On July 22 the Drupal security team shipped ten contrib advisories — five with no fix, just 'uninstall it.' What 'unsupported' actually means (including why they all read 'Critical' regardless of real severity), why it keeps happening, and the audit I now run on my own composer.json.
Gmail and Outlook now hard-bounce unauthenticated mail instead of junking it. Sending straight from a VPS is a reputation treadmill you lose. The fix is to relay but keep your own SPF/DKIM/DMARC — which is exactly where I found my own footgun: a live 'v=spf1 -all' with no relay include, my newsletter surviving on DKIM alone. Here's what each record does and how to not do what I did.
Three core security advisories in a month, including a highly critical SQL injection in the database abstraction layer itself — exploited in the wild, anonymous, PostgreSQL-only. My blog runs MariaDB so I dodged it, but the JSON:API object-injection pair hit closer to home. What actually happened, and why serialized fields plus unserialize() are a bomb you keep in the building.
Coolify shipped a first-party MCP server in v4.1.0, so I wired Claude Code to the VPS that runs this blog and deployed by asking. It works, which is the worrying part. What the tools actually do (no rollback), the thin confirmation model, and how I scope tokens so an agent can't restart prod off a misread sentence.
I just bolted GA4 onto this blog. Here's the honest look at self-hosting Plausible, Umami, or Rybbit instead - the ClickHouse tax, the GDPR wins, and what actually fits a small OVH VPS.
Field notes on connecting a coding agent to a running Drupal install through the AI module's MCP server, and the governance gaps of letting it build content types and run actions.
Field notes on Keygraph's Shannon: an open-source, white-box AI pentester that reads your source and actually exploits the bugs it finds. What works, what to fear.
Honest notes on Enkryptify, an EU-based secrets manager that injects your .env at runtime. What I liked, how the encryption actually works, and the lock-in I'd weigh.
OpenClaw became the fastest-growing repo on GitHub: a self-hosted AI agent you drive from WhatsApp. What it does, how to install it, and why security researchers are nervous.
