The rulebook
Notes on PHP security, Linux servers, coding with AI, WHMCS, WiseCP and game development. Every post is a page on how a piece of work is played.
CVE-2024-27834: Apple Pointer Authentication Bypass Added to CISA KEV
CVE-2024-27834 lets attackers bypass Apple's Pointer Authentication. CISA added it to its KEV list on Nov 4, 2026. Affected versions and update steps inside.
Brotli buffer overflow (CVE-2026-111497): which versions are affected?
CVE-2026-111497 in Google Brotli is on CISA's exploited list. See which versions are affected, the fixed releases and how to check your systems.
Cisco ASA and FTD VPN denial-of-service flaw: CVE-2026-76418
CVE-2026-76418 (CVSS 8.6) hits Cisco ASA and FTD SSL VPN and is on CISA's KEV list. Check if you are affected, and what to patch or mitigate now.
GitLab CVE-2026-97229: remote code execution through CI/CD configuration
Critical CVE-2026-97229 in GitLab CE and EE, CVSS 10.0. Affected versions, fixed releases, the CISA deadline and what to do now.
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: what to do now
Root privilege escalation (CVE-2026-111357) and file upload (CVE-2026-118527) in Ivanti Connect Secure: affected versions, CISA deadlines and the fixes.
CVE-2026-46300 in the Linux kernel: skbuff flaw and update guide
CVE-2026-46300 in the Linux kernel, now on CISA's exploited list. Fixed distro versions and the update steps you need to take.
Adobe Commerce and Magento file upload flaw: CVE-2026-48356
CVE-2026-48356 lets dangerous file types be uploaded in Adobe Commerce and Magento. CISA lists it as actively exploited. Affected versions and fixes.
Remote code execution in Nextcloud's Collabora CODE server: CVE-2026-110447
CVE-2026-110447 in Nextcloud's built-in Collabora CODE server is on CISA's KEV list. Fixed in richdocumentscode 26.4.303. No workaround. Here is what to do.
PHP memory corruption flaws: CVE-2026-109618 and CVE-2026-109619
Two flaws in PHP 8.2 to 8.5 can lead to unauthenticated remote code execution. Here are the fixed versions and what to do now.
Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625): actively exploited
Arista VeloCloud Orchestrator on-prem SQL injection (CVE-2026-114625, CVSS 9.4). On CISA's KEV list and actively exploited. Affected versions and next steps.
VMware ESX insufficient logging flaw: CVE-2026-41709
VMware ESX insufficient logging flaw (CVE-2026-41709). CVSS 2.7 but listed in CISA KEV. Fixed builds and what to do now.
WordPress core CVE-2026-119977: code execution during core upgrades
WordPress core CVE-2026-119977 (CVSS 8.1, on CISA KEV). Versions 4.7 to 7.1.3 are affected, 7.1.4 fixes it. What it is and what to do.
Coding with AI: what I hand over, and what I never do
Notes from a developer who uses AI coding assistants every day. Which jobs to hand over, which not to, the traps, and a safe way of working.
Tuning PHP-FPM: how to calculate pm.max_children
Set PHP-FPM's pm.max_children by measuring, not guessing. Measuring process memory, the formula, pm modes, the status page and the slowlog.
The server is slow: 10 Linux commands to run before you panic
Ten commands that tell you within five minutes whether a slow Linux server is short on CPU, memory, disk or network, or whether the application is to blame.
The first 30 minutes on a new Linux server: a security checklist
What to do in the first half hour on a fresh Ubuntu or Debian server. SSH keys, firewall, fail2ban, automatic updates, swap and a first backup.
PHP security checklist: the 8 holes I find most in real projects
SQL injection, XSS, CSRF, password storage, sessions, file uploads and error settings: the most common holes in PHP projects, with code examples for each fix.
WHMCS or WiseCP? 6 questions to ask when a hosting company picks a panel
What to look at when a company selling hosting and domains chooses between WHMCS and WiseCP. There's no winner, only the right questions.
Making a WHMCS theme update-safe: child themes and hooks
A child theme structure, the template markup you must keep, and hook-based customisation without touching the core, so your custom theme survives WHMCS updates.
GEO: how to write content that AI answers cite as a source
Search isn't just ten blue links anymore. Structure, language and technical tips for content that ChatGPT, Perplexity and Gemini understand and quote.
Customising WiseCP without touching the core: first steps with hooks
Modules, themes, hooks and the API explained, plus practical examples with action, filter and gate hooks, so your WiseCP extensions survive every update.
60 FPS in a browser game: smooth scenes without cooking the phone
Practical notes on draw calls, shadows, textures and pixel ratio for keeping a Three.js browser game smooth on mid-range phones.
7 rules for getting a sales team to love its CRM
Setting up a CRM is easy; getting the team to actually use it is hard. Seven practical rules for a CRM your sales team opens on its own instead of avoiding.
From Excel to ERP: a switch plan that keeps the business running
Have stock, orders and production lived in Excel for years? A step-by-step plan for moving to an ERP without stopping the business or losing the team.
Your first field in the browser with Three.js
How do you set up the first scene of a browser game? A step-by-step start with Three.js for camera, light, a low-poly field and clickable plots.
A bilingual site with Astro: wiring hreflang correctly
How to set up URL structure, shared content keys and hreflang tags in Astro so search engines understand your Turkish and English pages correctly.
CRM or ERP? Choosing the right order for your business
A CRM runs the customer side, an ERP runs the inside of the business. Which one to start with, how the two connect and what to watch during the switch.
A site without a database: content management with Markdown and Astro
This site uses no database. Posts, projects and services are generated from Markdown files. Why I chose this path and how it works.