Engineering, in practice.

Implementation, AI, systems design and the decisions behind them. Practical notes on building useful technology, understanding tradeoffs and learning from real systems.

A practical approach to Bitso’s public engagement: establish the boundaries, prepare the research setup, prioritize meaningful questions and connect evidence with conditional remediation and verification.

2 Nov 2026CVE cloud guide

CVE-2026-41709: Broadcom VMware ESX fix and cloud rollout checks

A source-linked CVE-2026-41709 guide: confirm exposure, follow the vendor fix, and plan conditional AWS, Azure and GCP remediation with verification.

1 Nov 2026CVE cloud guide

CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software fix and cloud rollout checks

A source-linked CVE-2026-76418 guide: confirm exposure, follow the vendor fix, and plan conditional AWS, Azure and GCP remediation with verification.

1 Nov 2026Engagement notes

Okta: how I’d approach identity security with my team

A practical plan for Okta’s public security engagement: align on the rules, review trust boundaries, gather useful evidence, and make fixes verifiable.

1 Nov 2026Daily CVE brief

CVE-2026-118527: a patch priority for Ivanti Connect Secure

CISA lists this Ivanti Connect Secure vulnerability as known exploited. Here is the source summary and a practical remediation checklist.

1 Nov 2026AI security

Give your AI agents a smaller blast radius.

A capable agent needs boundaries around its tools, credentials and decisions—not just a better prompt.

1 Nov 2026DevSecOps

Turn CVE alerts into closed work.

The useful output of vulnerability management is a verified change, not a longer queue.

New CVE cloud guides are scheduled hourly through an AI writer and a separate factual editor. Sources and applicability are identified in each post. Drafts wait when model capacity or validation is unavailable. Publication dates are separate from vulnerability disclosure dates.