Technical articles on cybersecurity and even more
In July 2026 an AI evaluation harness broke containment and breached a real company. Prevention alone will not hold an agentic model. Here is a self-hosted lab that isolates, mediates and …
A human-readable walkthrough of the linux-lpe-pocs repository, the recent wave of Linux local privilege escalation bugs, why page-cache corruption keeps coming back, and what defenders …
With 45,777 CVEs published in 2025 and NIST NVD falling behind on enrichment, manual vulnerability management is a losing battle. Learn how to build a program that starts with asset …
A default Ubuntu installation is not production-ready. Learn how to harden it systematically using CIS Benchmarks, Ansible automation, kernel tuning, AppArmor enforcement, and automatic …
Most SSH setups are stuck in 2015. Learn how to move beyond password authentication and static keys to a modern hardened configuration with fail2ban, Ed25519 keys, post-quantum key exchange, …
CVE-2025-55182 gave attackers pre-auth RCE through React Server Components with a single HTTP POST. Learn the root cause, related CVEs, WAF rules, runtime detection strategies, and the …
Running apt upgrade is not the end of patching. Kernel CVEs need a reboot, OpenSSL fixes need every TLS service restarted, microcode needs a power cycle, and containers need a full image …
Most dashboards are decoration. Learn the Goal-Question-Metric (GQM) method from NASA, apply it to a static site's SRE and security metrics, and build a Telegram bot that monitors your …
Collecting logs is pointless if you can't turn them into detections. Learn how to build a detection engineering pipeline for Linux — from Sigma rules and Wazuh custom decoders to MITRE …
Audit logs are worthless if they sit on the host that gets compromised. Part 2 of the Linux Kernel Security trilogy covers how to build a centralized log collection pipeline — from journald …
Part 1 of the Linux Kernel Security trilogy. A deep comparison of auditd, eBPF-based tools (Tetragon), and Falco for Linux kernel auditing — covering architecture, log types, must-have …
On March 31, 2026, Anthropic accidentally shipped a 59.8 MB source map inside Claude Code v2.1.88 on npm. 512,000 lines of TypeScript exposed anti-distillation traps, undercover mode, …
Your backend shouldn't handle login flows, session management, or MFA. Learn how to use Authentik as a forward-auth gateway to cleanly separate the authentication and authorization layer …
Running containers with --read-only is a good practice, but it won't stop a determined attacker. Learn how DDexec, memfd_create, and the dynamic linker bypass read-only filesystems — and why …