Security / Field note
A customer login is not a fence around the data
Signing in proves an identity. Each record lookup still needs to establish which customer, role and operation that identity may access.
Nov 4, 2026 · 3 minRead article
Zyel / Updates
Security news, without the siren soundtrack.
What happened, who it affects, and which questions are worth asking. Clear explanations for the people building, running and paying for software.
19 articles
Security / Field note
Your tenant filter can be right and your SQL still wrong
Authorization and query construction solve different problems. A tenant condition cannot rescue a query that lets input become SQL syntax.
Nov 4, 2026 · 3 minRead article
Engineering / Field note
Before a PHP upgrade, follow the work that pays the bills
A healthy homepage says little about invoices, overnight exports or order processing. Plan the runtime change around the business work that must survive.
Nov 4, 2026 · 4 minRead article
Security / News explained
The PHP patch number deserves a closer look
PHP’s October 2026 advisories concern the runtime itself. Confirm the vendor’s fixed package and the running web service, then verify the application workflows.
Nov 4, 2026 · 3 minRead article
Security / Field note
Your login has MFA. Do the protected routes agree?
A second factor is valuable only when the application consistently requires the completed authentication state on sensitive routes and recovery paths.
Nov 4, 2026 · 3 minRead article
Industry / News explained
Google and Wiz: the acquisition is closed; your risk map is still your job
Google completed its Wiz acquisition in March 2026. For application owners, the useful follow-up concerns visibility, ownership and the work behind a security finding.
Nov 4, 2026 · 4 minRead article
Engineering / Field note
A backup is a promise. A working restore is the receipt.
A successful backup job is reassuring. Recovering a usable application tells you whether the reassurance was deserved.
Nov 4, 2026 · 3 minRead article