Friday Works / Topic hub / 06

Cybersecurity

Practical protection for business websites, applications and data.

25 articles

See risk before it becomes an incident.

Guides in this topic

The genuine CVE.org record header for CVE-2026-111497, showing the Brotli flaw title and publication dates; captured 29 October 2026

Start here

Published Oct 30, 20264 min read

Brotli exploitation warning: what AWS Lambda teams need to verify

A 29 October NCSC warning concerns CVE-2026-111497. Check affected Brotli branches, AWS rollout conditions and evidence that a runtime is patched.

Official MFSA 2026-118 heading and Firefox 159 fix information, October 27, 2026

Firefox 159 fixes high-impact flaws: check ESR branches too

Mozilla published its advisory on October 27. Distinguish origin-isolation flaws from memory bugs, select the right servicing branch and verify after restarting.

Published Oct 28, 20264 min read

Rear of iPhone 11 Pro, photographed by pixelperfektion and published in 2019; hardware in the advisory’s iPhone 11 family

Apple patches iOS 26.7.2: review privacy exposure on managed iPhones and iPads

The October 26 update addresses privacy and memory issues. Check device eligibility, attack conditions and the installed version after updating.

Published Oct 27, 20263 min read

Actual NuGet distribution interface for the .NET 8.0.33 Windows x64 runtime package, not Visual Studio or evidence of an installed fix

Microsoft delivers the missing .NET Windows fix in an out-of-band update

The October 25 advisory delivers corrected packages for CVE-2026-70197. Self-contained Windows applications need rebuilding and redeployment, not only a machine-wide update.

Published Oct 26, 20263 min read

Cloudflare Managed Ruleset October 25, 2026 announcement for Brotli and Next.js rules with Log defaults

Cloudflare Adds Emergency Brotli Rules: Log Defaults Do Not Replace Node.js Patching

Cloudflare’s October 25 CVE-2026-111497 rules default to Log. Inspect Block overrides, protect Next.js image delivery and verify patched Node.js runtimes.

Published Oct 25, 20263 min read

Actual GitLab repository interface showing gitlab-org/gitlab README.md; original Friday Works capture October 23, 2026, not patch-state evidence.

GitLab Patches CVSS 10 RCE: Self-Managed Servers Need Another Update

GitLab published fixes on October 21 for CVE-2026-110264 affecting CE/EE since 7.0. Identify the correct release branch, upgrade and review self-managed server telemetry.

Published Oct 23, 20263 min read

Actual phpinfo Core on isolated localhost PHP 8.5.7; original Friday Works capture October 21, 2026, not a patched version.

PHP Releases Patches for Two Critical RCE Flaws: Update the Web Runtime Now

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. The flaws can allow unauthenticated code execution; configuration changes or a WAF do not replace patching.

Published Oct 22, 20263 min read

Firefox 90 on Linux: Page Info Security tab and View Certificate, VulcanSphere archival capture July 18, 2021; not patched Firefox 158.0.1.

Firefox 158.0.1 Ships eMudhra Certificate Blocks: What Businesses Should Check

Mozilla’s October 20 update packages blocks for eight compromised intermediates. Review OneCRL delivery, Firefox ESR and applications using NSS separately.

Published Oct 21, 20263 min read

Cloudflare Precursor settings with Off, Monitor and Arm status options; Monitor is selected in the official screenshot.

Cloudflare Adds Precursor Monitor Mode Before Bot-Score Enforcement

Cloudflare announced Monitor on October 19: Precursor signals leave bot score and clearance unchanged. Interstitials remain separate and need checkout/API testing.

Published Oct 20, 20263 min read

Cisco Secure Email Mail Policies, Advanced Malware Protection with Enable File Reputation in Cisco lab configuration, archival October 25, 2024 material.

Cisco Secure Email AMP Exploitation: Check the CVE-2026-76519 Fix

An October 18 NCSA warning highlights Cisco’s October 14 advisory. Administrators should check File Reputation, Content Scanner Tools and potential compromise separately.

Published Oct 19, 20263 min read

BeyondTrust Remote Support Screen Sharing session interface from official documentation; a sample screen, not an attack screenshot.

