detection engineering
77 posts
One grep, full repo access
A security camera shipped a full-scope GitHub PAT in its login page bundle. The credential exposure, supply-chain exploit path, GitHub audit-log telemetry, and why rotation - not removal - is the only fix.
Your image parser is a remote kill switch
Codex Micro's unvalidated image upload endpoint decodes attacker-controlled rasters in-band with a check-then-act race, enabling CWE-400/CWE-770 resource exhaustion.
Count Binface breaks your correlation rule
Count Binface names a detection-pipeline attack: targeted noise injection exploits data-aggregation bias to bury true positives and poison UEBA baselines.
tanh now fingerprints your OS
Chromium 148 dispatches Math.tanh to the platform libm, leaking OS identity through last-bit IEEE 754 divergence. A silent, unpatchable fingerprinting signal.
The flat line is the exploit
A flat SOC dashboard can be defense evasion, not a quiet network. How APTs shape telemetry to land in a pipeline's discard paths, and why the graph is the IOC.
XBOW topped HackerOne in 2025 and fixed nothing
Vulnerability research rewards finding, not fixing. Exploitation tracks disclosure, not the flaw. Why attackers react to reported CVEs, and where telemetry goes blind.
The copy runs past the allocation, again
Recurring dystopian tech vulnerabilities persist because defenders patch the CVE instance and never hunt the underlying mechanism. The inaction is the vuln.
The string you validated no longer exists
Unicode transliteration is a Turing-complete rewrite engine at every trust boundary. CVE-2024-4577, Django CVE-2019-19844, and Trojan Source show why.
A valid go.sum hash proves nothing
Argegy is not a CVE. It's a Go supply chain claim against go-ethereum - module trust, init() execution, T1195, and where telemetry goes blind.
Kalshi ships an unauthenticated oracle
Kalshi resolves contracts against unauthenticated public news feeds - an oracle-manipulation flaw that lets crafted narratives move regulated markets.
Not a pricing problem
Why security automation like Splunk SOAR and ML triage costs more than the engineer it replaced: systems execute on referenced trust, not verification.
Vectra lifted bearer tokens off Teams disk
Why Microsoft Teams session tokens leak between workspace and consumer accounts, how bearer-token replay bypasses MFA, and what fires - and doesn't - in telemetry.