Hi, I'm Toan

Magento Technical Lead & Full-stack Developer

Seasoned Tech Lead with 11+ years of experience in e-commerce development. Currently leading high-performing teams at Sutunam, delivering complex Magento 2, PWA, and Symfony projects for enterprise clients worldwide. Adobe Commerce Certified Expert with deep expertise in local development workflows and open source.

[email protected] linkedin.com/in/kaido4492 github.com/ddtcorex

Projects

All projects →

govard

Go-based local development orchestrator for Magento, Laravel, Symfony, Next.js, WordPress, and more. Docker stacks, SSL, Xdebug, and a desktop dashboard.

Go cordisdeepseek-harnessdev-toolsdjango

omni-ai

🧠 All-in-One AI Assistant Chrome Extension powered by multiple AI providers

gangway

Explicit SFTP editing for VS Code: hotfix one remote file and push it back with Alt+Shift+Q, or push, pull, and preview-sync workspace folders mapped to server paths. Never uploads on save, no background sync.

TypeScript deploymentdeveloper-toolsdevopshotfix

maestro-skills

Universal AI Agent Development Skills Hub & Cordis Plugin for Govard, Magento 2, Laravel. Works with Claude Code, Codex CLI, OpenCode, GitHub Copilot, DeepSeek Harness.

TypeScript agent-skillsai-agentai-skillsclaude-code

maestro-reviewer

AI merge-request review engine and GitLab CI reviewer: one secrets-holding reviewer project, secret-free bridge jobs, per-project AI providers, Docker image ddtcorex/maestro-reviewer

TypeScript ai-reviewci-cdcode-reviewcordis

dsh-maestro-remote

Remote access for DeepSeek Harness: cloudflared tunnel, LAN and public proxies with a PIN gate, QR pairing and Maestro PWA branding

TypeScript cloudflaredcordisdeepseek-harnessdsh-plugin

Recent posts

23 Oct 2026

Roundcube session desync (CVE-2026-114724): a '!' that turns into object injection

CVE-2026-114724 desyncs Roundcube session parsing with a '!' key into object injection. Patch 1.6.20/1.7.5 and check mail hosts.

securitycveroundcubephp

23 Oct 2026

Node.js Brotli RCE (CVE-2026-111497): malformed compression input to code execution

CVE-2026-111497 is an OOB write in Node's bundled Brotli decoder plus TLS bypasses. Upgrade to 22.23.4/24.22.1/26.12.1 now.

securitycvenodejsjavascript

23 Oct 2026

GitLab October release (12 CVEs): unauthenticated RCE via crafted compile input

GitLab's 22 Oct 2026 release fixes 12 CVEs including unauth RCE (CVE-2026-110264). Patch 19.3.6/19.4.3/19.5.1 now.

securitycvegitlabdevops

22 Oct 2026

PHPPresentation flaws (CVE-2026-114403/114404): a slide deck that runs code

PHPPresentation 1.2.0 deserializes objects from uploaded slide files plus a stored XSS. File-upload lessons for PHP apps.

securitycvephpdeserialization

22 Oct 2026

PHP core memory flaws (CVE-2026-109618/109619): when OOM handling corrupts the request

Two Oct 2026 PHP flaws corrupt request memory around OOM handling. Why every Magento host should track PHP patch releases.

securitycvephpinternals

22 Oct 2026

Duplicator plugin PHP Object Injection (CVE-2026-82814): migration input to code execution

CVE-2026-82814 gives unauthenticated PHP Object Injection via Duplicator's migration engine. The deserialization lesson for every PHP shop.

securitycvewordpressphp