Security / Field note
Your tenant filter can be right and your SQL still wrong
Authorization and query construction solve different problems. A tenant condition cannot rescue a query that lets input become SQL syntax.
Nov 4, 2026 · 3 minRead article
Zyel / Updates
Security news, without the siren soundtrack.
What happened, who it affects, and which questions are worth asking. Clear explanations for the people building, running and paying for software.
15 articles
Security / News explained
The PHP patch number deserves a closer look
PHP’s October 2026 advisories concern the runtime itself. Confirm the vendor’s fixed package and the running web service, then verify the application workflows.
Nov 4, 2026 · 3 minRead article
Security / Field note
Your login has MFA. Do the protected routes agree?
A second factor is valuable only when the application consistently requires the completed authentication state on sensitive routes and recovery paths.
Nov 4, 2026 · 3 minRead article