What's worth your attention
Two kinds of piece. Staff Picks is a monthly, hand-picked shelf of security tooling worth knowing about — each one background-checked for licence, maintenance and dependency hygiene before it earns a place. Editorial is longer-form work on how AI agents change what a security team has to see and govern.
Analysis and method
-
PHP2Shell: How AI turned a decade-old PHP bug into a live internet crisis
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP core. The bugs sat dormant for a decade until AI-assisted research made them practical to exploit. Here's what you need to know and do.
-
What mid-market organizations need to know about governing AI agents
The five things you need to be able to see, four principles that survive contact with a real organisation, and a 30/60/90 that does not require a new department.
-
The side door is the front line
Peripheral systems are now the front line. What the ARTEX campaign against South Korean banks means for the services your organisation never inventoried.
Want a second opinion on your own exposure?
The same discipline that produces Staff Picks is what an assessment applies to your environment: find what exists, find what it can reach, and say plainly what is unknown.
Book a discovery call