Email not arriving? Check where a domain’s mail goes with MX records
When messages bounce or vanish, start with two DNS checks: the MX records that say where a domain’s mail is delivered, and the reverse DNS of the…
Jimel S.·4 min read
What is my IP address? Public vs private, IPv4 vs IPv6, and what sites can see
Your settings say 192.168.1.23, but the support desk wants a different number. Here’s the difference between private and public addresses, how IPv4…
Jimel S.·4 min read
“sshole”: any long password logs in to some Alpine and musl SSH servers
On musl-based systems such as Alpine Linux, OpenSSH without PAM could accept any password longer than 256 characters for accounts that have no…
Jimel S.·4 min read
Patch PHP now: the “php2shell” flaws are under active attack
Two remote code execution bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, are on CISA’s list of exploited vulnerabilities. Update to PHP…
Jimel S.·4 min read
Ivanti Connect Secure zero-days gave attackers root on VPN gateways
Attackers chained three Ivanti Connect Secure flaws to get root on VPN appliances without logging in, starting on 3 October. The 13 October update…
Jimel S.·4 min read
November Patch Tuesday lands on the 10th: what October’s record release tells us
Microsoft’s October updates fixed more than 1,400 vulnerabilities, a new record, including a Windows zero-day that bypasses Mark of the Web and…
Jimel S.·3 min read
A fake job interview opened the door to Binance’s $6.3 billion heist
The FBI says North Korea stole more than $6 billion from Binance on or about 29 October. Binance’s incident report says it began with fake job…
Jimel S.·3 min read
DreamHost: File Manager attacker took FTP passwords and webmail logins
DreamHost says an attacker exploited third-party software behind its web File Manager and collected the FTP/SFTP passwords of people who logged in…
Jimel S.·3 min read
DigiCert breach: a migrated server left customer ID documents exposed
DigiCert says an internal system holding customer validation records was reachable from the internet, and that an outside account read customer…
Jimel S.·3 min read
“Black October”: attackers raid secrets at cloud and AI developer platforms
Northflank has told every customer to assume their environment variables were decrypted, after stolen AI API keys were used. Wiz now counts…
Jimel S.·3 min read
Is your website down? A layer-by-layer troubleshooting guide for site owners
When your site stops loading, work through it in the same order a browser does: DNS, connection, certificate, HTTP response and content. This guide…
Jimel S.·4 min read
Leaked an API key? How to rotate secrets without breaking production
Your hosting platform was breached, a .env file reached GitHub or a laptop went missing. Here’s the order to rotate secrets in, how to swap keys…
Jimel S.·4 min read