The NIS2 Compliance Illusion: Why Your Supplier's PC Dealer Is Now Your Board's Problem
The easy story about NIS2 goes like this: it’s yet another bureaucratic Brussels regulation; the CISO handles it, a consultant delivers a binder before the auditors arrive. Executives could hide…
My Calendar 3.8.8: Critical Security Release
My Calendar 3.8.8 fixes a critical security issue that allowed an unauthenticated attacker to gain full administrative privileges on a site running My Calendar. Due to the severity of this issue,…
Do I need end-to-end encryption on my mailbox?
Inbox Zero for Privacy, not Productivity inspired me to achieve an actual Inbox Zero at my e-mail provider, thereby sufficiently solving the challenge of e-mail encryption for my risk profile.
Crossplane's mental model and moving parts
It is long overdue to continue writing this series on building platforms with Crossplane. Where the previous post mentioned why we’re throwing out a bunch of Terraform code it also just namedrops…
Passkeys Are Not a Trap
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is…
Hands-On: Seculyze for Microsoft Sentinel – Part 1: Calibrate Your Detection Posture
Microsoft Sentinel has matured into one of the most capable cloud-native SIEM and SOAR platforms on the market. With the Content hub, the unified SKU,Continue Reading16 Min. Read
Announcing ColdFusion updates of Oct 13 2026 - p2 security update, with a LOT of changes
Adobe has released another set of updates, on Oct 13 2026, for CF2025 (update 14) and CF2023 (update 26). As with other recent updates, these address vulnerabilities "that could result in arbitrary…
What actually happens when you message Grok Bot
Always-on AI agents are distributed systems. Follow one Grok Bot message from send to sleep: queues, background workers, durable workflows with Temporal, idempotency, Firecracker VMs, prompt caching,…
I found 153,502 fake clones of Shopify stores
Enterprise brand protection costs $20,000+ a year. Most Shopify stores have nothing. Here's what I found, and what I built.
Does vLCM’s “Power Off” Remediation Option Gracefully Shut Down VMs?
A customer recently asked me a question about vSphere Lifecycle Manager (vLCM) image updates on a standalone ESXi host. It’s a good one, and the documentation didn’t completely answer it. The…
What The Impact Of July’s Water Utility Incidents Does & Doesn’t Tell Us
Impact matters in cyber attacks and incidents. It matters much more than the rate or number of attacks. 100+ water utilities being hacked within two days is new. Is it important? What was learned?…
The password you set while debugging
A common mistake is to use weak passwords while debugging and forget to change them before going into production.
Black-Box HashDoS: Attacking Hash Tables Without Knowing the Hash Function
In this article I will describe a novel technique that allows an attacker to pass attacker-chosen string keys to a hash table implementation such that each lookup query takes $O(n)$ instead of the…
New WebSockets Backdoor Likely Targeting Iraq
On September 29 2026, @MalwareHunterTeam shared a suspicious low detection file named document.exe, uploaded to VirusTotal from Iraq on that same day. The sample has minimal detection in VirusTotal:…
GitHub Security Advisory CVE Delays
GitHub's CNA promises CVEs within days, but delivers them in weeks.
Sandboxing Claude Code on Ubuntu
bubblewrap, a proxy and an AppArmor exception: enforcing Claude Code’s sandbox with managed settings and Ansible, probing it from inside and outside, and finding the one gap it cannot close.
