Programmiert seit 2002 – autodidaktisch gelernt, 2012 mit KO-Web selbständig gemacht. Über 100 Projekte, Fokus auf Security, Performance, Automatisierung und Qualität. Heute freiberuflich: DevSecOps-Beratung, Schulungen und Softwareentwicklung.
- DevSecOps
- TYPO3
- PHP
- Sylius
- CI/CD
- AI
- AI Agents
- Content Management Systems
- Startups
- Founding
- de
- en
- es
Posts by this author
Go CVE-2026-111943: how the crypto/x509 denylist blocks the eMudhra keys, why only a rebuild helps and how to find the Go binaries in your cluster.
Eight eMudhra intermediates had private keys below 256. Why browsers are protected while containers and Go, Java, Python and Node services are not.
GitLab CVE-2026-110264: how an .org file overflows Ruby's regex engine, what the fix in the bundled Ruby changes and which hardening actually helps.
Node.js CVE-2026-111497: why the Brotli decoder misreported an invalid block switch, what the fix changes and how to decompress untrusted data safely.
PHP2Shell explained: how the out-of-memory longjmp and stale worker state lead to RCE, what the fixed releases change and which hardening actually works.
Three vulnerabilities in apko, disclosed on 9 May 2026, push the boundaries of trust in the Wolfi/Chainguard build pipeline: path traversal, a missing hash comparison against the signed index, and a type-assert panic. Patch directly to 1.2.7, plus a dedicated SBOM verification stage as a structural response.
S3 as a fileadmin volume only gets cheap and fast when not every request reaches S3. Three cache layers (browser with immutable, Souin in the reverse proxy, GeeseFS RAM) plus the decision to serve fileadmin as static, content-addressed files past the TYPO3 frontend. Including the sharp edges: building the arm64 driver yourself, world-writable modes, Souin PURGE limits, and the 404 trap with immutable.
The classic path bakes app code into the image via COPY — every code release becomes an image build, runtime and code are coupled. Instead: code as its own OCI artifact via ORAS in the same registry, deployed through a one-shot oras-init container into a shared volume, services on an empty golden image. Including the sharp edges (entrypoint override, path validation, symlinks, stale content) and the honest limit: containerd doesn't (yet) mount OCI artifacts natively.
Instead of shorter poll intervals, the release becomes an event: an opt-in step in the semantic-release job triggers a minimal Renovate run that bumps only your own artifacts via the datasource (gitlab-tags/-releases/-packages). Three cadence tiers — security instantly, first-party in minutes, external in a 4-hour window with a soak period. Including the sharp edges: OSV CLI flag beats config, pruneStaleBranches, trigger variable encoding, burst debouncing.
Why classical SEO routines only half-cover layer 2 and miss layers 1, 3 and 4 entirely — plus an operator decision block for the right build order.