Blog
Notes on technology, building, and whatever I'm learning.
Latest
Oct 13, 2026
Storm-0558: When a Stolen Signing Key Forges Any Token
A single stolen token-signing key let attackers mint valid cloud identities and read email in about 25 organizations. Root cause, blast radius, and what to do about your own keys.
Oct 9, 2026
CircleCI Breach: Stolen Session Cookies and Your CI Secrets
One infected engineer laptop, one stolen SSO session, and every customer secret in CircleCI was in play. What failed, the blast radius, and how to make CI secrets cheap to rotate.
Oct 6, 2026
The chalk/debug npm Compromise: Anatomy of a Package Hijack
One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.
All posts
61 posts
Oct 2, 2026
Snowflake Customer Breaches: Why Passwords Without MFA Still Lose
The 2024 Snowflake customer data thefts needed no exploit, just stolen credentials and no MFA. Root cause, blast radius, and a phishing-resistant MFA rollout plan.
Sep 29, 2026
Browser Extension Supply Chain Attacks: Trusted Update, Hostile Code
The Cyberhaven extension compromise showed how one phished developer account turns a trusted browser extension into a session-token thief — and how to defend against it.
Sep 25, 2026
CVE-2026-21580: Confluence XSS That Skips Straight to Admin
An unauthenticated stored XSS in Confluence Data Center and Server chains into privilege escalation, turning your internal wiki into a path to full instance takeover.
Sep 22, 2026
CVE-2026-72898: Metabase Bug Nobody Escalated Hit 1M Users
An unauthenticated SQL injection in Metabase's password-reset endpoint gave attackers admin access — and an unread advisory turned it into a million-record breach.
Sep 18, 2026
Malicious Docker Hub Images Are Hiding in Plain Sight
Typosquatted and trojanized public container images have quietly served cryptominers and backdoors for years — why registry pulls need the same scrutiny as package installs.
Sep 15, 2026
DNS Hijacking Doesn't Need a Zero-Day, Just Your Registrar Login
A hijacked registrar or Route 53 account lets an attacker redirect your whole domain silently — how it happens, why TLS makes it worse, and how to detect and recover fast.
Sep 11, 2026
The IAM Permissions That Quietly Grant Admin, One Hop at a Time
A handful of ordinary-looking AWS IAM permissions combine into full account takeover — the policy chains attackers look for first, and how to close them.
Sep 8, 2026
Shai-Hulud Turns Your Own Laptop Into a GitHub Actions Runner
The Shai-Hulud npm worm backdoors developer machines by registering them as self-hosted GitHub Actions runners, then uses GitHub Discussions as its command channel.
Sep 6, 2026
Delete a Bucket, Steal the Data: Cross-Cloud Namespace Risk
Bucket names are globally unique but ownership is not permanent — new research shows deleting and re-registering one silently hijacks AWS, GCP, and Azure data pipelines.