A CVE Is Not an Answer to "Are We Affected?"
When a serious CVE lands, "do we use it?" is the first question. It isn't the answer a CTO, customer or board needs. The questions that follow decide what you patch first.
Latest posts
Did the Next.js Patch Reach Every App?
Next.js has fixed two unauthenticated remote code execution bugs. Patching the main app is the easy part. The app that gets hit is usually the one nobody remembers owning.
Archive
Where Do PHP and Node Actually Run?
PHP2Shell and Node2Shell are both on CISA's list of exploited vulnerabilities. Before you can patch, you need to know where the runtimes are, and the official Docker images hide them from most scans.
Reachability Is a Traversal Problem, Not a Lookup Problem
Most security tools answer "can A reach B?" by matching against stored rules. That is the wrong abstraction. The answer lives in the graph, and it requires walking the structure to find out.
Three Questions to Ask Before Approving a Network Change
Most risky network changes do not fail because the engineer forgot a command. They fail because the review never forced the team to make the blast radius, rollback point, and verification plan explicit.
Why DNS Is Often the Missing Layer in Incident Reviews
Teams investigating a network incident usually jump straight to routing, firewalls, and service health. DNS often gets checked too late, even though it is where many partial failures begin.