Articles
Long-form writing on tech, culture, and the edges of the internet.
Firecracker contains the attack it never sees
Firecracker microVMs on EC2 bare metal boot in under a second and tear down before any EDR, log flush, or forensic capture can observe them.
five dollars is the instrument
A five dollar demand to return images is a rights-framed extortion probe exploiting unenforced consent governance, not ransomware.
ScStoragePathFromUrl overflows the stack on PROPFIND
CVE-2017-7269 turns an unpatched IIS 6.0 WebDAV server into pre-auth RCE. The exploit primitive, the telemetry blind spot, and the residual exposure.
Stop Killing Games guarantees unpatched network-reachable code
Stop Killing Games is preservation law, not a security control. Statute governs publishers; it never patches the memory-corruption bugs attackers exploit.
The demo passed. Two weeks later, the queue filled.
Prompt engineering treats AI as magic. Reliable LLM systems come from validation, retries, fallbacks, and monitoring - not better wording.
What a tool does never made it safe
When ownership of an integrated, data-access tool changes, existing access persists under a new identity unless it is revoked and re-issued.
When Broadcom bought VMware, Tesco moved 40,000 workloads
Tesco moving 40,000 workloads off VMware shows how systems execute on reference, not validation, and why inherited trust does not survive a change of owner.
A valid JWT authenticates nothing
A JWT is a signed data structure, not authentication. The security lives in the verifier, not the token. Where validation is optional, the boundary is gone.
curl pauses security report intake for July
curl is closing its vulnerability intake for July 2026 to survive AI-generated report spam, and the precedent it sets for open source disclosure.
GrapheneOS Android 17 degrades every exploit primitive
GrapheneOS's Android 17 port: how sync MTE, hardened_malloc, and a hardened kernel degrade mobile exploit chains-and why failed attempts are the loudest telemetry.
No mitigations, full code execution
Memory corruption in shared embedded firmware components grants attacker code execution at firmware privilege, replicated across hundreds of vendor devices.
Removing curl and wget stops nothing
Bash /dev/tcp opens TCP sockets and sends HTTP with no curl or wget, evading process-name detection while leaving cleartext on the wire.