detection engineering
79 posts
Copy.fail has been root since 2017
Copy.fail turns an unprivileged Linux user into root via a copy_file_range credential cache flaw. Reachable since 2017. Telemetry gaps explained.
Binding 65535 ports is the easy part
Architecture and evasion realities of an LLM honeypot binding all 65535 ports - TPROXY, latency tiers, fingerprint defence, and detection traps.
Pick offense or defense
Two paths into infosec - offense and defense - broken down at the mechanism level. Foundation, tooling, telemetry, and the divergence point.
The Roblox cheat never touched Roblox
How a Roblox cheat turned into a Vercel supply chain compromise - stealer to stolen token to dependency confusion to persistent build-pipeline access.
Vercel hands attackers your build pipeline
Technical IR playbook for a Vercel CI/CD compromise: attack chain, MITRE ATT&CK mapping, telemetry gaps, containment sequence, and residual exposure.
Your MSSP is selling you blindness.
MSSPs run perimeter-era detection while attackers operate inside the identity boundary. The gap is structural, not a resourcing problem.
Your security pipeline missed 271 bugs
Mozilla's Anthropic Mythos scan surfaced 271 Firefox 150 vulnerabilities. The delta exposes the limit of single-pipeline vulnerability assurance.