Clara Leigh

CVE-2026-27593 - GitHub Advisory Database Statamic is vulnerable to account takeover via password reset link injection

PSA for @statamic.com folks - update your sites ASAP! ⚠️

A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱

All the details: cvereports.com/reports/CVE-...

My current task is to reinstate users ability to update their emails.

The issue? Their email is technically a stable coin wallet and money is directly linked to their ability to access that email

I have a fix but my god this topic hit hard this week

Shipping spaghetti is still shipping 😭

GitHub Action with the text: name: Run tests without networking run: | sudo unshare --net -- bash -lc ' ip link set lo up php artisan test --exclude-group manual --parallel '

Tip I leaned today: Disable networking on your GH Action Tests

Even if you block it in code, things could still leak

Hmm I wonder if it’s a cpu power limiter then under high load 🤔

Anyone else's PHP github actions suddenly taking an insane time to complete?

Mine are taking 20mins-1hr and I cannot replicate any problem on local or even brand new machines setup

If at first you don’t succeed, try and try again 🤔

kinda neat, I saw something else recently but in a code that compiles code that compiles other code nesting egg

We have another giveaway: a ticket to Laracon India 🎉.

Since this is a last-minute giveaway, it is only open to people already basedin Ahmedabad, India, and it's only open until January 17th, 2026.

Retweet/share for reach, and enter via our website, link below ⬇️.

Why governments need to treat fraud like cyberwarfare, not customer service Fraud has become industrialized and weaponized by syndicates and hostile states. This op-ed argues it’s a global security threat and outlines a new US-UK-backed public-private task force to fight it.

Why governments need to treat fraud like cyberwarfare, not customer service cyberscoop.com/industrializ...

gpg.fail

There should be a “same product, same features” law

If a country forces a company to have better privacy options or allow third party app stores or whatever it might be, you should be forced to offer that same feature here in Australia

By all means use it, but don't assume its telling the truth. Investigate and confirm what its said is true before you go off and ask someone else to verify its claims for you

Reminder folks, chatgpt is designed to agree with you and "solve" issues so it rarely tells you that you're misunderstanding things.

It will absolutely mislead you or say its found the issue when really it's just giving its best guess

Getting tired of seeing low quality github issues hey

Stay safe friends

View of Brisbane city at night

My favourite part of the city is the KP cliffs. Absolutely stunning views 😍

Whenever I need time to myself, this is where I go

I’m really hating the “I know but it’s still so cute” crowd of fb simps 😭

Ted has to be the worst of them all 🤢
Never met a more disgusting lib in my life

Wrong regex in the vite file? Css in script tags? Does it refresh but not do the thing?
I feel you, I’ve had to hunt this bug down a few times

Have they finally got the DB driver working well again?!? I’ll have to check it out

I remember checking in 2 years ago with the mongo team and it was not quite ready for production usage, but it worked in some areas

Yeah fr. In my paper I compare it to the CD/USB autorun drama of the 00s. Except instead of just inserting 1 device, we pull in 10,000 from the internet and assume it’s all gucci

The first step is tackling npm autorun. Explicit approval for any post install/update script with insights

Next would be SBOMs with behaviour attached. And notices when deps grow, scripts change etc. and a move away from the habit of using deps for tiny tasks. + much more. I could rant for a while

In npm world it’s a little tricky rn. Personally I don’t update a pkg until it’s 2-3 wks old (unless it’s a security patch). This gives community run static/dynamic analysis tools time to find and flag things. There are SBOM tools that help too

The real solution would require community change… 1/2

I wrote a research paper on this topic just last month

This issue is entirely preventable. The only reason we keep seeing this style of attack is because our industry keeps repeating the same mistakes over and over again 😔

Whoa this is stunning

I knew the good talks with China could only last so long. Guessing it’s a proxy war sorta thing? I haven’t read into it yet

It’s the small things that keep me on Mac.

Like I remember my yubikey being a pain with git commits on Linux and other little small things that take hours to fix properly

I do miss my Linux daily driver tho 🥲

✨Microsoft security✨

With the AWS outage, now‘s as good a time as any to post this old strip.