Articles
Long-form writing on tech, culture, and the edges of the internet.
What a $5 VPS honeypot taught me
An open-source honeypot probe database queryable via curl, HTTP, and MCP - what it catches, why it helps small defenders, and where the risks actually sit.
Your bot defenses just failed
A board-level view of how a stealth Playwright build erodes the assurance value of anti-bot and CAPTCHA controls across the business.
Zero-click chains broke the user-in-the-loop model
Zero-click malware does not need user action. It needs a reachable parser. What fails, why it fails, and what must be true.
Baby monitors exposed one million streams
One million baby monitors and cameras were viewable by unauthorised parties. What it reveals about IoT enforcement and the owner-side blindness behind it.
BitLocker isn't protecting what you think
A systems-level look at what a BitLocker backdoor claim actually means for enterprise security, and how to respond without panic or dismissal.
CISA contractor leaked GovCloud keys to GitHub
Technical analysis of a CISA contractor's leaked AWS GovCloud admin keys on GitHub - blast radius, IAM persistence paths, CloudTrail detections, supply-chain tail.
Contractor pushed the boundary keys
A CISA contractor pushed AWS GovCloud admin keys to a public GitHub repo. The credential format, not the contractor, is the failed control.
Hugging Face revived PapersWithCode in early 2025
Hugging Face's PapersWithCode revival restores the verification substrate LLM engineering teams lost, reshaping pipelines and AI workforce roles.
I built Burp Suite in Rust
Technical breakdown of an open-source Burp Suite alternative - proxy core, fuzzer, scanner depth, Collaborator gap, and what it means for vuln research.
Mandiant clocked exploit window at 21 days
Mean time-to-exploit is 21 days. Vulnerability programs built on 30, 60, or 90 day SLAs are no longer enforced inside the threat window.
Microsoft Exchange zero-day hits unpatched servers
Microsoft Exchange zero-day under active exploitation. What failed, why vendor trust is a perimeter control, and what operators must do now.
Microsoft sent you a code you didn't request
An unrequested Microsoft single-use code email is evidence of external interaction with your identity surface. What it proves and what it does not.