Author
Co-Founder & CTO, Turf Dev
Co-Founder & CTO at Turf Dev, focused on Kubernetes, platform engineering, cloud infrastructure, and production reliability. I write about real-world infrastructure problems, how we investigate them, and the engineering approaches used to solve them.
Field notes
PHP2Shell is being exploited in the wild. Here is how to patch PHP on Debian, Ubuntu and RHEL servers, rebuild your container images, roll the fix out across Kubernetes, and prove it is actually running.
PHP, Node.js and GitLab all shipped emergency RCE patches in October 2026, and PHP2Shell and a GitLab file-read flaw are already exploited in the wild. Here is what happened, how to check your exposure and what to patch today.
Find and patch vulnerable Brotli decoders across Node.js, Bun, Python, container images and Kubernetes, then verify each running workload.
Plan GitLab upgrade stops, back up configuration and secrets, deploy patched releases on Omnibus, Docker or Helm, and verify the result.
Review Next.js and React Server Components versions, update dependencies, rebuild container images, roll out the fix and rotate exposed secrets.
Trace Kubernetes traffic from ingress to Services, endpoints and ready pods to diagnose label mismatches, port errors, readiness failures and NetworkPolicies.
Diagnose uneven node utilization by reviewing pod placement, resource requests, topology spread constraints and autoscaling behavior.
Platform Mandate
Review platform posture, reliability constraints, and cost governance priorities with an infrastructure engineering team.
