Category Archives: Security

PHP: PHP2Shell – CVE-2026-109618 and CVE-2026-109619, Temporary Fix
0 (0)

21 October 2026

UPD: The official patch is already out, see PHP 8.5.12 Release Announcement. But it’s not available in the Amazon Linux repositories yet. I barely had time to recover from the issue with Updraft and the RTFM hack the day before yesterday – and here we go again. But this time, I’d really like to avoid… Read More: PHP: PHP2Shell – CVE-2026-109618 and CVE-2026-109619, Temporary Fix0 (0) »

RTFM: TeamUpdraft (UpdraftPlus) and WordPress Hack on the RTFM Blog
0 (0)

20 October 2026

The morning of October 19 didn’t start with coffee – but there was plenty of adrenaline. The first thing I saw when I woke up was Telegram alerts telling me that something had gone wrong with RTFM: At first, I didn’t pay much attention. PHP error alerts do happen occasionally, so I made myself some… Read More: RTFM: TeamUpdraft (UpdraftPlus) and WordPress Hack on the RTFM Blog0… »

Ubuntu: Installing NGINX with TLS Certificate from Let’s Encrypt and AWS Route 53
0 (0)

17 August 2026

We have an Ubuntu server running one of our services. The service itself is still at the Proof of Concept stage, so we’re not moving it to Kubernetes yet – but sending traffic in plain text, especially when these are requests to AI Agents with prompts and responses, is not a great idea. So, the… Read More: Ubuntu: Installing NGINX with TLS Certificate from Let’s Encrypt and… »

MikroTik: User Management, access permissions, and SSH
5 (1)

23 May 2026

Time to finally write up MikroTik and Users Management – this one’s been sitting in drafts for ages, and while I’m at it, I’ll also set up SSH key authentication. Let’s walk through the main concepts and settings of Authentication, Authorization, Accounting in MikroTik – groups, policies, and users. What we have and what needs… Read More: MikroTik: User Management, access permissions, and SSH5 (1) »

Okta: Integration with Google Workspaces, Part 1 – Provisioning
0 (0)

27 April 2026

Continuing with Okta setup for our project. In previous parts we did SSO for Grafana (see Okta: setting up Grafana SSO with OIDC and Role mapping) and AWS (see AWS: setting up Okta SSO with AWS IAM Identity Center), and now the most interesting part: integrating Okta with Google Workspaces. What we’ll need to do:… Read More: Okta: Integration with Google Workspaces, Part 1 – Provisioning0 (0) »

SSL/TLS: Self-signed Certificate Authority for NGINX on FreeBSD
0 (0)

18 April 2026

I run a bunch of web services on my home NAS – Grafana, VictoriaMetrics, my own WordPress blog, and half a dozen other small things. The whole series of posts on FreeBSD and NAS starts here – FreeBSD: Home NAS, part 1 – setting up ZFS mirror, there are 15 parts as of now. NGINX+PHP… Read More: SSL/TLS: Self-signed Certificate Authority for NGINX on FreeBSD0 (0) »

AWS: Setting up Okta SSO with AWS IAM Identity Center
0 (0)

31 March 2026

In the previous part of the Okta series we set up SSO for Grafana (see Okta: configuring Grafana SSO with OIDC and Role mapping) – now for a more interesting task: configuring SSO for AWS, with not just login but also user provisioning. Okta has a ready-made AWS IAM Identity Center App that lets you… Read More: AWS: Setting up Okta SSO with AWS IAM Identity Center0… »

Okta: Configuring Grafana SSO with OIDC and Role Mapping
5 (1)

27 March 2026

We finally “grew up” to using Okta on the current project, so there’s a short series of posts coming up on it. I wrote about Okta before, but that was 5-6 years ago, and there have been some interesting changes since then (see the #okta tag). Today we’ll be configuring SSO login via Okta for… Read More: Okta: Configuring Grafana SSO with OIDC and Role Mapping5 (1) »

AWS: ALB and Cloudflare – Configuring mTLS and AWS Security Rules
0 (0)

16 March 2026

While preparing the infrastructure for migrating RTFM from the DigitalOcean server to AWS (see AWS: basic infrastructure setup for WordPress) I decided to also try AWS ALB mutual authentication (for some reason I thought this feature launched at the last re:Invent, at the end of 2024, but it’s actually been around since late 2023 –… Read More: AWS: ALB and Cloudflare – Configuring mTLS and AWS Security… »

MikroTik: WireGuard VPN Setup and Linux Peer Configuration
0 (0)

14 March 2026

Another one of the many nice features of MikroTik – built-in WireGuard support (although even cheap TP-Link Archers have it). In my setup, the MikroTik RB4011 acts as a “VPN Hub” – all clients connect to it and are united into a single network, and the role of VPN is slightly exaggerated is genuinely important… Read More: MikroTik: WireGuard VPN Setup and Linux Peer Configuration0 (0) »