Simon Melotte

Cloud & network security architect, 19+ yrs. Building InvoSys (PEPPOL e-invoicing, BE) & MonPanier in public. AI agents, K8s, Terraform. Views my own.

[Simon Melotte @SimOnWebNow]

Hi, I'm Simon. 19+ years in cloud & network security (K8s, AWS/Azure, Terraform, NGFW).

Now building in public, solo, from Belgium:
- InvoSys: PEPPOL e-invoicing for BE freelancers
- MonPanier: click-and-collect for local shops

Cloud security + AI agents + honest build logs.

[Simon Melotte @SimOnWebNow]

@zhangwei379009 Good catch on the startup files. Anything sourced from .bashrc or .zshrc runs with your full environment, so keeping API keys out of those files is a good habit even outside agents.

[Simon Melotte @SimOnWebNow]

@_ground_truth Agree. Assume the sandbox will leak and make sure the agent holds nothing worth leaking: short-lived scoped tokens per task, and a human approval on anything irreversible.

[Simon Melotte @SimOnWebNow]

@severitydaily This is the part that worries me. Silent security fixes never show up in CVE-driven scanners, so teams waiting for an advisory stay exposed. Staying on current releases beats patching only what has a CVE.

[Simon Melotte @SimOnWebNow]

@AndraxPentester Agreed, patch first. Disabling a feature is a stopgap, running an old client with known root bugs is the real exposure. Worth pinning a minimum Tailscale version in your fleet checks.

[Simon Melotte @SimOnWebNow]

@cathrynlavery Good call. While it's off, it's a good moment to review the SSH rules in your tailnet policy file too: who can reach which machines, as which user. Tight rules there also limit the damage of the next bug.

[Simon Melotte @SimOnWebNow]

Sources:
NVD: https://t.co/UQxuRNG2m8
Node.js: https://t.co/K9WVeYDoQz
Envoy: https://t.co/KsUL3NCXUu
Istio: https://t.co/tOF0p5iqEH

[Simon Melotte @SimOnWebNow]

A critical Brotli bug (CVE-2026-111497) lets a crafted compressed stream corrupt decoder memory: crash, data leak, possibly RCE.

It's not just your web server. Brotli ships in Node.js zlib, Envoy, and Istio with Brotli decompression on.

Fixed versions below. Patch and restart.

[Simon Melotte @SimOnWebNow]

@EmilFine For me the two big ones are the content the agent ingests (prompt injection) and the credentials it holds. Keeping secrets off the box that scrapes the web solves a lot of both.

[Simon Melotte @SimOnWebNow]

@braddoran1 Same lesson here running a small fleet of bots: each one gets its own access, and inbound email or web content is never treated as instructions. Separation per bot turns a mistake into a small incident instead of a full account takeover.

[Simon Melotte @SimOnWebNow]

@samstrongng Agree with the intern model. I'd add scoped, short-lived tokens instead of long-lived API keys, and a log of every tool call. When something goes wrong you want to know exactly what it touched.

[Simon Melotte @SimOnWebNow]

@BalaiBB This is why anything an agent reads from disk, web or email has to be treated as data, never as instructions. Sandbox the agent and keep credentials it doesn't need out of reach, so when an injection lands the blast radius stays small.

[Simon Melotte @SimOnWebNow]

@techyoutbe Good plan. I'd put agent tool permissions in the first days too: most real damage comes from what an agent is allowed to call, not what it says. Least privilege on tools and tokens belongs right next to prompt injection.

[Simon Melotte @SimOnWebNow]

Most pods never talk to the Kubernetes API, yet by default each one gets a service account token mounted inside it.

Land in that container and the token is the first thing an attacker grabs.

Fix: set automountServiceAccountToken: false, then opt in only for pods that need it.

[Simon Melotte @SimOnWebNow]

@spacedevin MonPanier: click & collect for neighbourhood shops in Belgium 🇧🇪 0% commission.
https://t.co/HBEpZccE4c

[Simon Melotte @SimOnWebNow]

@spacedevin InvoSys: invoicing + Peppol e-invoicing for Belgian freelancers. Built solo in Belgium 🇧🇪 7 days free, no card.
https://t.co/BtmLPgLZ8b

[Simon Melotte @SimOnWebNow]

https://t.co/DRIa9jafbk

[Simon Melotte @SimOnWebNow]

The flaws behind php2shell have been in PHP for over a decade, back to 5.4. Two CVSS 9.2 bugs (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution, and your app doesn't need its own bug. WordPress, Drupal and Joomla were all shown exploitable.

[Simon Melotte @SimOnWebNow]

New on 23 Oct: CVE-2026-115560 is not fixed by these patches. Interim mitigation is session.upload_progress.enabled=0. Then watch for PHP workers starting shells or downloading tools.