ddtcorex

Blog

142 posts

23 Oct 2026

Roundcube session desync (CVE-2026-114724): a '!' that turns into object injection

CVE-2026-114724 desyncs Roundcube session parsing with a '!' key into object injection. Patch 1.6.20/1.7.5 and check mail hosts.

securitycveroundcubephp

23 Oct 2026

Node.js Brotli RCE (CVE-2026-111497): malformed compression input to code execution

CVE-2026-111497 is an OOB write in Node's bundled Brotli decoder plus TLS bypasses. Upgrade to 22.23.4/24.22.1/26.12.1 now.

securitycvenodejsjavascript

23 Oct 2026

GitLab October release (12 CVEs): unauthenticated RCE via crafted compile input

GitLab's 22 Oct 2026 release fixes 12 CVEs including unauth RCE (CVE-2026-110264). Patch 19.3.6/19.4.3/19.5.1 now.

securitycvegitlabdevops

22 Oct 2026

PHPPresentation flaws (CVE-2026-114403/114404): a slide deck that runs code

PHPPresentation 1.2.0 deserializes objects from uploaded slide files plus a stored XSS. File-upload lessons for PHP apps.

securitycvephpdeserialization

22 Oct 2026

PHP core memory flaws (CVE-2026-109618/109619): when OOM handling corrupts the request

Two Oct 2026 PHP flaws corrupt request memory around OOM handling. Why every Magento host should track PHP patch releases.

securitycvephpinternals

22 Oct 2026

Duplicator plugin PHP Object Injection (CVE-2026-82814): migration input to code execution

CVE-2026-82814 gives unauthenticated PHP Object Injection via Duplicator's migration engine. The deserialization lesson for every PHP shop.

securitycvewordpressphp

17 Oct 2026

Blameless postmortems and turning incidents into gates

A blameless postmortem template and three CI gates that turn each incident into an automated check that never regresses

magento2devopsquality

17 Oct 2026

Bulk and async APIs for high-volume product import

How the /async/bulk REST endpoints and RabbitMQ consumers turn a 50,000-SKU feed from an overnight outage into a replayable background job

magento2apicatalog

16 Oct 2026

Runbooks and on-call for a small commerce team

A one-page runbook template plus a sustainable on-call rotation that lets a three-person commerce team cover nights and weekends

magento2devopsteam

16 Oct 2026

Merchandising and search relevance tuning in OpenSearch

How OpenSearch relevance scoring decides which products surface first, and the synonyms, analyzers, and merchandising rules that tune it

magento2searchcatalog

15 Oct 2026

Import pipelines: CSV, API, and the case against both

Why scheduled CSV imports silently corrupt large catalogs, where REST falls over, and the validated staging pipeline with rollback that replaces them

magento2catalogintegration

15 Oct 2026

Alerting on symptoms, not causes

Burn-rate alerts on checkout success and queue lag that page on customer pain, with windows and thresholds you can copy

magento2devopsmonitoring

Browse by topic:

2faaccessibilityadminadobe-commercealpineanalyticsapiarchitectureauditb2bbest-practicesblueprintsbotscachecachingcatalogcheckoutcicicdcitrixclicomplianceconfigurationconsentcontentcore-web-vitalscrawlcrushftpcspcustomizationcvedatabasedebuggingdependenciesdeploydeploymentdeserializationdetectiondevopsdidockereavecommerceenterpriseerpeventsfile-transferfortinetfpcframeworksfraudfrontendgdprgitlabgogovardgraphqlhardeningheadlesshyvai18nimagesindexerintegrationinternalsinventoryivantijavajavascriptlaravellayered-navigationlayoutlcplocal-devmagento2migrationmodulesmonitoringmsimultistorenetworknextjsnodejsobservabilityonboardingopensearchorderspatchpaymentsperformancephppluginspricingprofilingpwaqualityrcereactredisremotesresilienceroundcubesapsearchsecurityseosessionsshippingslostructured-datasymfonysynctailwindteamtestingtomcatupgradevarnishwcagwordpressworkflowxdebugzeroday