# HadayaLab
> In-browser supply-chain inspectors and signed CycloneDX 1.6 attestations for PHP 7.4–8.5, Laravel, Next.js 15 / React 19, Node.js 20–26, Docker/Alpine, and AI Agent MCP/SKILL.md stacks.

## Articles & Technical Advisories
- [PHP2Shell (CVE-2026-109618 / CVE-2026-109619): Check Your PHP 8.3 / 8.4 Runtime and Vaccinate Production](https://hadayalab.com/blog/php2shell-cve-2026-109618-109619-check-and-vaccine.md): Your composer audit is green. The vulnerable component may be the PHP binary itself, including App Engine workers that were never restarted.
- [Node2Shell (CVE-2026-111497): Brotli Decoder Memory Corruption in Node.js 22 / 24 / 26, Check and Vaccinate](https://hadayalab.com/blog/node2shell-cve-2026-111497-brotli-rce-check-and-vaccine.md): npm audit scans your dependency tree. The vulnerable code is in the Node binary's native Brotli decoder, reachable on both inbound requests and outbound fetch().
- [EOL PHP 7.4 / 8.0 / 8.1 and PHP2Shell: Virtual Patching with Cloudflare WAF and PHP-FPM Without Downtime](https://hadayalab.com/blog/eol-php-74-80-81-php2shell-virtual-patch-waf-vaccine.md): End-of-life PHP branches get no upstream fixes. You can shrink exposure to CVE-2026-109618 and CVE-2026-109619 today, then upgrade on your schedule.
- [React2Shell + Node2Shell + Postgres RLS: A Combined Audit for AI-Built Next.js and Supabase SaaS](https://hadayalab.com/blog/react2shell-node2shell-nextjs-rsc-combined-audit-vaccine.md): Three independent failure classes can sit in the same app: an RSC protocol RCE, a Node runtime memory bug, and tenant data exposed by missing Row-Level Security.
- [Stale Docker Images and PHP2Shell / Node2Shell: Audit Cloud Run, Kubernetes and AWS Lambda for Pre-Oct-21 Base Layers](https://hadayalab.com/blog/docker-aws-lambda-php2shell-node2shell-stale-image-audit.md): A floating tag like php:8.3-fpm or node:22-alpine is a moving target. If your CI cached the layer before 2026-10-21, you may be shipping the vulnerable binary today.
- [AI Agent Supply-Chain Poisoning: Scan SKILL.md, .cursorrules and mcp.json for Hidden Unicode and Exfiltration Hooks](https://hadayalab.com/blog/ai-agent-mcp-skill-poisoning-scanner-and-attestation.md): Your agent trusts text files that humans never read character by character. Bidi control characters and hidden shell hooks make that trust exploitable.

## Platform
- [Credit Wallet & Pricing](https://hadayalab.com/pricing): Transparent self-serve credit pricing for in-browser inspections, non-breaking vaccines, and signed CycloneDX 1.6 SBOMs.
- [Verify an attestation](https://hadayalab.com/verify): Public verification gateway for DSSE Ed25519 signatures and CycloneDX 1.6 SBOMs.
- [Sovereign Solutions & Blueprints](https://hadayalab.com/templates): 20 battle-tested Cloud and AI architectures.
- [Public Ed25519 Keys](https://hadayalab.com/.well-known/hadayalab-attestation-keys.json): Public JWK key set.

## Authority & Governance
- [About Hajime Chiba & 45x Google Cloud & DeepMind Skill Badges](https://hadayalab.com/about.md): Executive profile and verified credentials.
- [Trust & Security Specification](https://hadayalab.com/security): Clean-room license isolation and zero-exfiltration CSP specification.