BeyondTrust Remote Support Exploitation: Apply BT26-05 and Review for Intrusion

Canada’s October 16 alert calls for action on CVE-2026-102764 in BeyondTrust Remote Support. Self-hosted deployments need a specific patch and separate intrusion review.

Published Oct 18, 20263 min read

Screenshot of Palo Alto Networks Security Advisories for CVE-2026-0322.

PAN-OS Flaw Is Being Exploited: Patch the Firewall Management Interface

Palo Alto Networks disclosed CVE-2026-0322 on October 14 with limited exploitation observed. Administrative credentials and management-interface access are required.

Published Oct 16, 20262 min read

AhsayCBS Overview showing server resources and configuration in the vendor’s documentation example.

AhsayCBS Needs a New Hotfix: Check the Backup Server for Compromise

Ahsay says earlier patches did not fully address CVE-2026-105133 and CVE-2026-105134. Verify the new hotfix and investigate compromise separately.

Published Oct 16, 20262 min read

GitHub Advisory Database showing Gitea CVE-2026-27771, affected versions and the patched version.

Responsible Security Research: Public Evidence of Friday Works’ Authorised Testing Practice

A public record of how Friday Works records scope, validates evidence, stops at the right boundary and publishes safe lessons from security research.

Published Oct 11, 20265 min read

A YubiKey 5C NFC hardware security key, illustrating phishing-resistant multi-factor authentication.

Phishing Emails Now Sound Very Human: Where Should a Business Stop Them?

As phishing emails become more polished, telling employees to be careful is not enough. Businesses need to protect mailboxes, accounts and verification steps.

Published Oct 11, 20262 min read

Chrome DevTools showing a network request’s Headers tab with its URL, status and HTTP headers.

Your Website Looks Compromised: 6 Things to Do in the First 24 Hours

Unexpected redirects, strange content or unusual mail are not a cue to delete things in a panic. Six steps to preserve evidence, limit impact and recover safely.

Published Oct 08, 20262 min read

Friday Works’ actual website security checker with target input and authorization confirmation.

Website vulnerability scans: how to read the results correctly

How to distinguish signals from confirmed vulnerabilities and decide what to do after a website security scan.

Published Aug 26, 20265 min read

The actual ZAP desktop interface with Sites, toolbar, Quick Start, History and Alerts areas.

Website, Web App and API Security Assessment Cost

Budget a website, web app or API security assessment around assets, user roles, business flows, testing depth, reporting and retesting.

Published Aug 11, 20265 min read

Friday Works’ public page describing its web-app security assessment scope.

6 Website Security Assessment Providers in Ho Chi Minh City to Shortlist in 2026

A non-ranked list of six Ho Chi Minh City providers publishing website, web app security assessment or penetration-testing services, with a method for separating scope before requesting proposals.

Published Aug 11, 20268 min read

Security Review vs Penetration Test: What Does Your Web App Need?

Compare security reviews, website security assessments and penetration tests by objective, scope, depth, evidence, operating risk and deliverables.

Published Aug 11, 20267 min read

The official OWASP Top 10 2025 documentation page, matching the edition discussed.

What Is the OWASP Top 10 2025? A Web App and API Checklist

Understand the OWASP Top 10 2025, turn awareness risks into verifiable controls and combine it with ASVS and contextual web app and API testing.

Published Aug 11, 20265 min read

ZAP’s sample Risk and Confidence report with alert and confidence sections.

How to Choose a Website Security Assessment Provider

Evaluate a website, web app and API security assessment provider through scope, methodology, safety constraints, evidence, reporting and retesting.

Published Aug 11, 20266 min read

Anthropic’s Computer Use sample application with tool definitions and computer-control actions.

Securing AI Agents: Prompt Injection, Permissions and Guardrails

Reduce risk when AI agents read untrusted content, call tools and act inside business systems.

Published Aug 10, 20264 min read

Chrome DevTools WebAuthn showing a virtual authenticator and credential information in a passkey test example.

What Is a Passkey? A Business Passwordless Roadmap

Understand phishing resistance, synced versus device-bound credentials and a risk-based enterprise rollout.

Published Aug 10, 20264 min read

A Practical Website Security Checklist for Businesses

Ten foundational controls that reduce risk before a website becomes a weak point in the business.

Published Jul 28, 20264 min read