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-92392 for the project curl , site reliability workers and systems administrators scrambled to desperately rebuild and patch all their systems to fix a…
Silently Install VSCode Extensions
Installing extensions on VSCodium-based IDEs such as VSCode, Cursor, and Antigravity for persistence
Deploying a Roundhouse app with Kamal
During the latest episode of The Pingback Podcast, we were talking about Roundhouse and Raul asked me how would you deploy a Rails app, compiled to a binary with Roundhouse and Spinel. It is actually…
Automating Kubernetes VM Deployment with Terraform and Ansible
Intro Some months ago, I created six VMs in Proxmox to build my first Kubernetes cluster. Terraform created the machines, but I prepared the nodes manually, as described in this previous article.…
Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
Introduction The investigation began with a Microsoft Defender for Endpoint alert for suspicious screen capture activity involving PowerShell. Examining the process ancestry revealed a larger…
How to Change DB_UNIQUE_NAME and Relocate All Oracle Database Files in ASM (Including PDB$SEED) #JoelKallmanDay
This article provides a step-by-step guide to changing the DB_UNIQUE_NAME parameter in Oracle Database after cloning, migration, or environment refreshes. It explains how to relocate database files,…
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
A . is all you need! Today Microsoft shipped the patch for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as Important severity Remote Code Execution…
Please stop hashing the public key first (or: ML-DSA's µ annoys me)
A goal one might have when designing a signing algorithm is to prevent signing a message one has not seen. Signing a message one hasn't seen might sound difficult at first, but most classical…
The fuzzer is the cheap part: Claude Code for security
Introduction Fun fact: in security testing, the fuzzer is the cheap part. Knowing the system is the expensive part. Over the last few weeks I have been pointing open source security tools at services…
Submarine Cable Resilience
These days there is a large volume of subsea communications cables, estimated at a total of some 1.5 million kilometres, used by 607 in-service submarine cable systems. They are not just important,…
Linux Lockdown and Hibernation (again)
(This is an updated version of an older post - the introduction remains the same, the technical details are different) Linux draws a distinction between code running in kernel (kernel space) and…
Tough Puzzles at the Community Privacy Residency
"As soon as you're caught in the room, cryptography won't help you." Most cryptographers are trained on that separation of concerns. If you're locked in a room, someone can coerce you into handing…
PEAKS No 65: AI Math Breakthroughs, Open Source Crisis & Security Updates
Hi there!🛡️ Security & PrivacyGoogle suspends open-source bug bounty program after AI-generated vulnerability reports flood submissions with low-quality spam. MoreOpenAI…
Zero-downtime Postgres upgrades with logical replication
This is part 3 of a series about Postgres logical replication use-cases, and about how the feature set has evolved over the past ten years and ten releases (Postgres 10 through the Postgres 19 beta),…
How to backup SharePoint with rclone and borg
IntroThis is a short guide on how to backup corporate Microsoft
Status Updates, October 2026
Long time no post! Here are some updates of what’s been going on. Database Backups I switched from logical database backups using pg_dump to physical backups using pg_basebackup. Sometime in…
API Auth Bugs Are Usually State Bugs
Most API authorization bugs get written up as a missing check. The report says the endpoint forgot to verify ownership, as if there was one absent if statement and adding it closes the hole. That…
Importing iCloud Shared Albums into Immich
I recently moved my photo library from iCloud onto a self-hosted Immich instance running on an old MacBook Pro in my living room. Importing the main library went pretty smoothly. The (shared) albums:…
Applying 10 Years of Server Updates in One Shot
The Big Mess o’ Wires website has a new foundation and updated look for 2026, cleaning out the cruft and junk. It’s a familiar story. Over the years, the site accumulated loads of…
Stop Checking Out Other People's Repos in CI
Most multi-repo CI pain comes from one question: how does my build get that other repo's code? Wrong question. Couple repos at the artifact and contract level instead, and most of the PAT sprawl,…
Why I'm Excited About AWS Lambda Web Functions
AWS just launched Lambda Web Functions. A pattern-driven tour of seven protocols and frameworks running on the new form factor, with a companion repo of working examples for each.
Phishing-Resistant by Default: Microsoft’s Passkey Shift
I joined Eric Woodruff and Sean Deuby on the HIP Podcast to discuss Microsoft’s Passkey Shift
encrypted DNS for pihole with dnscrypt
At first I wanted to set up cloudflared for my pihole a la https://pimylifeup.com/raspberry-pi-cloudflare-tunnel/. However, I realized this requires both a cloudflare account and setup of "tunnels"…
A Bayesian Network to Explore Data Center Risks
Data centers required to fuel the ambitions of Artificial Intelligence companies have sparked a nationwide conversation. AI companies are moving quickly to build out infrastructure and local…
Claude-slopped AWS deployments
Why would you do that? The App The architecture Nuance Static stuff Dynamic stuff Authentication Storage API Also NAT Gluing it all together with terraform So what did it cost? Worst case: What could…
TF vendor power - without the SaaS
Terraform vendors sell plan and apply on pull requests, approvals, policy, drift checks and an audit trail, run on their servers with your cloud credentials. terragucci is those pipelines, ready to…
Little Snitch DNS and Tailscale MagicDNS
How to use Little Snitch with DNS encryption and Tailscale MagicDNS: Find your "Tailnet DNS name" at https://console.tailscale.com/admin/dns. It should look something like…
Give your workloads an identity too, with Tailscale
tsiam is another (small) nail in the coffin of static credentials
Technical Due Diligence - Configuring a Secret GitHub Team
Add hidden users to your GitHub organization
Lambda Web Functions as queue consumers
[Lambda Web Functions][main-post] bill for the CPU you actually use, and queue consumers spend most of their time waiting on something else. So is an SQS consumer cheaper as a Web Function than as a…
Go on Lambda Web Functions via execve()
In [my notes on Lambda Web Functions][main-post-ric] I mentioned that the runtime contract is: Lambda import()s /var/task/index.js, then waits for something to accept a TCP connection on…