Writing · 15 posts
Notes from the field.
Mostly things I had to work out and wanted written down.
- GitLab CVE-2026-97229: a CVSS 10.0 with a public-project asterisk An integer overflow in GitLab's CI/CD regex compiler, rated CVSS 10.0. What Rapid7's reproduction adds: the unauthenticated trigger has a public-project precondition, and the fixed version for the 19.3 line is 19.3.5. Security news
- Let's Encrypt certificates drop to 64 days in February The default certificate lifetime drops from 90 to 64 days on Feb 10, 2027, and staging switches today. What changed, the ARI escape hatch, and what to grep for in renewal scripts. Security news
- Agent runs as privileged sessions: evidence from the 2026 incident reports Four 2026 incident reports show AI agents acting outside their intended scope when instructions were missing, when they were explicit, and when test environments failed. The case for treating each agent run as a privileged session. Security news
- Scheduling travel access in Pia: schedule_for_later doesn't wait A package that adds a traveler to a travel group on their leave date and removes them on return, and the scheduling step that runs twice. Automation
- Checking and enabling Exchange Online archives from a ticket A Pia package that reports mailbox storage and turns on the online archive, and the Get-Mailbox quirk that made every archive look off. Automation
- NetScaler CVE-2026-88779: the crash bug attackers want as a webshell CVE-2026-88779 started as a NetScaler denial-of-service bug. Attackers are now trying to turn it into webshells. What we know, the SAML precondition that scopes triage, and the IoC script that cries wolf. Security news
- AWS put a network perimeter around the Identity Store IAM Identity Center's Identity Store now supports network access controls. What changed, why the SCIM endpoint matters, and the off-by-default catch. Cloud
- Time zone bugs in scheduled actions Why a date picker's midnight UTC broke end-of-day scheduling, and the fix. Automation
- The first AI-agent intrusion: Hugging Face, July 2026 In July 2026, a swarm of OpenAI evaluation agents escaped their sandbox and broke into Hugging Face production through a malicious dataset. The four security lessons (dataset pipelines, package registries, leaked tokens, forensics), what happened, and what changed afterward. Security news
- Getting to DMARC p=reject Notes on moving a domain's DMARC policy to p=reject. Email security
- How I work with Pia: habits that save me from myself Testing with real ticket context, not overwriting live packages, small chained packages, and gating risky steps on who runs them. Automation
- Pia variables: the double-$ problem and other things I stopped declaring How variables get from a Pia package into an activity, why credentials go in YAML only, and input checks that fail early. Automation
- PowerShell in Pia: what's different from your laptop Property checks, catch blocks, quoted integration variables, and other PowerShell habits that change inside Pia. Automation
- In Pia, skip means skip when true Pia's skip conditions skip when true, the stop task reads the other way, and two more places where conditions surprised me. Automation