Tag: #security

← All posts

• How Far Has OpenBao Actually Diverged from Vault — Tracing the Fork Through Release Notes, Up to v2.6's Namespace Sealing

  Exactly two years have passed since OpenBao's v2.0.0 GA (2024-07-17), and v2.6.0 shipped three days ago. This post sets aside the tribal framing — 'BUSL betrayal' versus 'sustainability' — and checks where the fork actua

  2026-07-17 · 10 min read #security#open-source#devops#licensing

• Reading OpenSSH 10.4 Closely — Experimental ML-DSA Composite Signatures, the Next Step After the mlkem768 Default, and the Deprecations That Bite Operators

  OpenSSH 10.4, released on July 6, 2026, looks like a bugfix release on the surface, but read the release notes closely and two threads emerge. One is the next step of the post-quantum transition — key exchange was effect

  2026-07-17 · 15 min read #security#openssh#ssh#post-quantum-cryptography#cryptography

• DMARC Becomes a Standard After 11 Years — RFC 9989's Tree Walk, the pct Sunset, and the p=reject Warning

  DMARC (RFC 7489), the de facto standard for email authentication since March 2015, was actually an Informational document that never went through IETF working-group consensus. In May 2026 the IETF replaced it with three

  2026-07-17 · 15 min read #email#dmarc#dns#security#rfc

• Keycloak 26.7 — SCIM Promoted to Preview, Multi-Cluster v2 Without External Infinispan, and What to Watch in the Upgrade

  Keycloak 26.7.0, released on July 9, 2026, promoted the SCIM API — a request that had been open for nearly four years — to preview, and shipped multi-cluster v2 in preview, which builds multi-cluster HA out of the databa

  2026-07-17 · 16 min read #security#keycloak#sso#iam#scim

• The Road to 47-Day TLS Certificates — Step-by-Step Dates from the SC-081v3 Ballot Text, Let's Encrypt's 45-Day Transition, and ACME ARI

  As of March 15, 2026, the maximum lifetime of publicly-trusted TLS certificates has already dropped from 398 days to 200 days, and under the schedule locked in by the CA/B Forum ballot (SC-081v3) it keeps falling — to 10

  2026-07-17 · 16 min read #security#tls#certificates#webpki#automation

• The 18 CVEs in curl 8.21.0 — the "High-Quality Chaos" That Followed the End of the Bug Bounty

  On June 24, 2026, curl 8.21.0 set a new project record by shipping 18 CVEs in a single release. Yet all 18 are Low or Medium, and there hasn't been a single High since October 2023. Behind that number is a project that,

  2026-07-17 · 15 min read #network#security#curl#cve#open-source

• Who Maintains OPA Now — Styra's Team Joins Apple, and 11 Months of Verifiable Record

  On August 20, 2025, an announcement said OPA's founders and a number of Styra team members were joining Apple, and a rumor spread through the community that 'Apple acquired OPA.' Checking primary sources tells a differen

  2026-07-17 · 12 min read #security#opa#authorization#open-source

• October 11, 2026: The Root KSK Changes — What's Actually in the Root Zone Right Now ♪ Listenable

  The root KSK — DNSSEC's trust anchor — moves from KSK-2017 to KSK-2024 on October 11, 2026. For most resolvers this is a non-event thanks to RFC 5011, but for a validating resolver that failed to pick up the new trust an

  2026-07-16 · 25 min read #network#dns#dnssec#security#protocol

• Why Post-Quantum Certificates Are Not Here Yet — ML-DSA Signature Size, the 10kB Wall, and Merkle Tree Certificates ♪ Listenable

  In the post-quantum transition, key exchange (encryption) is already well underway, but certificates and signatures are still at the starting line. The reason isn't cryptography — it's size. The ML-DSA-44 signature defin

  2026-07-16 · 21 min read #security#post-quantum-cryptography#tls#webpki#certificates

• Passkey Portability Only Half Arrived — CXF Became a Standard, CXP Is Still a 2024 Working Draft

