heh what do we have over here…
Node.js Brotli RCE: CVE-2026-111497, PoC Status and Fixes
I just wrote about PHP2Shell and PHP’s request-lifecycle bugs. Now Node.js has its own runtime security update to deal with. Different engine, different failure mode, same uncomfortable reminder: safe-looking application code still depends on native code underneath it. On 21 October 2026, Node.js released fixes for 10 CVEs. The one I want to spend time on is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that permits remote code execution. ...
PHP2Shell: CVE-2026-109618 & CVE-2026-109619, PoC and Fixes
Two critical PHP CVEs landed on 21 October 2026, and this is not another vulnerable WordPress plugin story. The problem is underneath the application, inside PHP’s request lifecycle. That is the part I care about when looking at this from a vulnerability assessment and penetration testing (VAPT) perspective. Your application can have sensible authentication, clean input validation and a green static application security testing (SAST) report, and still sit on a vulnerable interpreter. ...
Malaysian devs aren't behind on agentic AI. Enterprise just moves slower
I came across a take in one of the tech talks going around lately that stuck with me: software engineers in Malaysia are still a bit behind when it comes to agentic AI. I get why someone would think that. Scroll Threads or X and it feels like everyone else is shipping apps with Claude Code over the weekend while our local dev scene stays quiet. But I don’t think “behind” is the right word. Quiet, yes. Slower to roll it out at work, sometimes. Behind? That depends on which 10% of the market you are looking at. ...
Mobile dev is getting ridiculous (in a good way)
I built an iPhone app without owning a Mac. Then I made it run on Android too. The whole thing took about nine days, and most of it happened on Linux servers I talk to from my phone. That sentence would have sounded like a scam a couple of years ago. Now it’s just how my week went. What CaptionCam does CaptionCam is a small app I wanted for myself. You record or import a video, it transcribes the speech on the phone, you fix the captions, and it exports an MP4 with the subtitles burned into the picture. The ones with the yellow word that follows along as you talk, like every other short video out there. ...
Cloudflare OS: what's the point?
First, it’s not an OS Cloudflare OS is an open-source AI productivity environment, originally built for Cloudflare’s own staff. Think agent chat, workspaces, and small apps you can build and share with other people. Cloudflare calls those apps “Gadgets”, with “Gatekeepers” controlling what agents and apps can access. Disclaimer before anyone gets excited: this is not an operating system like Linux or Windows. You are not installing it on your laptop to replace Ubuntu. The OS name is about managing AI workloads and company productivity. Fair enough, but quite a name to live up to. ...