DevOps - security and FinOps notes
Notes from operations: Cloudflare, Wazuh, AI, ecommerce, audit and FinOps.
StyleSmuggler CVE-2026-75650: Adobe hotfix for Magento RCE
Adobe shipped hotfix VULN-39341 for CVE-2026-75650. The patch does not clean an implant. Order: hotfix, IoC scan, encryption-key rotation.
When shared hosting stops being enough for a store
Shared hosting is a good start. Under heavier traffic the cart slows down. That is the moment to move to a VPS or your own virtual machine.
What happens when the store is down and the ticket waits in a queue
On mass-market hosting a store outage ticket waits in the same queue as a password reset. What matters is the contract and your own cart monitoring.
Proxmox VE, what it is for and how to stand up a cluster
Proxmox VE is a way to run your own virtual machines on your hardware. Why a cluster, how to join a second server and how to clone the first machine from a template.
AI threats, crawlers, leakage into a model and a fake counterparty
Training bots collect store and documentation content. People paste secrets into chat. The scope is crawler policy, tool control and a data boundary in the assistant.
Proxmox Backup Server, how it works and how to set up a copy
A snapshot stays on the same disk as the machine. PBS keeps the copy on another server. Datastore, schedule, retention and restore of a VM or a single file.
Cloudflare and malicious bots, score, challenge, origin off the internet
Password stuffing, cart scanning and price dumps. Bot score and a challenge before traffic reaches the store. Origin without a public address and a clear rule for when to raise the threshold.
Networking in Proxmox, bridge, VLAN and firewall
A bridge and VLANs split management, production, tests and backups. The Proxmox firewall runs on the cluster, the host and the VM. How to lay it out so staging does not see the database.
Ecommerce protection, checkout, edge and traffic you can name
Bots, card testing and a jump during a campaign. WAF on the cart, origin hidden, and traffic view says whether these are customers or a scan. Before the peak we test checkout, not the homepage.
Magento Open Source, what the stack is and how to put it together
Magento is the store: catalogue, cart, orders. It needs PHP, a database, cache, search and background jobs. Apache and files on shared hosting are rarely enough.
Wazuh, one picture of the host, the alert and on-call
Agents on hosts, file change and a control list in one console. An alert has an owner, a threshold and a close date. Without that a SIEM is a log warehouse.
Linux diagnostic commands, what they are for and how to read the output
A few commands show whether the store is slow because of CPU, memory, disk or neighbours on the host. What to run and how to read it before you add RAM.
How to check the CPU on a cheap VPS and why vCPU is not enough
The offer promises many vCPU and a lot of RAM at a low price. Store speed depends on CPU generation and on whether neighbours take time. How to measure that before you renew.
A CIS audit that does not end as a PDF
A CIS scan or cloud posture becomes a backlog: priority, owner, change window and proof of closure. A 30, 60 and 90 day plan can be settled at the next review.
Cloudflare Bot Fight and WAF, how to cut malicious bots off the store
Bots hit login, the cart and the API before anyone buys. Bot score, a challenge and a request limit at the edge. How to set that without blocking payment.
How to limit scraping of the catalogue, blog and documentation
A scraper dumps product cards, articles and the API. robots.txt sorts the polite ones. A request limit and Cloudflare cut the rest. How to set listing, search and docs.
How to secure the application: session, panel, secrets and dependencies
A session cookie, two-factor login on the panel, passwords outside the repo and up-to-date libraries. What to turn on in Magento, WordPress and on the server.
Which data to protect and how to set that up
Customers, secrets, the copy, staging and logs. First a list of collections. Then encryption, who has access, how long to keep it and whether the copy actually boots.
FinOps, before the cloud invoice arrives
Tags, showback and rightsizing protect product margin. The team sees its bill. Then anomalies, rightsizing and commitments.
A load test before the peak, not during it
A traffic scenario from analytics, a database bottleneck and a scaling decision, before marketing starts the campaign. A longer run shows a connection leak you will not see after two minutes.