Articles
Long-form writing on tech, culture, and the edges of the internet.
Baby monitors exposed one million streams
One million baby monitors and cameras were viewable by unauthorised parties. What it reveals about IoT enforcement and the owner-side blindness behind it.
BitLocker isn't protecting what you think
A systems-level look at what a BitLocker backdoor claim actually means for enterprise security, and how to respond without panic or dismissal.
CISA contractor leaked GovCloud keys to GitHub
Technical analysis of a CISA contractor's leaked AWS GovCloud admin keys on GitHub - blast radius, IAM persistence paths, CloudTrail detections, supply-chain tail.
Contractor pushed the boundary keys
A CISA contractor pushed AWS GovCloud admin keys to a public GitHub repo. The credential format, not the contractor, is the failed control.
Hugging Face revived PapersWithCode in early 2025
Hugging Face's PapersWithCode revival restores the verification substrate LLM engineering teams lost, reshaping pipelines and AI workforce roles.
I built Burp Suite in Rust
Technical breakdown of an open-source Burp Suite alternative - proxy core, fuzzer, scanner depth, Collaborator gap, and what it means for vuln research.
Mandiant clocked exploit window at 21 days
Mean time-to-exploit is 21 days. Vulnerability programs built on 30, 60, or 90 day SLAs are no longer enforced inside the threat window.
Microsoft Exchange zero-day hits unpatched servers
Microsoft Exchange zero-day under active exploitation. What failed, why vendor trust is a perimeter control, and what operators must do now.
Microsoft sent you a code you didn't request
An unrequested Microsoft single-use code email is evidence of external interaction with your identity surface. What it proves and what it does not.
MiniPlasma PoC hands attackers SYSTEM on Windows
Public PoC for the MiniPlasma Windows flaw yields SYSTEM execution. What the local privilege boundary failure means for endpoint control posture.
npm registry shipped 314 compromised packages
314 npm packages were compromised because the consumer install path does not verify publisher identity. The boundary failed at install, not registry.
npm was never a trust boundary
Technical analysis of the Shai-Hulud npm supply chain attack hitting 314 packages including echarts-for-react, size-sensor, and timeago.js.