https://codeknife.dev/en/blog/Notes on the tools developers use every day, and the security and software news that touches them.enMon, 02 Nov 2026 00:00:00 GMThttps://codeknife.dev/en/blog/cve-2026-98432-linux-tcp-ip-options-uaf/https://codeknife.dev/en/blog/cve-2026-98432-linux-tcp-ip-options-uaf/Mon, 02 Nov 2026 00:00:00 GMTAlex KnifeSecurityNewsExplainerA critical Linux kernel race in the TCP handshake, fixed in stable kernels: what the bug is, why 'only MPTCP' misleads, how to patch and mitigate.https://codeknife.dev/en/blog/least-privilege-for-ai-agents-and-mcp-servers/https://codeknife.dev/en/blog/least-privilege-for-ai-agents-and-mcp-servers/Mon, 02 Nov 2026 00:00:00 GMTAlex KnifeSecurityHow-toExplainerGive an AI agent wide room to work and narrow doors to the outside: scopes, sandboxes, MCP tokens and the audit trail a team gets in return.https://codeknife.dev/en/blog/php2shell-longjmp-stale-state-rce/https://codeknife.dev/en/blog/php2shell-longjmp-stale-state-rce/Sun, 01 Nov 2026 00:00:00 GMTAlex KnifeSecurityNewsExplainerTwo critical PHP RCEs patched on 21 Oct 2026: how longjmp() bailouts leave stale memory behind, how to check your version, and what is unconfirmed.https://codeknife.dev/en/blog/base64-is-encoding-not-encryption/https://codeknife.dev/en/blog/base64-is-encoding-not-encryption/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeSecurityExplainerA Base64 value in your config is your password in another alphabet. What Base64 is for, where it gets mistaken for encryption, and how to spot it.https://codeknife.dev/en/blog/how-cidr-and-ip-subnets-really-work/https://codeknife.dev/en/blog/how-cidr-and-ip-subnets-really-work/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeExplainerHow-toPrefix lengths, longest-prefix match, subnet and broadcast arithmetic, why /31 and /32 are special, and the planning mistakes that bite later.https://codeknife.dev/en/blog/password-entropy-length-beats-composition/https://codeknife.dev/en/blog/password-entropy-length-beats-composition/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeSecurityExplainerEntropy, offline cracking speeds per hash, why passphrases work, what strength meters can't know, and what NIST SP 800-63B really says.https://codeknife.dev/en/blog/regex-backtracking-redos-and-the-limits-of-regex/https://codeknife.dev/en/blog/regex-backtracking-redos-and-the-limits-of-regex/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeSecurityExplainerHow backtracking regex engines work, why ReDoS happens (Symfony's Cache-Control bug as a case), what RE2 gives up, and why regex can't parse HTML.https://codeknife.dev/en/blog/uuid-v1-v4-v7-leaks-collisions-index-locality/https://codeknife.dev/en/blog/uuid-v1-v4-v7-leaks-collisions-index-locality/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeExplainerPerformanceSecurityWhat UUID v1, v4 and v7 leak or guarantee, the birthday-bound maths for v4 collisions, and why time-ordered v7 keys keep database indexes fast.https://codeknife.dev/en/blog/what-cron-can-and-cannot-do/https://codeknife.dev/en/blog/what-cron-can-and-cannot-do/Wed, 28 Oct 2026 00:00:00 GMTAlex KnifeExplainerHow-toCron's day-of-month OR day-of-week rule, missing seconds, DST gaps and repeats, missed runs, and how to test a schedule before it bites you.https://codeknife.dev/en/blog/jwt-is-signed-not-secret/https://codeknife.dev/en/blog/jwt-is-signed-not-secret/Tue, 27 Oct 2026 00:00:00 GMTAlex KnifeSecurityExplainerAnyone can read a JWT payload. What the signature does prove, what it doesn't, and the mistakes that turn a token into a vulnerability.https://codeknife.dev/en/blog/rfc-2047-encoded-words-quadratic-regex-dos/https://codeknife.dev/en/blog/rfc-2047-encoded-words-quadratic-regex-dos/Tue, 27 Oct 2026 00:00:00 GMTAlex KnifeSecurityNewsA valid email header full of RFC 2047 encoded words froze postal-mime for seconds. How a harmless-looking check turned quadratic, and how to defend against it.