The Blog
Cybersecurity for startups from a security researcher and cybersecurity advisor: vulnerability breakdowns with step-by-step fixes, AI and agent security, compliance like India's DPDP Act, and the security checklist I use as a fractional CTO. On-site and Medium, all in one place. Back to the blog.
On 14 October 2026 Next.js shipped an out-of-band fix for two critical unauthenticated remote code execution flaws and a Server Actions denial of service. Here is what each one needs to be exploitable, how to tell in five minutes whether your app is exposed, and a step-by-step upgrade guide, including the sharp trap that leaves 15.x apps vulnerable after upgrading.
·11 min read
PHP2Shell is a pair of critical PHP flaws that let an attacker run code on a web server with a single unauthenticated request. Exploitation started before the patch shipped. Here is what happened, who is affected, and a step-by-step guide to finding every PHP install, patching it, mitigating what you can't patch today, and checking whether you were hit.
·12 min read
AI agent security, explained for founders by a security researcher who runs a multi-LLM platform: an agent is only as dangerous as the tools and data you hand it, and prompt injection means any text it reads can try to steer it. Here are the five risks that matter, the permission model I use, where a human must stay in the loop, and a ten-point AI agent security checklist for your first launch.
·11 min read
India's Digital Personal Data Protection Act is usually explained by lawyers as a consent law. Read it as a security engineer and it looks different: the biggest penalty in the Act is for failing to protect data, not for failing to ask permission. Here is why the law was needed, what the DPDP Rules actually require, and what to build before May 2027.
·13 min read
Most startups don't get breached through a zero-day. They get breached through a shared admin login, a key in a repo, or one config line nobody reviewed. Here is the security checklist I work through in the first weeks of every engagement, including the AI-specific items most founders skip.
·12 min read
Prompt injection is the SQL injection of the AI era. If you are building with LLMs and you have not thought about this, your product has a hole in it. Here is what it is, how it works, and how to defend against it.
·10 min read
When I was doing my M.Tech in Cybersecurity, attackers were skilled but slow. That asymmetry is collapsing. Here is what AI-powered attacks actually look like, and what we built at ColadAI to fight back.
·12 min read
We spent years adding rules on top of rules to catch threats we had already seen. Then we rebuilt the detection layer with ML at ColadAI and realised we had been fighting the wrong battle the entire time.
·9 min read
