Blog
- War story
, 1 min read
jq -e said the health check passed. Prometheus was down.
A Prometheus reachability probe passed while Prometheus was refusing connections. On that host's jq, -e exits 0 on empty input.
Read the post - CVE explainer
, 4 min read
SolarWinds: the supply-chain attack that changed everything
Attackers got into SolarWinds' build system and had it compile their backdoor into signed Orion updates. Up to 18,000 customers installed one. About a hundred were then picked for real intrusions.
Read the post - War story
, 2 min read
Locked out of my own encrypted Arch laptop after a motherboard repair
After a power-IC repair, my Arch laptop stopped booting. The fix came down to efivars in a chroot and two conflicting loader entries.
Read the post - CVE explainer
, 4 min read
Log4Shell (CVE-2021-44228)
One logged string could make a Java server fetch and run an attacker's code. Log4Shell took four patches in three weeks to close, and the hardest part was finding every copy of Log4j.
Read the post - Security guide
, 5 min read
CI/CD pipeline security: where attackers love to hide
A pipeline runs code, holds secrets and can reach production. Codecov in 2021, tj-actions in 2025 and Trivy in 2026 all show attackers using that combination.
Read the post - Security guide
, 4 min read
Kubernetes security hardening: CIS benchmark deep dive
The CIS Kubernetes Benchmark is the checklist auditors reach for. This post covers the controls that matter most and how to check them, and corrects some advice that has aged badly.
Read the post - AI security
, 4 min read
AI-generated code is a security problem hiding in plain sight
Independent studies keep finding vulnerabilities in a large share of AI-generated code, and developers using assistants feel more confident about it. The fix isn't banning the tools. It's gates that don't care who wrote the code.
Read the post - War story
, 1 min read
The Elasticsearch deadlock that parked every index: ILM warm phases on a single node
A single-node Elasticsearch cluster hit 999 of its 1,000-shard ceiling, then deadlocked a month later. Both came from the same missing setting in the ILM policy.
Read the post - CVE explainer
, 4 min read
The XZ Utils Backdoor (CVE-2024-3094)
A contributor spent more than two years earning maintainer rights on a compression library, then shipped a backdoor that reached sshd. It was caught because a login took half a second too long.
Read the post
Start with a $500 audit.
See exactly where you stand. Actionable findings in a week.
The full report and debrief call. Delivery in 5–7 business days.