Zyel / Updates
What happened, who it affects, and which questions are worth asking. Clear explanations for the people building, running and paying for software.
15 articles
Security / Field note
An authenticated browser can still be drawn into an unwanted action or encounter unsafe page content. CSRF protection, careful output handling and session controls address different parts of that everyday portal risk.
Security / News explained
The October 26 Windows packages include a repaired Brotli decoder while retaining the same PHP runtime versions. The distinction matters for applications that enable automatic decompression in cURL.
Security / News explained
AWS’s November 2 advisory concerns generated SQL in the awswrangler Iceberg writer. The fix is available, and the permissions of both catalog editors and the job consuming their metadata deserve attention.
Security / News explained
AWS’s November 2 MCP advisory covers JSON-file reads outside the intended status directory, with writes possible when enabled. Server version 0.2.1 contains the fix.
Security / News explained
CISA lists CVE-2026-97229 as exploited. GitLab’s October patches and Ruby’s follow-up explain why user-supplied patterns need attention below the pipeline configuration.
Security / News explained
AWS’s November 3 advisory identifies privilege escalation in affected Babelfish extensions. Patched releases are available; the extension and its deployment need the right update.
Security / News explained
AWS reports stored XSS in maplibre-gl-js-amplify through version 4.0.2. Version 4.0.3 fixes affected rendering paths for location properties and geofence identifiers.
Security / News explained
AWS’s November 3 advisory concerns the Redshift JDBC driver before 2.3.0. The important boundary is who can influence the application’s connection configuration.
Security / News explained
CISA added a WordPress Core upgrade flaw to its exploited-vulnerability catalog on November 3. The fix is available; the maintenance process deserves attention too.
Security / Field note
A rejected login is only the first event. Follow the signal through logging, detection, notification and a human response.
Security / Field note
Changing addresses can hide a pattern from a simple rate limit. Account behavior and a tested response give the traffic a more useful meaning.
Security / Field note
Signing in proves an identity. Each record lookup still needs to establish which customer, role and operation that identity may access.