Technology Tales

SolarWinds has issued security updates to address four critical vulnerabilities in its Serv-U file transfer software, which could allow attackers to gain root access on unpatched servers. The most severe flaw, CVE-2025-40538, involves a broken access control issue that enables the creation of system admin users and arbitrary code execution under high-privilege conditions. Additional vulnerabilities include type confusion and an insecure direct object reference flaw, though exploitation typically requires existing administrative access. While over 12,000 Serv-U servers are exposed online according to Shodan, Shadowserver estimates fewer than 1,200 are actively accessible. The software has historically been a target for cybercriminals and state-sponsored groups, with past exploits linked to ransomware campaigns and zero-day attacks. CISA currently tracks nine active SolarWinds-related security flaws, underscoring the ongoing risk posed by unpatched systems.

ModPageSpeed

ModPageSpeed 2.0 is a self-hosted web optimisation tool designed to enhance site performance without relying on external services such as proxies or CDNs. Supported by We-Amp B.V., it builds on the original mod_pagespeed project but introduces a new architecture that processes optimisations outside the main request path, reducing latency and ensuring content remains on the user’s servers. Key features include automatic image transcoding into multiple formats and resolutions, heuristic-based critical CSS extraction and sub-millisecond cache hits using a zero-copy memory-mapped system.

It supports any HTTP-based origin server and operates with minimal configuration, requiring only a licence key for activation. Unlike the older mod_pagespeed 1.x version, which is no longer actively maintained, ModPageSpeed 2.0 includes modern capabilities such as AVIF support and container integration while maintaining a conservative approach to optimisations to prevent site disruptions. The tool is available for a monthly subscription fee, with a free trial period and is positioned as a secure, GDPR-compliant alternative to cloud-based optimisation solutions.

Hackers believed to be working for the Chinese government compromised the popular open-source editor Notepad++ between June and December 2025, delivering malicious updates to users through a hijacked update mechanism. The attackers exploited vulnerabilities in the shared hosting server where the Notepad++ domain was hosted, redirecting certain users to a malicious server that delivered compromised software versions. Security researchers identified the perpetrators as Lotus Blossom, an espionage group known to target government, telecommunications, aviation, critical infrastructure and media organisations, with victims in this campaign being primarily those with interests in East Asia.

The developer, Don Ho, discovered that attackers gained hands-on access to victim computers through the tainted software, though the precise method of the initial server breach remains under investigation. After fixing the vulnerability in November and terminating hacker access in December, Ho urged users to download the latest version containing security fixes, whilst apologising for the incident that affected software that has had tens of millions of downloads over its two-decade history.

Altova recently highlighted three key capabilities in their software products for users who purchased XMLSpy 2022. MapForce now offers PDF data extraction through a visual interface where users can search for specific words to locate and extract tables or other content, which proves particularly valuable when working with large documents or repetitive elements in data mapping workflows. XMLSpy has introduced a graphical BSON editor that displays binary JSON documents in a readable grid format, allowing developers to view, modify and convert between BSON and formats like JSON and YAML without struggling with the inherently unreadable binary format. The company has also developed an XBRL Tagging solution for European Single Electronic Format reporting, enabling business users to visually tag financial statements in familiar PDF or HTML formats using their mouse and searchable menus, which then generates compliant iXBRL reports without requiring deep technical expertise in XBRL standards.

When a manager hesitates over paid Excel training, it usually reflects uncertainty about business value rather than opposition to development, so the case needs to be framed around workflow stability, fewer errors and measurable improvements. Free learning options can build general competence but often fail to address the messy reality of mission-critical spreadsheets, specific business rules and the shortcuts teams use under pressure, which is where targeted training can make processes consistent and repeatable. Cost objections can be met by comparing a modest workshop fee with payroll and showing how even small efficiency gains quickly repay the investment, while the claim that there is no time for training can be reframed as a sign of inefficient systems that a short, focused session can relieve through automation and better methods. Confidence in traditional Excel skills may also overlook modern features such as Power Query, Power Pivot, dynamic arrays, scripting and AI assisted workflows, so a low-risk pilot with before and after measures of time and errors can provide proof and make the decision easier. Here is where you can find out more.

Users can view and modify their personal language, time zone and regional preferences through their profile page in SharePoint, accessible from desktop or mobile devices. These settings only affect the individual user's view of SharePoint sites and do not change how others see the same content. To make changes, users must navigate through their profile picture or name at the top of any SharePoint page, select their Microsoft 365 profile, and access the language and region options through the edit details screen. If working in a local SharePoint environment rather than Microsoft 365, the site collection administrator must first enable additional languages before users can select them, and any language settings changed in Microsoft 365 will override those set directly in SharePoint.

Google Sheets and WordPress can be connected through several methods to streamline content management workflows. A WordPress plugin enables data transfer between the platforms, allowing users to create or update posts automatically when spreadsheet information changes, though this requires a paid business plan and involves technical configuration steps including code handling. Alternatively, users can embed spreadsheet content directly into WordPress pages using iframe links, though this approach raises privacy concerns and offers limited formatting control.

A more efficient solution involves using Zapier, which automates the transfer of content from Google Sheets to WordPress without requiring coding knowledge. This automation proves particularly valuable for writers and content creators who draft articles in spreadsheets before publication, as it eliminates manual copying and pasting whilst maintaining proper formatting. The process involves setting up a trigger that monitors new spreadsheet rows and an action that creates corresponding WordPress posts with customisable settings for categories, images, authors and publication status. Zapier also supports reverse workflows, such as logging published WordPress posts back into spreadsheets for tracking purposes, and can integrate additional steps like AI-generated content enhancement before publication.

Because I have been publishing articles with multiple sections, it has not been that clear when one ends and another starts on pages with more than one being displayed at a time. Thus, I made a slight tweak to the styling to make that clearer: adding box shadows. This has been applied to the welcome header on the front page too, allowing me to tidy up things a little more. After that, I set to sorting out the associated image so that it displays properly. Heading colours got adjusted too in an effort to offer more distinctions between them. The structural clarity was the most important motivation, while the other tweaks freshen things up a little too.

Automation Anywhere is a provider of enterprise automation platforms, utilising what it terms agentic process automation to enable organisations to deploy AI agents that autonomously handle business processes across various industries and functions. The company emphasises its process reasoning engine and offers pre-built solutions targeting sectors such as financial services, healthcare, IT and manufacturing operations, claiming significant efficiency improvements in areas like accounts payable processing and IT service management. The platform aims to orchestrate AI-driven workflows whilst maintaining enterprise-level security standards, holding various ISO certifications and compliance credentials including HIPAA and SOC 2. Beyond its core automation platform, the company provides developer tools, training resources through its University programme and partner networks, positioning its offerings as genuine agent-driven orchestration rather than merely repackaged generative AI layered atop legacy systems.

Sitecore

Sitecore's platform is utilised by numerous global enterprises to enhance digital experiences, streamline operations and improve customer engagement through advanced technologies such as AI, SaaS and headless commerce. Companies like United Airlines, Michelin, L'Oréal, Procter & Gamble and Toyota have implemented Sitecore solutions to personalise messaging, reduce content management times, cut costs and boost efficiency, with examples including a 46% reduction in expenses for Bayer Crop Science and faster publication processes for Michelin. The platform supports integrated content management, digital asset handling and agile marketing strategies, enabling organisations to deliver tailored experiences, optimise campaigns and achieve measurable business outcomes across diverse industries and regions.