Zyel / Updates
What happened, who it affects, and which questions are worth asking. Clear explanations for the people building, running and paying for software.
16 articles
Security / News explained
AWS’s November 2 MCP advisory covers JSON-file reads outside the intended status directory, with writes possible when enabled. Server version 0.2.1 contains the fix.
Security / News explained
CISA lists CVE-2026-97229 as exploited. GitLab’s October patches and Ruby’s follow-up explain why user-supplied patterns need attention below the pipeline configuration.
Security / News explained
AWS’s November 3 advisory identifies privilege escalation in affected Babelfish extensions. Patched releases are available; the extension and its deployment need the right update.
Security / News explained
AWS reports stored XSS in maplibre-gl-js-amplify through version 4.0.2. Version 4.0.3 fixes affected rendering paths for location properties and geofence identifiers.
Security / News explained
AWS’s November 3 advisory concerns the Redshift JDBC driver before 2.3.0. The important boundary is who can influence the application’s connection configuration.
Security / News explained
CISA added a WordPress Core upgrade flaw to its exploited-vulnerability catalog on November 3. The fix is available; the maintenance process deserves attention too.
Security / Field note
A rejected login is only the first event. Follow the signal through logging, detection, notification and a human response.
Engineering / Field note
Retries are normal. Duplicate orders and charges need not be. Give each business operation an identity that survives interrupted requests.
Security / Field note
Changing addresses can hide a pattern from a simple rate limit. Account behavior and a tested response give the traffic a more useful meaning.
Security / Field note
Signing in proves an identity. Each record lookup still needs to establish which customer, role and operation that identity may access.
Security / Field note
Authorization and query construction solve different problems. A tenant condition cannot rescue a query that lets input become SQL syntax.
Engineering / Field note
A healthy homepage says little about invoices, overnight exports or order processing. Plan the runtime change around the business work that must survive.