  FIDO has two credential-exchange specs. CXF, which defines what gets exchanged, became a Proposed Standard on August 14, 2025 and even got an errata on March 9, 2026 — but CXP, which defines how it gets exchanged, is sti

  2026-07-16 · 16 min read #security#passkeys#webauthn#fido#standards

• AWS Lambda MicroVMs — Running Agent-Written Code Under VM Isolation, and the New Problem Snapshots Create

  AWS launched Lambda MicroVMs on June 22, 2026. It sells Firecracker micro-VMs as a service, and the market it's aiming at is clear — running user- or AI-generated code, isolated per tenant. It moves the container's share

  2026-07-16 · 17 min read #security#firecracker#microvm#aws-lambda#sandboxing

• One Issue, the Whole Supply Chain — How an Agent Inside CI Broke, and What the Defenses Actually Bought ♪ Listenable

  The Claude Code GitHub Actions vulnerability that GMO Flatt Security researcher RyotaK disclosed on June 1, 2026 traces, end to end, how an agent dropped into a CI pipeline can become the channel that hands over an entir

  2026-07-16 · 21 min read #security#ai#prompt-injection#supply-chain#ci-cd

• What ROV Blocked, What ASPA Still Can't — the June 2026 Telegram Hijack and the Next Layer of Routing Security ♪ Listenable

  On June 16, 2026, India's Rcom (AS18101) hijacked Telegram's prefixes, and Kentik's measurement shows the hijacked path reached only 1.6% of Kentik's own BGP sources — a case where RPKI ROV actually worked. But that's be

  2026-07-16 · 23 min read #network#bgp#rpki#routing#security

• The 3-Hour axios Account Takeover — Provenance Was On, and Nobody Checked It

  At 00:21 UTC on March 31, 2026, a malicious version 1.14.1 landed on axios, a package with over 80 million weekly downloads. What makes this case interesting is that axios was already using npm trusted publishing — the l

  2026-07-16 · 18 min read #security#supply-chain#npm#nodejs#devsecops

• QuadRF and Software-Defined Radio — What "Seeing WiFi Through a Wall" Really Means

  QuadRF, featured by Jeff Geerling, is a development kit that stacks a 4×4 MIMO software-defined radio and a phased-array antenna on a Raspberry Pi 5. The provocative headline — "see WiFi through my wall" — is not X-ray v

  2026-07-11 · 6 min read #sdr#rf#radio#raspberry-pi#hardware

• Why npm supply-chain attacks won't go away — what npm-scan actually checks, and the defenses that work

  npm supply-chain attacks are not isolated accidents but a recurring product of install scripts, transitive dependencies, and typosquatting. In 2025 the Shai-Hulud worm self-replicated through install scripts and harveste

  2026-07-11 · 7 min read #npm#supply-chain#security#javascript#nodejs

• GhostLock: a stack use-after-free that hid in Linux rtmutex for 15 years (CVE-2026-43499)

  GhostLock (CVE-2026-43499) is a stack use-after-free in the Linux kernel's real-time mutex code that, per the nebusec.ai IonStack part II writeup, sat in mainline from 2.6.39-rc1 in 2011 until a fix in April 2026 — about

  2026-07-11 · 6 min read #linux-kernel#security#use-after-free#privilege-escalation#rtmutex

• EU Chat Control 1.0: what actually passed, and the client-side scanning question

  On 9 July 2026 the European Parliament let a message-scanning regulation pass even though more MEPs in the room voted against it than for it. The label Chat Control hides two very different things: a voluntary derogation

  2026-07-11 · 6 min read #privacy#encryption#eu-regulation#client-side-scanning#messaging

• Building SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features

  Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re

  2026-07-09 · 9 min read #keycloak#sso#oidc#security#devops

• Hunting Bugs with AI — The Era of Automated Security Research ♪ Listenable

  Cases of AI automatically probing APIs at scale to uncover vulnerabilities are on the rise. From how fuzzing, differential analysis, and LLM-assisted triage work, to the asymmetry of attackers also using AI, the implicat

  2026-06-25 · 20 min read #devops#security#ai#bug-bounty#fuzzing