Tag: security

In May 1998, Wietse Venema released the first public alpha of a mailer he’d been writing inside IBM Research and originally called…

The myguard OpenSSH 10.3 package rebuilds sshd for production servers: post-quantum key exchange, AEAD-only ciphers, an AppArmor profile, a fail2ban jail, monthly moduli regeneration, three switchable sshd flavours (default / gssapi / minimal), and compiler hardening beyond Debian’s default. Includes a 2026 SSH key-generation walkthrough and a stack of server-hardening tips.

Default Docker is barely a container at all — root, mutable, all caps, shared kernel. This is the ten-flag hardening checklist that turns it into something a real attacker has to work to break: rootless, read-only, cap-drop, no-new-privileges, distroless, secrets, segmentation, scanning. With a worked NGINX + PHP-FPM compose example.

Curl is shipping a record-breaking security release after AI tools dredged up eleven vulnerabilities — including its oldest bug ever. So why did Anthropic mysterious Mythos model only find one tiny issue? Let us unpack the whole story.

Rspamd is the modern spam filter that runs Bayesian classifiers, neural networks, greylisting, DNS blacklists, Pyzor, Razor, OLEFY and DCC — all at once. Here is what rspamd does, how spam evolved, and why it crushes the inbox war.

Run your own password manager with self-hosted Vaultwarden — a tiny Docker image, full Bitwarden client compatibility, and total control over your encrypted vault.

BREACH is a compression side-channel attack that can leak CSRF tokens and other secrets over HTTPS. Here is how the BREACH attack works, why padding is weak protection, and how to prevent it properly.

A beginner-friendly, step-by-step guide to installing ModSecurity and the OWASP Core Rule Set on NGINX for Debian and Ubuntu — from zero to a live WAF without taking your site down.

The wordpress-hardening-plugin adds 25+ targeted ModSecurity rules on top of OWASP CRS to lock down xmlrpc.php, the REST API, wp-login.php brute force, GeoIP access control, and IP reputation blocking — all without a single line of PHP.

The complete WordPress + NGINX + PHP-FPM setup for Debian and Ubuntu: server block config, pool tuning, FastCGI caching for anonymous traffic, Redis object cache, Brotli compression, and security hardening with ModSecurity and Snuffleupagus.

A reverse proxy puts NGINX in front of your Node.js, Python, or PHP backend — handling SSL termination, caching, buffering, and security. This guide covers proxy_pass, upstream keepalive, caching, WebSocket proxying, and security headers.

NGINX rate limiting with limit_req_zone stops credential stuffing, scrapers, and DDoS floods before they reach your application. This guide covers burst handling, per-endpoint limits, IP whitelisting, WordPress-specific config, and Redis-backed cross-server limiting.

A friendly, jargon-free walkthrough: install Snuffleupagus from the myguard APT repo, pick the right rulebook for your stack (WordPress, Roundcube, generic PHP, internal agent), wire it into a PHP-FPM pool, and avoid the 5 traps that bite everyone the first time.

A complete Postfix + Dovecot + Rspamd mail server on Debian 12 and 13 — with TLS, DKIM, SPF, DMARC, spam filtering, virtual mailboxes, security hardening, and a 10/10 score on mail-tester.com. No shortcuts.

ModSecurity v3 with the OWASP CRS blocks SQL injection, XSS, shell injection, and scanner traffic at the HTTP layer. This guide covers installation, CRS paranoia levels, WordPress tuning, false positive handling, and performance impact.

We just upgraded our openssl-nginx package from OpenSSL 3.x to OpenSSL 4.0. This guide explains what openssl-nginx is, what changed in version 4.0, the real pros and cons of upgrading, and how to do it safely on your Debian or Ubuntu server.

The first audit found 22 issues, but the last two weeks of git history added 14 more issue-level fixes. This updated guide covers the full 36-issue fork-window story, the runtime and build bugs, and the CI tests now guarding the module.

Your server’s system OpenSSL juggles SSH, apt, Python, and your web server all at once. openssl-nginx says no to that. Here’s the dedicated OpenSSL built exclusively for NGINX and Angie — faster handshakes, post-quantum crypto, kernel TLS offload, zero legacy bloat.

The complete guide to building and running an optimised Nginx or Angie server on Debian and Ubuntu — HTTP/3, TLS 1.3, brotli, ModSecurity WAF, FastCGI caching, and eight layers of WordPress defence. Every directive explained.

Most WAFs sit outside PHP and can be tricked. PHP-Snuffleupagus lives inside the PHP interpreter itself — blocking dangerous functions, SQL injection, XSS, type juggling, and deserialization attacks where attackers can’t reach. This is what defence in depth actually looks like.

nginx-minimal strips 12 unused static modules from NGINX while keeping HTTP/3, TLS 1.3, jemalloc, zlib-ng, and all 50+ dynamic modules. Smaller binary, smaller attack surface, same blazing speed. Perfect for WordPress, PHP-FPM, and Docker.