Blog on Raúl Pastor

Hardening a personal domain in an afternoon, for free

Thu, 29 Oct 2026 20:05:00 +0100

Your personal domain is part of your professional identity. If someone can send mail as you, get a certificate for it or take over a forgotten subdomain, that’s your name on it. I recently cleaned up mine with a free Cloudflare plan and a free mail plan. Here is what each piece does and how to check it. The examples use example.com.

1. Remove what you don’t use

Old subdomains pointing at services you have deleted are the easiest way in. If blog.example.com still has a CNAME to a hosting platform where you closed the account, someone else can claim it and serve content on your domain. This is called subdomain takeover.

Node.js October 2026 security release: Brotli RCE and certificate checks fooled by odd IPs

Mon, 26 Oct 2026 18:20:00 +0100

In one paragraph

On 21 October 2026 Node.js shipped 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities. The headline is CVE-2026-111497, a memory corruption bug in the bundled Brotli decompressor that researchers nicknamed Node2Shell. Any app that decompresses Brotli data from someone it doesn’t trust is exposed, and two very common paths do it by default. CISA added it to the KEV catalog on 27 October. Node.js 20 and every other end-of-life line get no fix.

PHP2Shell: two pre-auth RCEs in PHP itself, explained

Sat, 24 Oct 2026 11:15:00 +0200

In one paragraph

Two flaws in the PHP engine, nicknamed PHP2Shell, let an unauthenticated attacker run commands on a server just by sending a crafted HTTP request. They trigger while PHP parses the request, before your application code runs, so it does not matter which framework or CMS you use or how well it is written. Exploitation attempts were seen four days before disclosure. Both CVEs are rated 9.2 (CVSS v4.0) and are in CISA’s Known Exploited Vulnerabilities catalog.

eMudhra's guessable CA keys: what happened and how to check your estate

Thu, 22 Oct 2026 19:40:00 +0200

What happened

A certificate authority (CA) is trusted to vouch for websites and software publishers. That trust rests on one thing: nobody else can use the CA’s private key.

On 17 October 2026 an independent researcher reported that eight intermediate CA certificates from eMudhra, an Indian CA, had private keys with values below 256. A healthy P-384 key is a random number around 115 digits long. These could be found by trying at most 256 values, and one of them was literally the number 4.