Explore. Create. Inspire.
Welcome to my personal corner of the internet. Here I share technical deep-dives and pieces of my life story.
Fresh from the blog
Latest Stories
Before November 2, Treat `pull_request_target` as a Permission Boundary, Not Just a CI Trigger
GitHub Actions workflows can look deceptively ordinary. A workflow starts when someone opens a pull request. It runs tests. It leaves a comment. It adds a label. Nothing about that sentence sounds lik...
The R2 Reached Metrotown. Treat It as a New Corridor, Not a Guaranteed Faster Trip.
The R2 now reaches Metrotown from Phibbs Exchange, via Hastings Street and Willingdon Avenue. That is a meaningful new link across the North Shore, Vancouver and Burnaby — and a reason to pause before...
29th Avenue Station’s Elevator Is Closed: Make a Time-Aware Accessibility Plan, Not a Screenshot
An elevator closure is not the kind of service change that fits neatly into a saved screenshot. TransLink says the elevator at 29th Avenue SkyTrain Station closed on September 29, 2026, for replacemen...
Fortinet Shipped the FortiMail Patches. If You Stopped There, You Missed the Point.
Fortinet Shipped the FortiMail Patches. If You Stopped There, You Missed the Point. FortiMail 8.0.2, 7.6.7, and 7.4.9 landed on October 5, 2026. That is the good news. The disclosure of CVE-2026-10428...
Let's Encrypt Drops to 64-Day Certs in February. Go Grep Your Cron Jobs.
On October 7, Let's Encrypt announced the first reduction to its default certificate lifetime in the organization's history. Staging starts issuing 64-day certificates on October 14. Production follow...
Veeam's October Patch Fixes a 9.4 RCE. The Patch Is Step One; the Viewer Role Is Step Two.
Veeam released Backup & Replication 12.3.2 P4 on October 6, and the headliner is ugly: CVE-2025-64393, a CVSS 4.0 score of 9.4, lets a user with the low-privileged Backup Viewer role run arbitrary cod...
Atlassian's Critical File-Read Flaw Hit Eight Products at Once. The Exploit Attempts Started Within Hours.
On October 5, Atlassian published a critical advisory for CVE-2026-21589. By October 6, researchers had published a public proof of concept. By October 8, honeypot networks were logging 190 exploitati...
WDS Got a Deprecation Notice. You Have Years to Plan the Exit, Not Weeks.
Microsoft published a support notice on September 21, 2026 (KB5129631) announcing that it plans to deprecate the Windows Deployment Services server role, starting with the next release of Windows Serv...
Microsoft 365 Backup Is Your Job, Not Microsoft's. What the Native Tools Cover and What They Don't.
Eon launched Microsoft 365 data protection this week. IDrive added Entra ID backup last month. And Microsoft itself quietly took native Entra ID backup and recovery from preview to general availabilit...