else about to inventory v7.x boxes still serving traffic because the app "just works?”

Deployment vendor called it zero-touch provisioning. It took four of us touching it all afternoon yesterday and a large portion of this morning.

Cloudflare's write-up on the eMudhra keys asks developers not to fix the new certificate errors by disabling verification. They had to put that in bold, in 2026, because… Reasons.

Tech’s obsession with vertical integration this year: chips, data centers, models, apps, all under one roof. I've been pursuing horizontal integration instead, and the returns have been excellent.

On-call this morning, a junior said "Oh, that alert always does that." Morgan Freeman in the distance: The alert did not always do that.

Employee charged with planting a recording device in an AI lab's office. Enterprise security teams across the country just looked at their conference room speakerphones a little harder.

CoreWeave's 2032 bonds briefly touched 15% yield this week. The debt runs another six years, on GPU capacity. Engineers who’ve run a hardware refresh know what a 2026 accelerator is worth in 2030… Someone’s on the hook to explain this to finance dept.

Leadership approved our request for a staging environment. For cost reasons, it will be shared with production.

Has anyone actually applied the Ivanti fix in prod yet, or are we still waiting on the change window?

Runbook for a popular vacation destination’s “Crown Jewels” database failover was last edited by a user named "Admin" in December 2018. They, as an organization, have placed a lot of eggs in the Admin basket.

Ubuntu's front door went dark for four hours last week, the second time this year. Time for some introspection @ubuntu ?

Adobe patched 140 vulnerabilities across 10 products, including Photoshop, Bridge and FrameMaker. 140 patches for the tools they think so highly ($$$) of. Remind me tomorrow?

AI labs have perfected one part of incident response… A blog post. Sandbox escape gets 4,000 words, a diagram, and a thoughtful lessons-learned section. Perhaps a “talk” at a convention. No follow-up on the shortcomings? How bizarre.

Zero-day chain gave attackers root on fully patched Ivanti VPNs. Compliance dashboards show every one of those boxes at 100%, and they’re correct.

If your k8s pods read secrets from env vars or subPath mounts, rotation does nothing until a restart… Mount the whole Secret as a volume and reread the file, or trigger a rollout when it rotates. Otherwise, rotation policy is a fictional tale.

Years ago, a junior was the only one at his site who'd touched Cisco, so he became the IOS expert. They sent him alone to add a switch to a Nortel network. Spanning tree dropped 4,000+ AS/400 sessions. In consulting, expertise is too often assigned via spreadsheet.

Three CISA KEV remediation deadlines passed yesterday. Numerous POA&Ma are being updated to "in progress" today which is the federal-speak for "not started."