Severity vs. Exploitability

This week’s most important technical learning for me (so far) was that there is a big difference between the severity of a vulnerability and its exploitability. The general press often seems to make no difference between the two, which leads to a lot of initial hysteria and often to a subsequent non-event, which is then, of course, not reported. In the past two weeks, several vulnerabilities were published with a high severity score, which caught a lot of media attention. But their exploitability ‘seems’ to have been nowhere near what their severity score suggested.

Let’s have a look at a rather good example, CVE-2026-99999, a vulnerability much hyped for a day because of its severity rating and potential impact if it could be easily exploited remotely. After all, the vulnerability would enable a Virtual Machine escape and host compromise. Sounds bad, doesn’t it?

Continue reading Severity vs. Exploitability

How to Make Nextcloud AIO Un-Reachable While Updating

Last week’s PHP exploit scare left the world scrambling to update their systems. Nothing much happened afterwards, but I preferred to err on the cautious side and decided to shutdown my servers and only start them again once the PHP parts were fully patched. This worked great for all of my servers except for one: A Nextcloud AIO (all in one) installation. I tried a lot but I couldn’t find a way to stop all containers, update them, and only then start them again. While it’s easy to stop the production containers, I couldn’t find a way to update the installation without AIO’s master container running. This is bad, as the master container has an administration web frontend that probably uses PHP, too. Hence, no way I would connect this VM to the Internet while patching. But finally, I found something that helped.

Continue reading How to Make Nextcloud AIO Un-Reachable While Updating

The Week of ‘Critical’ PHP Exploits – And Nothing Happened – Yet

I’m temped to write a short note here because something good and odd happened that I did not expect. Last Wednesday (21. October 2026), two critical PHP vulnerabilities were disclosed (CVE-2026-109618 and 619). Stern warnings were issued that patches for them should be applied as quickly as possible. The reason given was that it seemed likely that it would only take a short while until a way would be found to use them for remote code execution (RCE) without login or any other previous interaction with the target. It sounded really bad.

Continue reading The Week of ‘Critical’ PHP Exploits – And Nothing Happened – Yet

MeshCore – Part 4: Observing the Hops

After looking at the direct range between two MeshCore devices in part 3 of this series, another exciting aspect of MeshCore is how messages are forwarded between repeaters in the network. In the smartphone app, one can see the list of all repeaters that have forwarded a message, as each message does not only contain the content, but the chain of repeater IDs it has gone through. The screenshot on the left is a good example of a relatively direct path.

Continue reading MeshCore – Part 4: Observing the Hops

Replacing Logitech M650 Mouse Buttons

When it comes to input devices, I do have my preferences. For many years, I’ve been using Logitech M650 mice for many reasons, the main one being is that they have silent keys. The main drawback of them, however: The buttons wear out over time. Very irritating. My fix so far: Buy a new mouse. But these mice are expensive, so I was wondering if one could perhaps exchange the switches used below the mouse buttons. And indeed, this is possible and it costs almost nothing!

Continue reading Replacing Logitech M650 Mouse Buttons

Wireguard as Client on Ubuntu 26.04

Some things take a bit of time. 2 years ago, I started my first experiments to replace my OpenVPN server instances with a dockerized Wireguard sever. It worked, but Ubuntu 22.04 I used at the time did not have a built-in GUI plugin for it. As I skipped Ubuntu 24.04, I had to wait for 26.04. With this in place now, I was wondering how well Wireguard runs on this platform. The quick answer. Rock stable!

Continue reading Wireguard as Client on Ubuntu 26.04

MeshCore – Part 2: Web Serial For Flashing

After having had a first look at MeshCore in the previous post, here’s a follow-up on how to actually flash software to devices. This used to be a bit tricky, as flashing devices over USB in the past typically required downloading a binary for the device and an app to flash the device from a PC or notebook. Then, Web Serial for web browsers came along. Until now, I’ve never used it and always preferred the manual way. MeshCore offered the perfect opportunity to give Web Serial in the web browser a try and learn. I was expecting a bit of resistance and a steep learning curve, and was surprised that what I got instead was an easy process and a working device in 2 minutes.

Continue reading MeshCore – Part 2: Web Serial For Flashing

MeshCore – Part 1: What is This?

Recently, I heard the term ‘MeshCore‘ a few times from people who were quite enthusiastic about this rising star in the mesh radio networking domain. After listening to a talk about it (in German), I decided that I wanted to try it out as well. A device costs around 50 euros, so I ordered a few. Just out of interest, without a particular use case in mind (yet). So what is this ‘MeshCore’ then?

Continue reading MeshCore – Part 1: What is This?

Getting eth0 back on a Debian 13 Server

A quick rant today: Having a network interface name tied to where a physical network interface is actually connected in the overall system can be good idea, but on a virtual machine, this renaming just gets in the way. I want my eth0 back! Here’s a link to how that is done on an Ubuntu server installation in a VM that uses netplan. As I’ve started to experiment with Debian as my VM OS, I wanted to have it there as well. Debian continues to use /etc/network/interfaces for the network configuration, so getting eth0 back works a bit differently there. The fix here: overlay the udev rule that does the renaming:

ln -s /dev/null /etc/udev/rules.d/80-net-setup-link.rules

sudo update-initramfs -u

Done!

P.S.: If you are interested why the initramfs has to be updated, have a look at this Debian Wiki entry.