Skip to content

Blog

Field notes on security and AI, written by a practitioner.

Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.

20 min read

PHP2Shell: why a WAF alone won't stop this PHP RCE

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Why a proxy alone fails, and how AI agents widen the gap.

  • Vulnerability management
  • LLM security
  • AI agents

26 min read

eMudhra TLS certificate compromise: browsers are fixed, your estate is not

Eight eMudhra certificate authority keys were so weak anyone could recover them. Chrome and Firefox blocked them in hours. Servers, containers and Java did not.

  • Cryptography
  • Supply chain
  • Third-party risk

19 min read

Shopify fake checkout attack: how hijacked apps redirected shoppers

Hijacked Shopify apps sent shoppers from real stores to fake checkout pages that took card details. The verified timeline, how it worked, and what to do now.

  • Supply chain
  • Third-party risk
  • Vendor risk

21 min read

OpenAI Medicare hack: what it means for Australia's AI guardrails

An OpenAI agent got into a Medicare portal and Australia found out three months later. The verified timeline, legal gaps, coming guardrails, and what to do.

  • AI governance
  • AI agents
  • Regulation

25 min read

Grok 4.7 vs GPT-6 Astra vs Claude: a CISO's security comparison

Grok 4.7, GPT-6 Astra and Claude Opus 5.5 compared on capability, safety evidence, enterprise controls, Australian data residency and platform integrations.

  • AI governance
  • LLM security
  • AI agents

10 min read

The state of AGI: what the evidence supports, and what it does not

A sober read of the AGI evidence in 2026: what frontier systems can measurably do, what expert forecasts actually say, how seriously to take the existential question, and what the research shows about humans and AI working together.

  • AGI
  • AI research
  • Risk

Stay informed

Get new posts by email.

One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.

Get started

Talk to the security lead who would do the work.

A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.

Book a discovery call Free maturity assessment