DevSecOps
The Detection Gap: Transparency Matters Commercial endpoint detection and response (EDR) tools are black boxes. You buy a binary, run it with elevated privileges, and trust it works. You don't know what rules it's actually using. You don't know if detections are accurate or
Threat Intel
The Exploit That Shouldn't Exist: Microsoft Defender's Race Condition A Windows zero-day dubbed RoguePlanet has been released publicly. It exploits a race condition in Microsoft Defender to escalate privileges from a standard user to SYSTEM level. The exploit was released by Nightmare Eclipse (also known
Threat Intel
Persistence: The Attacker's Real Goal A Linux server gets cleaned up after an intrusion. The suspicious process is terminated. Credentials are rotated. The system is rebooted. Everything seems secure. A few hours later, the same outbound connection appears again. That's persistence. The attacker no longer needs
Threat Intel
A Mail Server Vulnerability With No Workaround The Exim mail server project announced a critical use-after-free vulnerability in its GnuTLS backend. All versions from 4.97 through 4.99.2 are affected. The only fix is upgrading to 4.99.3. What makes this vulnerability particularly dangerous: triggering
Threat Intel
18 Vulnerabilities, One High-Severity: And AI Found Some OpenSSL released patches for 18 vulnerabilities in June 2026. That alone would be significant. But one detail stands out: several were discovered with AI assistance, including the highest-severity flaw. CVE-2026-45447 is a heap user-after-free bug in
DevOps
Authentication: SSH Keys vs Personal Access Tokens When you work with GitHub from the command line, you need to prove your identity. Two methods exist: SSH keys and Personal Access Tokens (PATs). Both work. They solve slightly different problems. SSH Keys: Long-Term, Passwordless Access An SSH key is a
Threat Intel
The Threat Changed: Your Workstation Is Your Supply Chain A developer's machine gets compromised. Credentials are stolen—SSH keys, cloud tokens, npm publishing credentials. The attacker uses those stolen tokens to push malicious code to dependencies. The developer's next package update reaches thousands of users, and
DevOps
Pick the wrong reverse proxy and you'll spend a weekend fighting trailing slashes, broken WebSockets, or a TLS renewal that silently died three months ago. The three that actually matter today are Nginx, Caddy, and Traefik. They all terminate TLS and forward requests to a backend, but they
DevSecOps
Most dependency scanners are good at one thing: handing you a wall of CVE IDs and walking away. You get the what's broken. What you almost never get is the what do I run to fix it — the part you actually have to figure out yourself at 11pm
DevSecOps
The Problem: A Single Key, Zero Alerts An attacker gains access to your system. They add a public key to an existing account. No alerts fire. No failed authentication attempts appear in logs. No brute-force signatures. The SSH daemon sees a trusted credential and grants access. That key now
DevSecOps
The Cloud MITM Problem: It's Not Just the Network Edge A man-in-the-middle attack positions an attacker between two communicating parties to intercept, read, or modify data without detection. In traditional networks, that meant Wi-Fi eavesdropping or LAN-level attacks. In modern cloud environments, the
Self-Hosting
I moved my Obsidian vault off Obsidian Sync and onto my own box about a year ago, and I've never looked back. The plugin that makes it work — Self-hosted LiveSync — talks to a CouchDB backend, gives you real-time sync across desktop and phone, and end-to-