Jazz Digital
Website and app security remediation from Chiang Mai, for companies in Thailand and abroad. We audit what you run — PHP and WordPress, Laravel, Node.js, Next.js, React Native, iOS and Android — patch what is exploitable within days, check whether anyone got in first, and harden the stack so the next advisory is a non-event.
WordPress and its plugins, Laravel, Drupal, Magento, Next.js, Astro, Rails, Node.js and Express, with the servers they run on: nginx, Apache, PHP-FPM, Docker, Linux.
React Native and Expo, native iOS and Android, the SDKs and the backend APIs behind them: authentication, token handling, storage, update pipelines and store builds.
npm, Composer and PyPI packages, GitHub Actions and CI secrets, container images and the credentials scattered through .env files. We find what is exposed and rotate what should never have been there.
Every runtime, framework and plugin version you run, mapped against current advisories, ranked by what is exploitable from the internet today. Plain language, one page, with the order of work.
Upgrades, backports and mitigations shipped and tested, a compromise check for web shells, backdoors and odd logins, and a re-scan that shows each hole closed.
Dependency monitoring, a WAF rule set, an update pipeline your team can run, and a short handover so the next advisory is a routine Tuesday, not an incident.
October brought serious remote code execution flaws in PHP, Node.js and Next.js, the software behind a huge share of the web. Our team finds what is exposed, patches it fast and proves the hole is closed.
Unauthenticated remote code execution in PHP itself, demonstrated against WordPress, Drupal and Joomla. Exploit attempts started before the patch shipped.
An out-of-bounds write in the bundled Brotli decoder opens the door to remote code execution. One of ten CVEs fixed across the 22, 24 and 26 lines.
Two unauthenticated remote code execution flaws, one in image optimization and one in 'use cache' Cache Components.