Security research, news and explainers.https://ryanhenrick.com/https://ryanhenrick.com/research/citrix-netscaler-cve-2026-88771/https://ryanhenrick.com/research/citrix-netscaler-cve-2026-88771/On 27 September 2026 Citrix fixed a critical NetScaler flaw that was already being exploited. What it is and how to check your appliances.Wed, 11 Nov 2026 00:00:00 GMTnewsnetscalercitrixzero-dayedge-deviceshttps://ryanhenrick.com/research/connectwise-cloud-backup-microsoft-365/https://ryanhenrick.com/research/connectwise-cloud-backup-microsoft-365/In October 2026 attackers used a Cloud Backup application's credential to sign in to customer Microsoft 365 tenants. What is known, and what to check in your tenant.Wed, 11 Nov 2026 00:00:00 GMTnewssupply-chainmicrosoft-365oauthmsphttps://ryanhenrick.com/research/php2shell-patch-php/https://ryanhenrick.com/research/php2shell-patch-php/PHP shipped emergency fixes on 21 October 2026 for two remote code execution flaws. What happened, and what to check on your servers.Wed, 11 Nov 2026 00:00:00 GMTnewsphprcepatchingcve-2026-109618https://ryanhenrick.com/research/what-to-expect-from-a-security-assessment/https://ryanhenrick.com/research/what-to-expect-from-a-security-assessment/What an external assessment covers, what it does not, and what should be in the report.Wed, 11 Nov 2026 00:00:00 GMTexplainerpentestreportingscopinghttps://ryanhenrick.com/research/why-your-website-might-be-insecure/https://ryanhenrick.com/research/why-your-website-might-be-insecure/The common problems I look for first on a public website, and how to check whether you have them.Wed, 11 Nov 2026 00:00:00 GMTexplainerweb-securitychecklistmisconfiguration