Incident Response.
All posts.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What Broke, How to Fix It, and What It Means for Salesforce
PHP2Shell is two critical PHP engine flaws allowing unauthenticated RCE. How the bugs work, the patched versions, and why your Salesforce integrations matter.
Salesforce Guest User Anomaly Fired: Scanner, Tester, or Data Leaving? Investigate It with sf audit incident
A Salesforce Guest User Anomaly fired. Scanner, tester, or data leaving? How sf audit incident turns the alert into a cited, defensible verdict, offline.
Salesforce Outage Recovery After Incident 20004433: What Fails Silently Once the Status Page Turns Green
Salesforce incident 20004433 hit core services on 16 September 2026. The sf CLI queries that find the async work that failed quietly while you waited.
Why Filtering Salesforce Event Logs by IP Misses Most of the Incident
Salesforce splits one actor's activity across event types with different identifying fields. Why IP filtering misses the SOQL, and how to correlate safely.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Locked Out After Salesforce MFA Enforcement: Recovery Paths, Temporary Codes, and the Break-Glass Account You Should Have Built
Locked out after Salesforce MFA enforcement? The recovery paths, temporary codes, Support realities, and how to build a break-glass admin account for your org.