Security — Blog — Caleb Dorris

A refrigeration controller display showing a setpoint of minus 20 degrees and an actual temperature of plus 50 degrees in defrost mode, under the headline Your smart equipment is an attack surface

2 November 2026, 10:00 AM · 13 min

IoT Security for Small Businesses: Your Smart Equipment Is an Attack Surface

Overnight on November 1, attackers warmed up shop freezers in seven European countries, weeks after hundreds of French supermarkets were hit the same way. Here's how they got in and a seven-step plan for the connected eq

A dark desk at night with a laptop showing a terminal, a brass padlock and key beside it, under the headline Extension 2.1.313? Check Now.

30 October 2026, 11:25 AM · 11 min

Was Your Cursor Install Backdoored? How to Check for the Claude Code 2.1.313 Extension

On October 29, Cursor's marketplace served a tampered Claude Code extension that tried to plant an SSH backdoor. Here's the one-minute check, what to remove if you were hit, and why this is a supply-chain story, not an A

A heavy steel vault door standing open in a dark server room, with a thin glowing line running out from its keyhole.

30 October 2026, 9:00 AM · 10 min

The Binance Hot Wallet Drain: How One EIP-7702 Delegation Can Empty a Wallet

A Binance hot wallet was delegated to a sweeper contract through EIP-7702, and billions left minutes later. Binance now points to a compromised engineer laptop. Here's what the EIP does, what the chain shows, and what I'

Cover reading "HIPAA-Compliant, Explained" with a Dev · Security tag: a glowing teal shield with a white medical cross, linked to blank document cards, an amber padlock and a server rack.

28 October 2026, 10:00 AM · 11 min

What "HIPAA-Compliant" Actually Means When You're Building an App

Nobody is HIPAA certified, and SOC 2 isn't a badge. Here's what the rules actually ask of the software, what a BAA is, where SOC 2 fits, and the checklist I build to when an app will hold health information.

Cover reading "Scope Your Agent's Access" with an AI · Security tag: a friendly glowing teal figure holding a single amber key in front of three dark doors, where only the first door's keyhole glows and the other two stay padlocked.

25 October 2026, 9:31 PM · 6 min

Before You Give an AI Agent Real Access, Scope Its Permissions

Anthropic confirmed Claude requested a token it wasn't asked for and queried a fee-gated Georgia dashboard of aggregate vote counts. Georgia officials say the voter registration system was never touched. Here's how small

24 October 2026, 8:47 PM · 6 min

Newsletters Plugin SQL Injection (CVE-2026-111402): Update to 4.18.2 Now

A critical SQL injection in Tribulant's Newsletters plugin for WordPress needs no login, and Patchstack expects it to be exploited. Version 4.18.2 fixes it. Here's how to check your site, update, and look for signs someo

Cover reading "Update Prime Mover to 2.2.2" with a Security · WordPress tag: glowing teal data blocks ride a conveyor into a dark moving crate while an amber speech-bubble block cracks open with bright light leaking out.

24 October 2026, 2:06 PM · 6 min

Prime Mover Vulnerability (CVE-2026-115806): Update to 2.2.2 Before Your Next Migration

A critical bug in the Prime Mover backup and migration plugin lets anyone who can leave a comment plant a payload that goes off the next time an admin runs an export or restore. Version 2.2.2 fixes it. Here's what to do.

Cover reading "Turn Off HTTP/3?" with a Security · Infrastructure tag: a stream of tiny glowing teal data packets flowing into a dark server rack while a huge amber balloon inflates out of its top vent, straining as if about to burst.

24 October 2026, 12:30 PM · 9 min

HTTP/3 Vulnerability in QPACK: Should a Small Site Turn Off HTTP/3?

FoxIO found that tiny HTTP/3 requests can balloon server memory through QPACK header compression. Most of the big libraries are already patched. Here's what it means for cPanel, LiteSpeed, nginx, Cloudflare and Vercel si

Cover reading "Patch the Brotli Bug" with a Security · Dev tag: glowing teal data blocks squeezing through a dark funnel while one amber block cracks and spills bright fragments over a circuit-patterned floor.

24 October 2026, 11:31 AM · 7 min

Brotli Vulnerability in Node.js: What Next.js and Node Apps Need to Patch

Node2Shell, CVE-2026-111497, started as one line in the October 21 Node.js release. It turns out to be a bug in Google's Brotli library, so Bun, Envoy, Istio and Python's Brotli packages need fixes too. Here's what to up

Cover reading "Stopped at Review" with an AI · Security tag: a small, curious robot reaching toward a glowing archway of code and being gently stopped by a shimmering hexagonal barrier marked with an amber padlock and checkmark seal.

23 October 2026, 1:30 PM · 11 min

An AI Agent Tried to Sweet-Talk Its Way Into a Real GitHub Project. Here's What Stopped It

During a UK AI Security Institute test, Claude Mythos 5 improvised a full social engineering campaign against a real open-source maintainer. The new reports are fascinating, and the defenses that worked are ones any smal

Cover reading "Audit Your WordPress Site Now" with a Security, WordPress tag: glowing green puzzle-piece modules in a dark server rack, with a magnifying glass over one cracked red piece.

23 October 2026, 10:00 AM · 17 min

How to Audit Your WordPress Site After October 2026's Plugin Compromises

Stolen UpdraftCentral keys and a backdoored Rank Math PRO release put backdoors on WordPress sites this month, and the Amelia booking plugin patched a critical SQL injection. Here's how to tell if you're affected, and th

Cover reading "What to Patch This Week" with a Security, Oct 2026 tag: hands swapping a drive in an open server rack lit by amber status lights.

22 October 2026, 5:05 PM · 57 min

October 2026 Security Patches: What to Patch This Week

PHP, GitLab and Node.js all shipped critical fixes on October 21, and a batch of Linux kernel bugs went public before the patches did. Here's the order I'd work through them.

Cover reading "Is PHP 8.5 Worth It?" with an Upgrade Guide tag: a cracked, rusted old engine next to a gleaming new purple engine in a garage at dusk.

22 October 2026, 5:00 PM · 8 min

Still on PHP 7 or 8.1? Why You Should Upgrade to PHP 8.5

PHP 8.1 and older stopped getting security fixes, and this week's PHP2Shell patches skipped them. Here's what upgrading to PHP 8.5 gets a business, what breaks, and how I run the upgrade.

Cover reading "Rotate Your API Keys" with a Security runbook tag: a hand adding a new key to a ring of old keys on a dark workbench, with discarded keys beside it.

22 October 2026, 12:05 PM · 28 min

How to Rotate API Keys After a Breach Without Downtime (A Runbook)

Railway's preliminary report confirms that at most 1.85% of workspaces had environment variables potentially exposed. Here's what Railway confirmed, and how I rotate keys with an overlap window so nothing goes down.

Cover reading "Lock Down Composer" with a Security tag: a warehouse shelf of shipping crates, one chained shut with a padlock and wax seal beside a pried-open crate glowing with a suspicious package.

22 October 2026, 12:00 PM · 11 min

Composer Supply Chain Attack Checklist for PHP Projects

Attackers hit Packagist three times this spring with stolen GitHub access. Here's what happened, what Composer changed, and the checklist I use to lock down a PHP project's dependencies.

PHP2SHELL title card on a dark screen of source code, with the line Are you secure?

21 October 2026, 8:06 PM · 18 min

PHP2Shell: AI Helped Find Two Critical Bugs in PHP Itself. Patch Today.

Two CVEs in the PHP engine allow unauthenticated remote code execution. The fixes shipped October 21, exploits are getting better, and most PHP installs still aren't patched. Here's how to check yours.