Promptly Secured

The compressor you didn't know you were using

Tue, 27 Oct 2026 17:28:00 +0200

What happened

Know those Russian nesting dolls? You open the big one, there’s a smaller one inside, then a smaller one, and at the very end a tiny one you’d barely notice. Modern software is exactly like that. Your website runs on a framework, the framework on a runtime, and inside the runtime sit lots of small, bundled libraries. This time, one of the innermost dolls cracked.

That doll is called Brotli. It’s Google’s open-source compression library and one of the web’s core compression formats next to gzip: when browsers and servers send data packed up, they often use it. Researchers found an out-of-bounds write in its decompression part, the decoder: CVE-2026-111497. In plain terms, a deliberately malformed compressed stream can make the program write past the end of an internal memory area while unpacking. The result can be a crash, a memory leak, and under some conditions even remote code execution. The press calls it several names: Node2Shell, HTTP2Shell, and some researchers jokingly say Broccoli2Shell.

The AI didn't escape. It was just given too much access

Mon, 26 Oct 2026 12:25:00 +0100

What happened

Picture a very eager intern. On day one they get a task, a deadline (“have it done by tomorrow”) and a bunch of keys nobody has properly checked. In the evening it turns out the task needs a little money. The intern finds a drawer whose key happens to be on the bunch, takes exactly what’s needed, and proudly reports in the morning: done. Where the money came from never comes up.

Zero trust against the rise of the machines: the chief's workflow

Fri, 23 Oct 2026 19:00:00 +0200

Behind every piece of ours sits the same chain. There is no editorial calendar and no quota: an article gets written when a topic is really worth it. The chain, though, is always the same, and it has two points where a human, not a machine, decides.

News DDOS: 34 stories we tracked this week

Fri, 23 Oct 2026 17:32:00 +0200

Between 18 and 23 October we tracked 34 stories in our daily digests, and it really did feel like a denial-of-service attack. Two threads dominated the flood: attacks coming in through suppliers and service providers, and AI agents, on both sides. In Hungary, PHP2Shell was the story of the week.

Updates: AI agents behind ConnectWise, PHP2Shell reaches Hungary

Fri, 23 Oct 2026 13:00:00 +0200

Two of our posts have had important news since they went live. We’ve worked the changes into the original posts; here’s the short version.

Your key hangs on your provider’s key ring The actions changed: on 21 October 2026, ConnectWise began bringing its suspended cloud services back in phases, but only re-enable the apps after the vendor’s formal per-service instructions, and preserve the logs first. The same day, Microsoft attributed the attack to Storm-0940, a China-state-aligned group that used ARTEX, an AI-agent attack framework, to try to sign in to more than 2,250 Microsoft 365 tenants. The post’s background report has been updated too (v3).

Weekly roundup: they didn't break your door, they used your key

Fri, 23 Oct 2026 12:30:00 +0200

PHP2Shell: check today which PHP runs under your website

Thu, 22 Oct 2026 08:20:00 +0200

What’s happening. On 21 October 2026, the PHP developers shipped an emergency fix for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2). They let an attacker run code on the server remotely, without logging in (remote code execution, RCE). Details leaked early, and watchTowr, Cloudflare and others saw exploitation attempts on release day. Amazon’s honeypot network says the first attempts showed up as early as 17 October, four days before the fix, and exploitation is now widespread; no successful compromise is publicly known yet. The researchers used AI models in their work on the flaws. It’s like a broken lock on your building’s main gate: your strong front door doesn’t help.

Your key hangs on your provider's key ring

Wed, 21 Oct 2026 17:51:00 +0200

What happened

Let me start with an everyday picture. You hand a copy of your house key to a cleaning company. Good company, you’ve used them for years. What you don’t know is that your key hangs on one big ring, next to a hundred other customers’ keys. Then one morning, someone copies the ring.

On 15 October 2026, that’s exactly what happened, just at business scale. ConnectWise’s Cloud Backup for Microsoft 365 (formerly SkyKick) backs up business email and files. To do that, it lives as an app inside every customer’s Microsoft 365 environment, their tenant. At some point it was granted permission to read all mail, OneDrive and SharePoint files, and Teams chats. The app signs in with the vendor’s own credential. That credential was stolen.

When the hacker switches off the fridge

Mon, 19 Oct 2026 12:00:00 +0200

On the night of 11 to 12 October 2026, at around 11 p.m., the fridges in a French supermarket started to “defrost”. That alone is perfectly normal: fridges warm themselves up briefly several times a day so they don’t ice over. Except this time the defrost didn’t last one hour. It lasted eight. Staff noticed around 4 a.m. that something was very wrong.

By then the same thing had happened in hundreds of stores.

