#security
grep -l "security" /portfolio/* · 5 entriesPHP2Shell: patch what you need, delete what you don't
Two critical PHP flaws landed on a Tuesday. One service got patched within the day. A handful of old PHP scripts got something better than a patch: they got switched off for good.
Log4Shell: finding every Java app we ran
The patch was the easy part. The hard part of Log4Shell was finding every place log4j-core existed, including inside jars inside jars.
1 min readA security group change that cut the app off from its database
A tidy-up of security group rules removed the one that let the app reach its database. Flow logs and CloudTrail found it in minutes.
1 min readA secret printed in a Jenkins build log
A database password showed up in plain text in a build log. The fix was more than masking it: secrets moved to Vault and every pipeline stopped holding them.
Heartbleed week: patching everything at once
Heartbleed meant finding every OpenSSL we ran, patching it, restarting what still had the old library loaded, and then replacing the keys.