Research
Research.Plain write-ups of real security events.
In the news. What happened in a major security event, why it matters, and what to check on your own systems. Written in my words, with links to the original sources.
Explainers. Common problems I look for on real websites, and how to check whether you have them.
Citrix NetScaler zero-day: unauthenticated command execution on the gateway
On 27 September 2026 Citrix fixed a critical NetScaler flaw that was already being exploited. What it is and how to check your appliances.
ConnectWise Cloud Backup: a vendor credential, and Microsoft 365 tenants
In October 2026 attackers used a Cloud Backup application's credential to sign in to customer Microsoft 365 tenants. What is known, and what to check in your tenant.
PHP2Shell: two critical PHP bugs, already exploited
PHP shipped emergency fixes on 21 October 2026 for two remote code execution flaws. What happened, and what to check on your servers.
What a good external security assessment gives you
What an external assessment covers, what it does not, and what should be in the report.
Why your website might be insecure
The common problems I look for first on a public website, and how to check whether you have them.
My own findings will go here once they are published. I only publish with permission from the affected party.
Spotted an error in a post? Email hello@ryanhenrick.com.