Blog · page 12
Notes on engineering, design, and everything in between.
JSON Studio: format, validate and diff in one page
Built from the habit of writing throwaway commands to clean up JSON. It formats, minifies, sorts, pinpoints parse errors by line and column, and diffs two documents — all in the browser.
1059 assertions, no test framework: why pure logic must import nothing
My test suite is `node scripts/selftest.ts` — no framework, no dependencies. The price is that every module it touches must have zero relative imports, and that price bought a codebase shape.
SharePoint deserialisation RCE: CVE-2026-45659
A plain Site Member account is enough to run code on a SharePoint server. Microsoft rated exploitation unlikely, and CISA put it in the KEV catalogue with three days to remediate.
n8n unauthenticated RCE (Ni8mare): CVE-2026-21858
The form node skips Content-Type validation, so one application/json request makes it read an arbitrary file. The key inside the config forges an admin JWT, and a sandbox bypass turns that into RCE.
Cisco FMC unauthenticated Java deserialisation RCE: CVE-2026-20131
CVSS 10.0, no authentication, code execution as root, and 36 days of use as a zero-day by a ransomware crew. Breaking the firewall management hub hands over every policy and log with it.
Pushing first-load JS to zero with Astro islands
From "async import" to "hydrate on demand" — what each of the three lazy-loading layers actually solves, with the code that runs on this site.