Topic
34 articles found
What finally made me stop procrastinating on it was reading about the CISA leak. A contractor for the Cybersecurity and Infrastructure Security Agency maintained a public GitHub repository called "Private-CISA" that exposed administrative credentials to three AWS GovCloud accounts, dozens of plainte
The threat actor known as PCPJack has hijacked cloud servers associated with Amazon Web Services (AWS), Google Cloud, and Microsoft Azure to create a covert SMTP email relay network. "Compromised business servers across the U.S., Europe, and Asia were quietly converted into SMTP proxies, verified fo
In Part 1, we implemented Application-Level Envelope Encryption. Our documents are now protected by per-record AES keys, wrapped in user-specific RSA envelopes. But a secure application is more than just secure data — it must have a secure infrastructure. Under SOC 2, two critical principles often c
VoidZero, the team behind Vite, Vitest, Rolldown, Oxc, and Vite+, is joining Cloudflare. Vite stays open source, vendor-agnostic, and built for everyone.
The message looked completely normal. A recruiter, a short pitch, a "take-home challenge" hosted on GitHub. Clone it, run npm install, get the dev server up, build a small feature, send it back. Standard stuff. I have done a dozen of these. This one was trying to steal my wallet keys and browser ses
The AI agent security community has been converging on a problem. A researcher recently ran an experiment — feeding a memory-retrieval framework 10 scenarios involving certificate operations: signing, issuing, revoking, delegating. The system retrieved the right memory 8 out of 10 times. It matched
Should you run CSPM tools yourself or bring in a managed service? There's no universal answer. It depends on your team, your environment, and your honest assessment of what you can sustain. Running CSPM internally works when: You have dedicated cloud security staff: Someone whose primary job is oper
A security reviewer finds a critical issue a day or two before the release of an application. While it's an important issue, it sets the team back weeks, frustrating their product management partners and customers. The review came at the most expensive time in the process. There are many examples of
A stack de autenticação em .NET fica sólida quando separamos duas responsabilidades: ✅ Argon2id para guardar senhas (hash irreversível, lento, memória-intensivo) ✅ JWT Bearer para provar identidade depois do login ✅ Validação de iss, aud, exp e assinatura em cada request ✅ Segredos fora do repositór
Abstract: Authentication modules represent the absolute frontline of application security. This article presents a practical, code-level case study on transforming a highly vulnerable, legacy PHP authentication script into an enterprise-ready, OWASP-compliant system. By implementing atomic database
Recently, I lost a lot of time reviewing and would have lost even more implementing, what I can only describe as vibe-written specs. Requirements that felt coherent while saying almost nothing concrete. The kind of document where every paragraph sounds reasonable until you scratch the surface a bit
1. Executive Summary Field Details Challenge Name Bypass Me Category Binary Exploitation / Reverse Engineering Difficulty Beginner–Intermediate Target bypassme.bin on foggy-cliff.picoctf.net:53044 Primary Technique Static reverse engineering + XOR cipher decoding Key Vulnerability Runtime password d
Me and a friend recently noticed a gap in the security tool space. Most corporate File Integrity Monitors (FIM) out there are heavy, complicated, and worst of all: they come packed with telemetry endpoints sending data to god knows who. We wanted something different. Something private, fast, and ent
Many educational resources exist outside of IBM Vault to help users get the most value out of their secrets management experience with Vault. From developer docs to videos authored in-house by HashiCorp, an IBM company, to user and community-generated content, users have access to many resources out