Research, product updates, and practical writing from the Skyreach Orion team.https://blog.skyreachtech.co.uk/https://blog.skyreachtech.co.uk/posts/a-cve-is-not-an-answer/https://blog.skyreachtech.co.uk/posts/a-cve-is-not-an-answer/When a serious CVE lands, "do we use it?" is the first question. It isn't the answer a CTO, customer or board needs. The questions that follow decide what you patch first.Wed, 28 Oct 2026 00:00:00 GMTVulnerability ManagementExposureOperationsSkyreach Orion Teamhttps://blog.skyreachtech.co.uk/posts/did-the-nextjs-patch-reach-every-app/https://blog.skyreachtech.co.uk/posts/did-the-nextjs-patch-reach-every-app/Next.js has fixed two unauthenticated remote code execution bugs. Patching the main app is the easy part. The app that gets hit is usually the one nobody remembers owning.Wed, 28 Oct 2026 00:00:00 GMTVulnerability ManagementApplication SecurityNext.jsSkyreach Orion Teamhttps://blog.skyreachtech.co.uk/posts/where-do-php-and-node-actually-run/https://blog.skyreachtech.co.uk/posts/where-do-php-and-node-actually-run/PHP2Shell and Node2Shell are both on CISA's list of exploited vulnerabilities. Before you can patch, you need to know where the runtimes are, and the official Docker images hide them from most scans.Wed, 28 Oct 2026 00:00:00 GMTVulnerability ManagementContainersSBOMSkyreach Orion Teamhttps://blog.skyreachtech.co.uk/posts/reachability-is-a-traversal-problem/https://blog.skyreachtech.co.uk/posts/reachability-is-a-traversal-problem/Most security tools answer "can A reach B?" by matching against stored rules. That is the wrong abstraction. The answer lives in the graph, and it requires walking the structure to find out.Tue, 06 Oct 2026 00:00:00 GMTArchitectureReachabilityProductResearchSkyreach Orion Teamhttps://blog.skyreachtech.co.uk/posts/three-questions-before-approving-a-network-change/https://blog.skyreachtech.co.uk/posts/three-questions-before-approving-a-network-change/Most risky network changes do not fail because the engineer forgot a command. They fail because the review never forced the team to make the blast radius, rollback point, and verification plan explicit.Fri, 02 Oct 2026 00:00:00 GMTChange ManagementNetwork SecurityOperationsSkyreach Orion Teamhttps://blog.skyreachtech.co.uk/posts/why-dns-is-often-the-missing-layer-in-incident-reviews/https://blog.skyreachtech.co.uk/posts/why-dns-is-often-the-missing-layer-in-incident-reviews/Teams investigating a network incident usually jump straight to routing, firewalls, and service health. DNS often gets checked too late, even though it is where many partial failures begin.Tue, 29 Sep 2026 00:00:00 GMTDNSIncident ResponseResilienceSkyreach Orion Team