I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
DevSecOps
F5 pushed an out-of-band security release on July 15 covering eight vulnerabilities across NGINX and BIG-IP. The one that matters most is CVE-2026-42533, a heap buffer overflow in the map directive reachable by unauthenticated crafted HTTP requests, and the affected version range is the part
DevSecOps
Containers feel like VMs — own hostname, own process list, own network — but the isolation is namespace sleight-of-hand over a shared kernel, not a hardware boundary. Worth verifying rather than assuming, because the gap between "looks isolated" and "is isolated" is exactly where container escapes
System Design
KVM is the virtualization layer underneath most of the Linux world you already touch — Proxmox, oVirt, OpenStack, and every "KVM VPS" you've ever rented all sit on it. It's built into the kernel, it's been production-grade for well over a decade,
Kubernetes
The core move in GitOps is making Git the desired-state control plane and letting a controller reconcile the cluster to match it, continuously. Traditional CI/CD pushes to the cluster; GitOps pulls. That single inversion is where most of the security benefit comes from, and it's the
Cloud Security
ELB is the piece that makes "highly available on AWS" mean something — a stable entry point that spreads traffic across targets, drops unhealthy ones, survives an AZ going dark, and scales with Auto Scaling underneath. The three flavors solve different problems, and picking the wrong one is the
DevSecOps
The classic tell: a box with clean top, clean ps, an EDR reporting green, and outbound encrypted traffic to an IP that netstat swears isn't there. Every user-space tool agrees the system is fine because every user-space tool asks the same kernel the same question, and
DevOps
Three load balancers, three different jobs, and in real production they usually stack rather than compete. HAProxy for high-throughput L4/L7 distribution, Nginx for application-aware routing and TLS termination, Cloudflare for global Anycast edge and failover. Here are production-shaped configs for each, the tradeoffs that decide which
Linux
Ubuntu 26.04 keeps Netplan as the default network layer, YAML files under /etc/netplan/, rendered to either systemd-networkd or NetworkManager. Nothing dramatic changed from earlier releases, but a few sharp edges still catch people, and one of them will disconnect you from a remote box mid-SSH if
Kubernetes
Manual compliance audits don't survive contact with Kubernetes. Pods live and die in seconds, a snapshot is stale the moment you take it, and a single kubectl patch applied during a 3 a.m. incident silently drifts a cluster off its CIS baseline until the next scheduled audit
DevOps
If you've ever maintained a private repository alongside a public mirror — internal infra code you want to open-source part of, or a confidential project with a public-facing subset — you know the sync problem gets ugly fast. Manual cherry-picking, scrubbing internal paths by hand, forgetting which
DevSecOps
Most people maintaining an open source project weren't hired to be security engineers, and GitHub's security settings page is dense enough that it's easy to close the tab and move on. But leaving those settings untouched quietly stacks the deck against you: no automation,
Linux
Ripping the init system out of a running Linux install is the kind of thing most of us know is possible but never actually do, because PID 1 is the one process you really don't want to get wrong. Daniel Cordova did it anyway — pulling systemd and dropping