I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
Linux
Most server-hardening checklists tell you to "disable root SSH login," "set the firewall to default deny," and "configure auditd with rules," and then stop, leaving you to work out the actual config. This is the version with the config filled in: every control
Self-Hosting
Getting a certificate installed is table stakes; configuring TLS correctly is where servers actually differ. Plenty of production sites serve valid HTTPS and would still earn a C or D from SSL Labs, weak ciphers enabled, TLS 1.0 still accepted, HSTS missing, a certificate expiring next week because nobody
Self-Hosting
A site-to-site VPN encrypts all traffic between two networks so that two offices, a data center and a cloud VPC, or your infrastructure and a partner's, communicate as if they were on the same private LAN, even though the packets cross the public internet. IPsec is
Threat Intel
Evooo1Bot is another Mirai descendant, and the interesting question isn't what it does (routers, cameras, firewalls turned into DDoS bots and proxies, we've seen the shape before) but whether your edge is exposed and how you'd know. FortiGuard Labs' Yi Ping Lin documented
DevSecOps
You kill the weird process, wipe the script, reset the password, grab a coffee, and five minutes later it's running again. That's persistence, and it's almost never movie-malware, it's an attacker using the same cron and systemd you use to keep
Kubernetes
Most StatefulSet tutorials show you a volumeClaimTemplates fragment, list "back up your data" as a best practice, and stop. Then you deploy, and discover the three things they didn't mention: the headless service a StatefulSet requires to actually give pods stable identities, what happens to your
DevOps
Most "how to dockerize an app" tutorials get you a container that runs, and quietly teach you three habits you'll have to unlearn: an outdated base image, a container running as root, and a single-stage build that bakes your compiler and dev dependencies into production.
DevSecOps
Most secrets-detection buyer's guides refuse to name tools. They talk about "evaluation criteria" and "workflow fit" and then, if they name anything at all, drop one sponsored product as the answer. That's useless when you actually have to pick something. This
Self-Hosting
Meta Description Featured Image Alt Text An SPF TXT record being evaluated left to right against a connecting mail server's IP address. Most SPF references drown you in eight mechanisms, eleven macro letters, and two modifiers as if you'll use all of them. You won'
Self-Hosting
DMARC gets asked to do jobs it was never designed for. Teams reach for it as a spam filter, a phishing filter, a general trust signal. It's none of those. The protocol answers one deliberately narrow question: did the owner of the domain in the visible From address
Threat Intel
The first question with SCTPhantom isn't "should I patch," it's "is SCTP even loaded on this host," because for most servers the answer is no and the whole thing is moot, and for the ones where it's yes, you have
Threat Intel
Three weeks after wp2shell, WordPress has shipped another security release with an RCE-capable headline bug, and the coverage is already blurring the two. Get the distinction straight, because it changes your urgency: CVE-2026-64638 in WordPress 7.0.3 is a pre-authentication reflected XSS on the login