sysadmin horror stories
Two critical PHP RCEs, a leaked embargo, a continent of nervous sysadmins, and one daemon that spent the afternoon arguing with its own code reviews. What CFM rules 10021/10022 catch for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — and what they don’t.
How we stop unmanaged dedicated servers and VMs from adding extra IPs, changing MACs, ARP/NDP spoofing or running rogue DHCP/RA on a shared /24 — with MikroTik raw rules, Cisco Nexus port-security and the Proxmox VE firewall. Verified on production, with the gotchas.
A real-world AlmaLinux 10 SELinux migration from fully disabled to enforcing on a server running Apache, Remi PHP-FPM, BookStack, a Laravel controller, MariaDB, custom SSH port 65535, cron jobs and custom writable paths — with troubleshooting commands and a practical SELinux cheatsheet.
A real-world BookStack upgrade from v25.02.2 to v26.05.3: service-account Git ownership, runuser, backups, Composer/PHP version mismatches, Laravel migrations, writable storage, and the checks that tell you the upgrade actually worked.
A real-world, step-by-step AlmaLinux 8 → 9 → 10 in-place upgrade guide using ELevate: backups, Leapp inhibitors, VDO checks, NetworkManager migration, third-party packages, MariaDB, old EL packages, and the post-upgrade cleanup nobody tells you about.
CFM has been CLI-first since day one. This summer it grew a real web UI — and building it turned out to be less about CSS and more about one question: is this page meant to be glanced at, or worked in? Seven lessons, including the dashboard that cost 543 GB of allocations an hour.
CloudLinux says GhostLock has no mitigation. That’s true for the kernel UAF — but not for the public exploit chain. Here’s what CFM already ships against two of its stages, and, just as importantly, what it doesn’t.
BitNinja’s July newsletter — a JavaScript Proof-of-Work CAPTCHA, a unified WAF, and a “coming soon” SOS mode — describes features a one-person, open-source WAF shipped last spring, plus two kernel layers the newsletter never mentions. A friendly, factual comparison.
Introduction, or “What Could Possibly Go Wrong” So you have a perfectly good server. Two perfectly good SATA SSDs. A perfectly reasonable desire to mirror them so that when one inevitably dies at 3am on a Sunday, your server keeps running. You’ve done this a hundred times. mdadm, RAID1, /boot on the array, done, beer, … Read more
“Wait, can you even do that?” It started, as the best bad ideas do, with a question I didn’t expect a real answer to. I’d been hearing about MCP — the Model Context Protocol, the thing that lets an AI assistant actually talk to your stuff instead of just hallucinating about it. And I had … Read more