The PHP CVE impacted you, too

23 Oct 2026 🔖 security 💬 EN

Even if you didn’t program any of your applications in PHP, you were impacted by PHP CVE-2026-109618 & CVE-2026-109619, because it’s time to go look at how your vendors managed it. After all, they’ll be handling similar attacks against whatever programming language you do use.

When you lose your Visual Studio perks after an email addess change

15 Oct 2026 🔖 tutorials iam 💬 EN

Perhaps you worked for ABCDE Corporation, and it just got bought out by VWXYZ Corporation, and last night they changed your email address from JaneDoe@ABCDE.com to JaneDoe@VWXYZ.com in Microsoft Entra ID.

Hey, wait a minute!

• Why are all the paid features grayed out in the Visual Studio (“VS”) IDE desktop software?
• Why is your license level back down to the free default of Stakeholder in all of your Azure DevOps (“ADO”) subscriptions?
• Where’s your old list of free Windows license keys?

Griping as a Service, on vBrownBag

09 Oct 2026 🔖 prompt engineering 💬 EN

I presented “Griping as a Service: LLM-assisted requirements analysis” on vBrownBag.

Things I need my politicians to know about AI after Bernie's ban proposal

14 Sep 2026 🔖 prompt engineering security professional development 💬 EN

Despite having followed Dr. Timnit Gebru, Dr. Emily Bender, etc. back in the days before LLMs went public, I haven’t really talked about the sociopolitical side of LLM-based generative AI, other than joking about it as the “plagiarism-at-scale machine” and pointing out how short-sighted and cruel the resulting Taylorism at workplaces is.

Attempts to make fetch -- I mean GovOps -- happen

30 Aug 2026 🔖 iam security databases devops professional development prompt engineering 💬 EN

Somehow at Open Source Summit North America 2026 (my #OSSummit recap here), I ended up in the LinkedIn identity and access management ecosystem (maybe through Okta’s Jennifer Mulford?), and I’m hooked (hi, come find me 👋). It’s a bunch of standards committee member type wonks pondering and debating the issues I blogged in May 2025 in “Securing Authenticated Agentic AI, one of whom is named Mike Schwartz.

How to censor MCP servers with Azure APIM

17 Aug 2026 🔖 security iam 💬 EN

To reduce your “lethal trifecta” LLM attack surface, your company should probably prevent employees from using any MCP servers that aren’t censored via an API gateway.

How to unapprove old GitHub CLI operations

17 Aug 2026 🔖 security tips 💬 EN

If I have to use the GitHub Copilot CLI tool, I usually end up approving each file-edit one at a time, because I don’t want to forget I blanket-approved write access, forever, for a whole folder. Turns out there’s a file I can simply backspace it out of.

New computer day game plan

07 Jul 2026 🔖 windows devops 💬 EN

My PC’s been in limp mode for two years, and I finally ordered a new-to-me replacement. Given the equipment I have on hand, and the impracticality of buying much more in 2026’s era of price gouging, here’s the plan. (How lucky that I’ve gotten to learn a lot about enterprise “endpoint” management over the last few years. Potentially a game changer. This will be my first round of trying to do “new laptop day” in a repeatable, low-pain fashion.)

Microsoft 365's Agent Registry should list tools

29 Jun 2026 🔖 security iam 💬 EN

Microsoft’s new Agent 365 Agent Registry should list desktop IDE client tools like the GitHub Copilot CLI, GitHub Copilot VSCode Chat pane, etc. Anything less sells enterprises a security story that isn’t meaningful.

GitHub Actions Agentic Workflows

16 Jun 2026 🔖 security devops 💬 EN

1. This is a deterministic CI/CD pipeline, authored in YAML (a classic GitHub Actions “workflow”).
2. This is a nondeterministic CI/CD pipeline, authored in Markdown (a public-preview GitHub Actions “agentic workflow”).

I’m not sure how to feel about that. Lots of “lethal trifecta” (see Simon Willison’s blog) and “software supply chain security” (see Andrew Nesbitt’s blog) issues to be explored, that’s for sure.