I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
Threat Intel
Now Being Exploited: A Three-Year-Old Container Escape A Linux kernel vulnerability that's been public for three years is now being actively exploited in the wild to escape containers and gain root access. CISA added it to their Known Exploited Vulnerabilities (KEV) catalog on June 2, 2026,
Threat Intel
The Attack: Seconds, Not Hours A new denial-of-service technique discovered by Calif security researchers can knock major web servers offline in seconds from a home computer on a 100 Mbps connection. The attack, dubbed HTTP/2 Bomb, chains two old techniques together in a way that nobody had
Linux
If you live in a Linux terminal but your daily driver is a Windows box, Microsoft just handed you something useful — and a few sharp edges. At Build 2026 they shipped Coreutils for Windows, a native port of the common GNU coreutils commands, built on the Rust-based uutils project.
AI Security
The Problem DockSec Solves: Vulnerability Noise You run Trivy on your container image. It reports 200+ CVEs. You stare at a list of vulnerability IDs, CVSS scores, and version numbers. Which ones actually matter for your application? Which can you ignore? Which are exploitable in your specific environment? This is
Threat Intel
A 19-Year-Old Kernel Bug, Found by Machine Learning, Gives Root Asim Manizada found and disclosed a privilege escalation in the Linux kernel's CIFS (SMB file sharing) subsystem called CIFSwitch. The vulnerability chains four normal pieces of Linux infrastructure—keyrings, the cifs.upcall helper, user namespaces, and
Self-Hosting
A few years back, self-hosting was a niche thing. You'd run Nextcloud on an old laptop, brag about it on a forum, and move on. Now it's practically a movement. Every other thread is someone pulling their photos off Google, their notes off Notion, their
AI Security
Anthropic says it's clearing the way for a public release of its Mythos-class models, months after holding them back over security concerns. The company had originally limited access because of what it saw as real risk to software in the wild, both public and private. Why Mythos
Linux
Every infrastructure team I've worked with has the same dirty secret. There's a directory somewhere — usually on a shared drive, sometimes in a 1Password vault if the team is feeling responsible — that contains the SSH public keys of everyone who's ever needed access to
Linux
You've Done It: Pasted a Password, Hit Enter, Immediately Panicked You paste a curl command with an API key embedded. You hit Enter. The command works. Then you realize: where did that string just land? Bash saved it. To ~/.bash_history. Which is readable by anyone with access
Linux
A Linux process is an instance of a running program. The kernel manages every process that starts on your system, allocating CPU time, memory, and file descriptors. Understanding process management is essential for debugging performance issues, terminating rogue processes, and understanding system behavior. Think of processes as tasks in a
Linux
Alpine's Quiet Experiment Signals Larger Shift Alpine Linux, the Linux distribution that has spent years as the poster child for "you don't need systemd," is now experimenting with systemd compatibility. This isn't a headline-grabbing announcement. It's more of a
Threat Intel
Critical: Any cPanel User Can Become Root LiteSpeed's cPanel plugin has a privilege escalation flaw that's actively being exploited right now. Any cPanel user on your server—including a compromised account—can run arbitrary scripts as root. CVSS 10.0. This isn't theoretical. What