~/blog / topic / security
Vulnerabilities & patches: check, prioritise, fix
When a critical vulnerability is announced, the headline matters less than three questions: am I affected, how fast can I find out, and how do I patch without downtime? Here I collect my checklists from operations, with commands you can run right away.
Checking your Nextcloud from the outside: version, support end, exposed paths
A tool that scores your own Nextcloud from the real network: version, end of life, exposed paths (config, data, .htaccess) and security headers. No login.
Website DNA: an n8n workflow sequences your homepage and finds third parties and CVEs
Enter a domain, watch the double helix: own code, third parties, libraries with known CVEs and cookies. An n8n workflow with OSV.dev and AI.
Mission Control: 90 seconds to handle a fictional cyber incident
Make three decisions in 90 seconds around a genuinely exploited CISA vulnerability. See how Mission Control was built and download the n8n workflow.
Your website as a city: an n8n workflow builds it as a miniature town
Enter a domain, explore a 3D city: sections become districts, subpages high-rises, headers watchtowers. An n8n workflow with AI and a download.
A school report card for your website: security headers, e-mail protection and certificate, graded like at school
Type a domain and get a report card: grades for security headers, SPF/DMARC and the TLS certificate, an overall grade and teacher remarks. Free.
Can these domains be spoofed? We checked SPF and DMARC of 102 well-known domains, and only half of the banks reject forged mail
SPF, DMARC and MTA-STS of 102 well-known domains: 59 reject forged mail, 21 only monitor with p=none, 6 have no DMARC. Banks, Germany and Italy compared.
We graded the security headers of 57 big websites: only 21 ship an effective CSP
A scan of 57 well-known sites: HSTS is common, CSP is not. Results by header, the four sites with grade A, and how to read the numbers fairly.
HTTP security headers in ten minutes: a safe starter set for nginx and how to test it
HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy: what each security header does, a copy-paste nginx starter set, and how to test it.
Scam radar: today's phishing emails and fake texts in plain words, updated twice a day
My new scam radar collects current scams, explains them in plain words and says what to do. How it works, and how to spot a scam before you click.
One week after PHP2Shell: attacked in the wild, and now a Linux kernel flaw on top
PHP2Shell is exploited and on CISA's list. Now a Linux kernel flaw (CVE-2026-46300) can turn it into root. The facts in charts, and what to check today.
Nextcloud: Collabora's built-in CODE server is being exploited. Check it today
CVE-2026-110447 lets attackers run commands on Nextcloud servers with the built-in CODE app. How to check, update or remove it and look for web shells.
Three critical NGINX flaws: less dramatic than PHP2Shell, but patch them quickly anyway
NGINX fix in 1.30.6 and 1.31.7 (Plus 37.1.0.1, 37.0.5.1): which configurations are affected, how to check them and how to update containers.
Mitigating PHP2Shell when no update exists yet: php.ini settings for NAS, Plesk and your own servers
No PHP update yet on Synology? Three php.ini settings shrink the PHP2Shell attack surface — step by step for Web Station, Plesk and your own servers.
PHP emergency patch (PHP2Shell): how to check and patch your servers
Two critical PHP flaws, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: what to do on Plesk, Synology, shared hosting, Docker and your own servers.
Topics: Nextcloud DNS, mail & certificates Linux troubleshooting AI, LLMs & RAG