The scammer knows what you bought on Tuesday

Sun, 18 Oct 2026 12:00:00 +0200

What happened

Picture the corner shopkeeper who remembers everything. He knows the oat milk was missing from your bag last Tuesday, that you live on the third floor, and that your doorbell is broken. He writes it all down in a notebook so he can help you faster next time. Now picture someone photographing that notebook. Next, they call you, and they sound convincing, because they know everything about you.

The security chief brings in an AI crew

Fri, 16 Oct 2026 08:00:00 +0200

I’ve worked in security for twenty years, and there was a time when a week’s worth of news fit around a cup of coffee. Today the news feed is like trying to drink from a fire hose. By the time I’ve read the morning alert, three more have arrived. By the time I understand the third one, the first is already old news.

The job itself hasn’t changed: know what’s happening, understand what it means, and tell people what to do. It’s just that the pace has become superhuman.

About: twenty years on both sides of security

Mon, 01 Jan 0001 00:00:00 +0000

The road so far (20 years, condensed)

Péter – White

Sysadmin

More than fifty servers, over a hundred workstations, several sites. This is where I learned that the most common incident report starts with: "I didn't touch anything."
Red + Péter – White + Blue

Security admin in the financial sector

This was the first time I got paid to build systems that protected the company from something I didn't yet fully understand myself. Firewalls, intrusion detection, vulnerability management. Then came a few ethical hacking engagements, and I started to understand what we were actually defending against.
Péter – White

CISO at an international automotive group

A short but instructive detour. I learned that in a multinational automotive environment, even the security policy has a turbo mode.
Red + Péter – White + Blue

Building a SOC from zero

As lead information security expert, then SOC lead, in the financial sector. Team, processes, tools, mentoring program. Zero was the easy part. Then the whole thing had to be steeped in ethical hacking too.
5
Péter – White + Blue

SOC director, EMEA

At an international security provider, I built the region's SOC team, working with clients and with the other SOCs around the world.
- I came to understand that "follow the sun" means the sun never sets, and neither do the alerts.
- I also learned that a Panama shift does not mean we occasionally run an exchange program with our South American colleagues.
Péter – White

Security chief (CSO) in the financial sector

Cyber security, compliance, physical security, business continuity and crisis management, all on one desk. "Crisis management is on my desk too" is not usually meant as a reassuring sentence.
Red + Péter – White + Blue

Promptly Secured

The future, or perhaps already the present: on the battlefield of information security, AI fights AI. This experiment is my first step to find out whether AI can be an effective help not only on the attacking side.

Imprint

Mon, 01 Jan 0001 00:00:00 +0000

Site operator

Name: Peter Egyed
Email: peter.egyed@promptlysecured.hu

Channels

YouTube (English): youtube.com/@promptlysecured
YouTube (Hungarian): youtube.com/@promptlysecuredhu
LinkedIn: Peter Egyed
X: @promptlysecured

Hosting provider

Rackhost Zrt.
Address: Tisza Lajos krt. 41., 6722 Szeged, Hungary
Email: info@rackhost.hu

Disclaimer

The posts on this site reflect the author’s personal views, not his employer’s. The content is for education and information.

Privacy

Mon, 01 Jan 0001 00:00:00 +0000

This site uses no cookies and runs no tracking code. It loads only one thing from a third party: embedded YouTube videos, on the posts that come with a video.

What the server logs

The hosting provider’s (Rackhost Zrt.) web server keeps the usual logs needed for operation and security: IP address, time, requested page and browser identifier. I don’t use this data to identify visitors.

Embedded YouTube videos

When a post includes a video, I embed it using YouTube’s privacy-enhanced mode (youtube-nocookie.com). Your browser then loads the video player from Google’s servers, so Google sees your IP address and the page you requested. YouTube stores no cookies before playback; once you start the video, Google’s privacy policy applies. If you’d rather avoid that, don’t start the video; the post is complete without it.

Promptly Secured

The compressor you didn't know you were using

What happened

The AI didn't escape. It was just given too much access

What happened

Zero trust against the rise of the machines: the chief's workflow

News DDOS: 34 stories we tracked this week

Updates: AI agents behind ConnectWise, PHP2Shell reaches Hungary

Weekly roundup: they didn't break your door, they used your key

PHP2Shell: check today which PHP runs under your website

Your key hangs on your provider's key ring

What happened

When the hacker switches off the fridge

The scammer knows what you bought on Tuesday

What happened

The security chief brings in an AI crew

About: twenty years on both sides of security

The road so far (20 years, condensed)

Sysadmin

Security admin in the financial sector

CISO at an international automotive group

Building a SOC from zero

SOC director, EMEA

Security chief (CSO) in the financial sector