Tag: #security

← All posts

• What a bastion is in the cloud, and how to use one well on AWS — ProxyJump measured, SSM Session Manager, EC2 Instance Connect Endpoint

  A bastion is the host that reduces the doors into a private network to one. Go through a jump host with OpenSSH ProxyJump in a homelab and measure what the target server actually sees, then compare the two things AWS rec

  2026-09-10 · 8 min read #aws#bastion#ssh#ssm#security

• Scanning the production image with Trivy — 768 findings, and the real work was three packages and one Dockerfile line

  From a signature-verification bypass in the login library (CVE-2026-27962) to a digest-pinned base image that could never receive OS security fixes. The scanner counting itself, false positives in secret detection, and a

  2026-09-10 · 6 min read #security#cve#trivy#docker#python

• Building a Hands-On Learning Platform on a Home Server — Putting Kubernetes Inside an Unprivileged Pod

  A write-up of putting a learning platform on a 7-node Kubernetes cluster at home: a learner presses a button, a dedicated container comes up, a browser terminal attaches to a real Linux shell, and at every step the serve

  2026-08-20 · 16 min read #kubernetes#cilium#security#homelab#kwok

• The Air-Gapped Operations Playbook — Keeping Up with Security Patches, Rolling Back, and Managing CVE Lag

  The story that begins after the transfer procedure is finished — the operations chapter, about running an air-gapped network for years. It first makes clear that slow CVE response inside an air-gapped network is not team

  2026-08-14 · 13 min read #linux#rhel#air-gap#dnf#security

• Air-Gap Transfer Procedure and Integrity — Building a Bundle That Still Installs the Same Way Six Months Later

  Covers what to put on the transfer medium, what to verify, and how to make that bundle produce the same result when you open it again six months later. It starts with why signature verification matters more in an air-gap

  2026-08-14 · 8 min read #linux#rhel#air-gap#rpm#gpg

• DRAM Address Scrambling and the Layer Beneath a Security Boundary — What Happens When the Fence Sits Above the Translation

  A research tool was published that reads the most hidden memory regions inside a CPU by perturbing address translation in the DRAM controller. The vulnerability is not in any cipher or permission check. It is in the layo

  2026-08-14 · 7 min read #security#hardware#memory#reverse-engineering#firmware

• The HEIR Homomorphic Encryption Compiler and the Condition Called Cost — When the Comments Supply the Number the Announcement Omits

  Google published HEIR, an open source compiler toolchain for homomorphic encryption. The real news here is the compiler, not the cryptography — what has kept homomorphic encryption out of deployment was never the mathema

  2026-08-14 · 7 min read #cryptography#privacy#compiler#machine-learning#security

• Open Source Worth Watching Right Now (4) Observability and Security

  With observability data, volume is cost, and a security tool that never makes it into the pipeline never gets used. This post introduces 12 open source projects that have genuinely taken hold — instrumentation standards,

  2026-08-12 · 5 min read #open-source#observability#security#opentelemetry#ebpf

• What Is Not in the Asset Inventory Never Gets Scanned — OT Exposure Management, From the Water Utility PLC Case

  On 30 July 2026 CISA warned of a sharp rise in activity targeting PLCs in the water and wastewater sector and urged operators to remove internet-exposed OT immediately. The behavior the advisory observed was not compromi

  2026-08-09 · 9 min read #security#ot#ics#plc#cisa

• A Breach With No Attacker — Why Agent Credentials Deserve Another Look

  Hugging Face disclosed a production breach caused by autonomous agents on 16 July 2026, and about three weeks later OpenAI revealed that the attack had leaked out of its own training environment. This post is not an inci

  2026-08-09 · 8 min read #security#llm#agent#incident-response#credentials

• The Exact Scope of the Phrase x86 Hardware Backdoor — Reading rosenbridge as Its Author Wrote It

  The repository title says hardware backdoors in x86 CPUs, but the body of the README states that the only thing believed to be affected is the VIA C3 and that later generations no longer carry the feature. In the disclai

  2026-08-09 · 9 min read #security#hardware#x86#cpu#fuzzing

• How AI Found Two Years' Worth of Chrome Bugs in a Single Month — Reading the Number 1,072 Correctly

  According to an announcement Google made on July 30, 2026, Chrome 149 and 150 — the two versions released in June alone — fixed 1,072 security bugs, more than the 1,036 fixed across the previous two years and 23 mileston

  2026-07-31 · 12 min read #ai#security#chrome#fuzzing#vulnerability

• Authentication, Authorization, and IDOR — Why the Login Is Fine but You Can See Data That Belongs to Someone Else

  Most real data breaches come from authorization, not authentication. The classic case is IDOR, where the login passes normally but changing only the ID in the URL returns another user resource verbatim. This post separat

  2026-07-26 · 15 min read #security#authorization#idor#api#multi-tenant

• Secrets Management — Why a .env File Is Not Enough, the Paths Environment Variables Leak Through, and How to Design Rotation

  Adding .env to .gitignore does not make a secret safe. The process environment is readable verbatim from the same host through /proc/PID/environ, it rides out in crash reports, debug pages and CI logs, and it stays forev

  2026-07-26 · 16 min read #security#secrets#devops#vault#kubernetes

• Decoding the TLS handshake and certificate errors — why the browser works but curl fails

  When the browser shows a healthy padlock while only curl and server-side calls fail with a certificate error, the problem is server configuration. The browser downloads the missing intermediate certificate itself through

  2026-07-26 · 15 min read #network#tls#ssl#openssl#security

• How to Read Container Image Vulnerability Scan Results — The Real Way to Turn Hundreds of Criticals Into Zero

  Run an image scanner for the first time and you get thousands of vulnerabilities, a good number of them Critical. Hand that report to the team as is and nothing happens. This post starts from the fact that all a scanner

  2026-07-26 · 13 min read #security#container#docker#trivy#kubernetes

• SQL Injection and Parameter Binding — The Places That Still Break When You Use an ORM

  The first thing people search for as a defense against SQL injection is an escaping function, but the right answer is parameter binding. Escaping is an attempt to make a value safe inside a string literal, while binding

  2026-07-26 · 16 min read #security#sql#database#orm#python

• Dependency Supply Chain Security — The Things a Lockfile Does Not Block

  You wrote a dozen or so packages into package.json, yet more than a thousand get installed. This post explains why transitive dependencies are riskier than direct ones, and uses a real lockfile entry to show why an integ

  2026-07-26 · 14 min read #security#supply-chain#npm#sbom#ci

• When .gitignore is not working — the number one cause and a close reading of the pattern rules

  You clearly wrote it in the ignore list, and yet the file keeps getting committed. The reason is almost always the same one: ignore rules do not apply to a file that is already tracked. This post covers the exact command

  2026-07-26 · 12 min read #git#gitignore#troubleshooting#security#version-control

• JWT or Sessions, and When — Settling the Authentication Choice by Asking Where the State Lives

  The difference between JWT and sessions is not encryption or performance. It is one question: does authentication state live on the server or on the client? From that choice follows the fundamental weakness of JWT, the i

  2026-07-26 · 13 min read #web#jwt#session#authentication#security