I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
DevOps
Authentication: SSH Keys vs Personal Access Tokens When you work with GitHub from the command line, you need to prove your identity. Two methods exist: SSH keys and Personal Access Tokens (PATs). Both work. They solve slightly different problems. SSH Keys: Long-Term, Passwordless Access An SSH key is a
Threat Intel
The Threat Changed: Your Workstation Is Your Supply Chain A developer's machine gets compromised. Credentials are stolen—SSH keys, cloud tokens, npm publishing credentials. The attacker uses those stolen tokens to push malicious code to dependencies. The developer's next package update reaches thousands of users, and
DevOps
Pick the wrong reverse proxy and you'll spend a weekend fighting trailing slashes, broken WebSockets, or a TLS renewal that silently died three months ago. The three that actually matter today are Nginx, Caddy, and Traefik. They all terminate TLS and forward requests to a backend, but they
DevSecOps
Most dependency scanners are good at one thing: handing you a wall of CVE IDs and walking away. You get the what's broken. What you almost never get is the what do I run to fix it — the part you actually have to figure out yourself at 11pm
DevSecOps
The Problem: A Single Key, Zero Alerts An attacker gains access to your system. They add a public key to an existing account. No alerts fire. No failed authentication attempts appear in logs. No brute-force signatures. The SSH daemon sees a trusted credential and grants access. That key now
DevSecOps
The Cloud MITM Problem: It's Not Just the Network Edge A man-in-the-middle attack positions an attacker between two communicating parties to intercept, read, or modify data without detection. In traditional networks, that meant Wi-Fi eavesdropping or LAN-level attacks. In modern cloud environments, the
Self-Hosting
I moved my Obsidian vault off Obsidian Sync and onto my own box about a year ago, and I've never looked back. The plugin that makes it work — Self-hosted LiveSync — talks to a CouchDB backend, gives you real-time sync across desktop and phone, and end-to-
Threat Intel
Now Being Exploited: A Three-Year-Old Container Escape A Linux kernel vulnerability that's been public for three years is now being actively exploited in the wild to escape containers and gain root access. CISA added it to their Known Exploited Vulnerabilities (KEV) catalog on June 2, 2026,
Threat Intel
The Attack: Seconds, Not Hours A new denial-of-service technique discovered by Calif security researchers can knock major web servers offline in seconds from a home computer on a 100 Mbps connection. The attack, dubbed HTTP/2 Bomb, chains two old techniques together in a way that nobody had
Linux
If you live in a Linux terminal but your daily driver is a Windows box, Microsoft just handed you something useful — and a few sharp edges. At Build 2026 they shipped Coreutils for Windows, a native port of the common GNU coreutils commands, built on the Rust-based uutils project.
AI Security
The Problem DockSec Solves: Vulnerability Noise You run Trivy on your container image. It reports 200+ CVEs. You stare at a list of vulnerability IDs, CVSS scores, and version numbers. Which ones actually matter for your application? Which can you ignore? Which are exploitable in your specific environment? This is
Threat Intel
A 19-Year-Old Kernel Bug, Found by Machine Learning, Gives Root Asim Manizada found and disclosed a privilege escalation in the Linux kernel's CIFS (SMB file sharing) subsystem called CIFSwitch. The vulnerability chains four normal pieces of Linux infrastructure—keyrings, the cifs.upcall helper, user namespaces, and