The agency that tells the rest of the US government how to secure its systems left administrative AWS GovCloud keys and dozens of plaintext internal passwords sitting in a public GitHub repository for roughly six months. As reported by KrebsOnSecurity, which broke the story after being contacted by the researcher
During an incident, your logs are the one thing you need to trust, and attackers know it. The first move after getting root is almost always to wipe the evidence. If you're not actively protecting your logs, you're blind the moment a breach happens, and there&
There's a gap between what Linux logs by default and what you need to actually detect a compromise. Most environments have logging switched on, which feels like coverage right up until you're pulling logs after an incident and finding fragments: a login here, a process there,
WordPress shipped 6.9.5 and 7.0.2 on July 17 and enabled forced auto-updates, closing a pre-authentication remote code execution in core. Not a plugin. A default install with zero plugins is exploitable by an anonymous HTTP request, no login, no user interaction, no preconditions. The
Hours after Microsoft's July 2026 Patch Tuesday shipped fixes for over 600 CVEs, the researcher known as Nightmare Eclipse (also Chaotic Eclipse) dropped another one that wasn't in it. LegacyHive is a local privilege escalation in the Windows User Profile Service (ProfSvc) that works on fully
F5 pushed an out-of-band security release on July 15 covering eight vulnerabilities across NGINX and BIG-IP. The one that matters most is CVE-2026-42533, a heap buffer overflow in the map directive reachable by unauthenticated crafted HTTP requests, and the affected version range is the part
Containers feel like VMs — own hostname, own process list, own network — but the isolation is namespace sleight-of-hand over a shared kernel, not a hardware boundary. Worth verifying rather than assuming, because the gap between "looks isolated" and "is isolated" is exactly where container escapes
KVM is the virtualization layer underneath most of the Linux world you already touch — Proxmox, oVirt, OpenStack, and every "KVM VPS" you've ever rented all sit on it. It's built into the kernel, it's been production-grade for well over a decade,
The core move in GitOps is making Git the desired-state control plane and letting a controller reconcile the cluster to match it, continuously. Traditional CI/CD pushes to the cluster; GitOps pulls. That single inversion is where most of the security benefit comes from, and it's the
ELB is the piece that makes "highly available on AWS" mean something — a stable entry point that spreads traffic across targets, drops unhealthy ones, survives an AZ going dark, and scales with Auto Scaling underneath. The three flavors solve different problems, and picking the wrong one is the
The classic tell: a box with clean top, clean ps, an EDR reporting green, and outbound encrypted traffic to an IP that netstat swears isn't there. Every user-space tool agrees the system is fine because every user-space tool asks the same kernel the same question, and
Three load balancers, three different jobs, and in real production they usually stack rather than compete. HAProxy for high-throughput L4/L7 distribution, Nginx for application-aware routing and TLS termination, Cloudflare for global Anycast edge and failover. Here are production-shaped configs for each, the tradeoffs that decide which
Linux
Ubuntu 26.04 keeps Netplan as the default network layer, YAML files under /etc/netplan/, rendered to either systemd-networkd or NetworkManager. Nothing dramatic changed from earlier releases, but a few sharp edges still catch people, and one of them will disconnect you from a remote box mid-SSH if
Kubernetes
Manual compliance audits don't survive contact with Kubernetes. Pods live and die in seconds, a snapshot is stale the moment you take it, and a single kubectl patch applied during a 3 a.m. incident silently drifts a cluster off its CIS baseline until the next scheduled audit
DevOps
If you've ever maintained a private repository alongside a public mirror — internal infra code you want to open-source part of, or a confidential project with a public-facing subset — you know the sync problem gets ugly fast. Manual cherry-picking, scrubbing internal paths by hand, forgetting which
DevSecOps
Most people maintaining an open source project weren't hired to be security engineers, and GitHub's security settings page is dense enough that it's easy to close the tab and move on. But leaving those settings untouched quietly stacks the deck against you: no automation,
Linux
Ripping the init system out of a running Linux install is the kind of thing most of us know is possible but never actually do, because PID 1 is the one process you really don't want to get wrong. Daniel Cordova did it anyway — pulling systemd and dropping
Linux
The most maddening thing about regular expressions isn't the syntax — it's that the syntax changes depending on what you run it through. A feature that works in one tool is missing in another, or present but spelled differently. You write a pattern that works perfectly in
Self-Hosting
Most blog engines want a database, a runtime, a package manager, and a list of dependencies longer than the content you're trying to publish. Carlos Fenollosa went the other direction and built bashblog: a complete static blog generator that lives in a single Bash script of roughly a
Linux
A process with a steady workload shouldn't keep growing its resident memory. When it does, the first question isn't "how much RAM is free." It's "where did allocations stop being released." And on Linux that's rarely obvious from
Self-Hosting
The appeal of a tunnel is that it flips the usual exposure model. Instead of poking a hole in your firewall and accepting inbound traffic, the tunnel client opens an outbound connection to a relay, and public requests come back down that pipe. No open ports on the origin, no
System Design
A benchmark number drops, and within a day half your feed is repeating it: engine X demolished engine Y, here's the chart, end of discussion. The number feels objective. It's a measurement, after all. The trouble is that a database benchmark almost never measures the one
DevOps
Here's a question worth sitting with: what happens if you just point a git server at an object storage bucket? Xe Iaso actually built it — a project called objgit, a git server with no local disk, no /usr/bin/git, and no database. The writeup is one of
DevSecOps
In Omdia's 2026 software supply chain security report, 73% of organizations that generate SBOMs say they enable more efficient vulnerability mitigation — yet 86% still find the generation process challenging. That gap between recognized value and operational difficulty is where most teams are stuck. If you build or secure