<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Norn // foron23</title><link>https://foron.dev/en/tags/norn/</link><description>Portfolio and blog of Iker Foronda: cloud and DevOps engineering (Kubernetes, Terraform, Azure), AI offensive security and LLM red teaming, and full stack development (Python, Node.js, PostgreSQL).</description><generator>Hugo -- gohugo.io</generator><language>en</language><lastBuildDate>Fri, 06 Nov 2026 00:00:00 +0100</lastBuildDate><atom:link href="https://foron.dev/en/tags/norn/index.xml" rel="self" type="application/rss+xml"/><item><title>Your agent hits you. Do you know how much it hurts?</title><link>https://foron.dev/en/blog/your-agent-hits-you/</link><pubDate>Fri, 06 Nov 2026 00:00:00 +0100</pubDate><guid>https://foron.dev/en/blog/your-agent-hits-you/</guid><description>&lt;p&gt;Thinking about how to improve Norn, I went back to the usual: naming what I want to see when it happens, and what I want to see before it happens.&lt;/p&gt;
&lt;p&gt;At some point in that exercise I asked myself what &lt;a href="https://github.com/foron23/norn"&gt;Norn&lt;/a&gt; detects. It detects obedience: whether the model does what the document tells it, with a canary as witness and a corpus I can count. That part is measured.&lt;/p&gt;
&lt;p&gt;The uncomfortable doubt came right after that. An agent with tools does not only obey: it executes. And of what it executed I had no number. It is not that I measured it badly. It did not exist. The question that comes out of that is not the one the benchmarks ask, which measure whether the attack wins and how much utility defending costs: it is how much of what happened actually hurt, and how much was stopped halfway.&lt;/p&gt;</description><category>ai</category><category>security</category><category>norn</category></item><item><title>PHP2Shell: five days of attacks on a flaw nobody could patch</title><link>https://foron.dev/en/blog/php2shell/</link><pubDate>Thu, 22 Oct 2026 00:00:00 +0200</pubDate><guid>https://foron.dev/en/blog/php2shell/</guid><description>&lt;aside class="callout callout-warn" role="note"&gt;
&lt;div class="callout-head"&gt;
&lt;span class="callout-glyph" aria-hidden="true"&gt;!&lt;/span&gt;
&lt;span class="callout-label"&gt;tl;dr&lt;/span&gt;
&lt;/div&gt;
&lt;div class="callout-body"&gt;&lt;p&gt;Two flaws in PHP&amp;rsquo;s core, &lt;a href="https://www.cve.org/CVERecord?id=CVE-2026-109618"&gt;CVE-2026-109618&lt;/a&gt; and &lt;a href="https://www.cve.org/CVERecord?id=CVE-2026-109619"&gt;CVE-2026-109619&lt;/a&gt; (9.2), give &lt;strong&gt;unauthenticated remote code execution&lt;/strong&gt;: control of the server, whatever application sits on top. A hello world page is enough. Affects everything back to PHP 5.4.&lt;/p&gt;
&lt;p&gt;The second impact is disclosure of process memory, including passwords and tokens belonging to other requests.&lt;/p&gt;
&lt;p&gt;Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Restart the processes&lt;/strong&gt;, not the machine: PHP-FPM, Apache, and any worker that has been up for months.&lt;/p&gt;</description><category>security</category><category>iocs</category></item><item><title>MacGyver on a Raspberry Pi</title><link>https://foron.dev/en/blog/macgyver-on-a-raspberry-pi/</link><pubDate>Tue, 06 Oct 2026 00:00:00 +0200</pubDate><guid>https://foron.dev/en/blog/macgyver-on-a-raspberry-pi/</guid><description>&lt;p&gt;Many of the things that are worth it come from curiosity. Others come from need. What I am telling here sits in the middle of the two.&lt;/p&gt;
&lt;p&gt;Among so much slop on the internet, I realised I could not keep up with every information channel. It was adapt or die, in the purest Darwinian style. Madafaka.&lt;/p&gt;
&lt;p&gt;Since the start of August I have been putting everything I read and everything I decide into a folder of text files. Today it holds 471 atomic notes, 333 sources, 79 syntheses and 7 exchanges. An hour ago it held 470 and one fewer, because the system keeps working while I do other things.&lt;/p&gt;</description><category>ai</category><category>hermes</category><category>learning</category></item><item><title>The Code Is Solved. Now What?</title><link>https://foron.dev/en/blog/the-code-is-solved/</link><pubDate>Tue, 29 Sep 2026 00:00:00 +0200</pubDate><guid>https://foron.dev/en/blog/the-code-is-solved/</guid><description>&lt;p&gt;The code is solved.&lt;/p&gt;
&lt;p&gt;Almost. Not quite. What has been solved is one very specific part of the job, the part that used to eat whole afternoons, and what is left is the part nobody ever had to train.&lt;/p&gt;
&lt;p&gt;For years, my job was this loop: write code, compile, run, it does not work, read the error, change one line, start again. A one-line error could take an entire afternoon. It did not matter how well I had thought the design through: if it would not start, there was nothing. There were days when I got nothing done, and the maddening part was never the error. It was the loop.&lt;/p&gt;</description><category>ai</category><category>development</category><category>sdlc</category></item></channel></rss>