Category Sector
Techniques and tooling, and how each gets built.
35 articles
PHP had an emergency release. Engineers had a long week. I built a small lab for the part that still needs doing: establish which runtime answered, check the patch evidence, and leave a handoff another person can use. I'm fresh and ready to work.
Read Article →Google, I challenge you to a duel of wits. Someone I love outlived the technology they understood. Medical technology keeps them here. Email keeps changing the rules. In the age of AI, give them something better than another warning to be careful.
Read Article →Containerizing something became a way to signal that you know what you are doing, and for a certain kind of engineer the signal is the point. The same confidence that ships a docker-compose.yml never asks what it does when it breaks, and the failure that opens the door does not look like a security bug, so nobody admits it is one. This is the difference between a bug and a reliability defect, the short chain for forcing the second, and how that chain runs from one starved container to a poisoned CI cache that ships to everyone downstream, and into the agent that trusts the build.
Read Article →Part three of the transit trilogy, after the portal and the phone: the open data. Agencies publish ridership as open data and call it anonymized. It is not. A trip is hidden only among the riders who made the same trip in the same hour, and when that count is small, one anchor turns it into a name. Grounded in the mobility-unicity research and a runnable auditor that measures where a release re-identifies people and proves the fix. Defensive by design. No one was re-identified.
Read Article →A forward look, companion to the OMNY report. Institutions kept moving the sensitive thing onto the phone, payment, keys, transit, and now government ID, on one assumption nobody writes down: that the device cannot be turned against its owner. Dopamine 3.0 documents support for iOS 26.0–26.0.1 on A12/A13 devices, and that narrow support puts the compromised-client question back on the table. This says only what is now possible, not what was done. The Secure Element still holds. The trust that transit operators, and even governments, placed in an un-openable phone no longer does.
Read Article →Every CISO knows the multi-million-dollar stack is a house of cards waiting for one motivated actor. Louis Vuitton found that out in 2025 through a third-party account, while the firewall held. A hypothetical holiday red-team against a Maison, built on what already happened, modeled on the crew doing it right now, and named for the one street in New York that taught everyone how a good fake passes at the counter.
Read Article →Account-update failures led to a transit lab testing cross-account card reads and sensitive changes with a valid session. Eight fixture checks pass. Live OMNY authorization and the suspected telemetry dependency remain unproven.
Read Article →Ray 2.59.0 warned that token authentication was disabled. I checked its local Jobs API: one request, zero credentials, a shell command running. The browser CVE had already been patched. This run tested the separate authentication setting.
Read Article →A shared photo can carry a canary endpoint. Requests leave network and client metadata, but a fetch is not a person and a user-agent is not an identity. A field note on what the ledger can tell you, and what still belongs in the offline sheet.
Read Article →Continental One emails me four times a month to inform me that my data has been found on the dark web. The alert monitors the wrong stage of the pipeline, addresses the wrong threat model, and ignores the actual fraud vectors that took $40B from card issuers in 2025. The architecture below is what the alert pretends to be.
Read Article →Buying an Italian eSIM from abroad turned into four hours of VPN errors, console instructions, and a failing accessibility widget. The assistant kept calling it a fraud shield. The browser showed a messier story.
Read Article →A tax identifier, a federation login, and a card with a chip solve different problems. Italy puts them in the same administrative journey. The citizen gets to discover the boundaries at the login screen.
Read Article →Your website has a border now. Papers, please.
Read Article →The perimeter isn't a firewall anymore. It's a behavioral signature, the way your script touches the DOM, the timing of your API calls, the fingerprints your environment leaves before you've done anything. GHOST_PROXY is a full-stack UserScript workshop and offensive security sandbox built for the 2026 detection landscape. Neural intercepts, Shadow DOM obfuscation, AI-assisted payload hardening. The hardest vulnerabilities aren't in the code. They're in the assumptions.
Read Article →The smartest attacks do not prey on your ignorance. They weaponize your reflexes. The unsubscribe link feels like cleanup. In a bad email, it can be the trap.
Read Article →A drone-security research interface with simulated RF and telemetry views, synthetic detector checks, and a WebUSB discovery path. Claiming a radio is one step. Reading its samples and proving detection is another.
Read Article →The Alfa AWUS036ACH was a legend in 2017. It's a relic in 2026. But in the gap between modern Wi-Fi 7 security and the legacy equipment still running the world's infrastructure, the 'Old Blue' is still the most reliable instrument in the bag. This is why we still use it, how to keep the drivers alive on modern kernels, and what it taught us about the persistence of plaintext.
Read Article →A zigzag wall, a relay road, and a captured ruler make sharp security analogies. The October 2026 test is whether your recovery route still works when the network and identity service it secretly depends on are gone.
Read Article →Pierre Le Grand captured a much larger vessel by looking like a fishing boat. In 2026 the fishing boat is a compromised IoT printer. The overconfidence premium hasn't changed. The attack surface has.
Read Article →Bourdieu wrote about authority that feels natural. A fraudulent payment request can borrow that authority before anyone checks the account number.
Read Article →Zhussupov's book makes an argument most security curricula avoid: you cannot defend against techniques you haven't written yourself. XOR obfuscation, dynamic API resolution, DLL hijacking, the red team toolkit, explained.
Read Article →The horse comes with a story. So does the urgent invoice and the call that sounds like your boss. Generative AI gives the impersonator more material, while the useful defense still has to interrupt the requested action.
Read Article →A rootkit doesn't want to destroy anything. It wants to become the source of truth. Hoglund and Butler documented how in 2005. The technique is still operational in 2026, it just travels under a signed certificate now.
Read Article →A Python packet-monitoring and evasion research toolkit. Rule loading works; destination precedence and live enforcement need separate evidence. The original article promised command wrappers and undetected scans the current source does not demonstrate.
Read Article →A photograph records a loss. A production estimate needs a model of what reached the field, what was lost, and what became visible. Before auditing the superpower, audit the estimator.
Read Article →The rational actor ran the numbers. Saturated, hyper-alerted Western targets versus rapid-growth Arab infrastructure with undersaturated local defenders. The math was obvious. Kim et al. (2025) documented where the syndicates went. This is why.
Read Article →The spectrum around you was built for range and reliability, with authentication as an afterthought and encryption optional, fine when receivers were expensive and expertise was rare. Neither is true anymore. A working map of what broadcasts, what listens, and what it takes to watch the layer below the network.
Read Article →The temporary role still works. The application can reach metadata. A logging change has an ordinary API name. The shared-responsibility gap appears in the permissions and records connecting those three facts.
Read Article →Security isn't a state of being. It's a rate of change. The attacker has a budget, the defender has a constraint set, and in 2026 both of them have AI. The math hasn't changed. The velocity has.
Read Article →Reinstall Windows. Replace the drive. A firmware implant can still be there at the next boot. LoJax made that persistence concrete in 2018. Checking it takes more than a clean process list or one reassuring register bit.
Read Article →Someone tells your laptop to leave. Someone changes the address book. Someone reports ice on the road. Wi-Fi, ARP, DNS, and connected vehicles give us different ways to ask who gets believed, and what happens after.
Read Article →The counter moved by three between two visits. That gives you a net change and an observation gap. Turning it into three Bitcoin payment timestamps requires evidence the page never supplied.
Read Article →A firewall is a set of rules. Rules have exceptions. Tunneling finds them. Brennon Thomas wrote the plumber's handbook and in 2026 every lesson in it still works, the pipes are just carrying more interesting cargo.
Read Article →Newsrooms are intelligence targets, not brochure websites. Tit for Tat checks origin candidates, CMS and RSS exposure, and fetched-resource integrity. Its hashes and canary heuristics produce evidence to inspect, not a visitor identity or a guarantee that a page is clean.
Read Article →The touchscreen, the paper, the scanner, and the results website do different jobs. A useful red-team exercise follows the ballot between them, records what changed, and checks whether the independent evidence catches it.
Read Article →