Abusing OIDC in CI/CD: A Step-by-Step Tutorial on GitHub Actions Token Trust Chains
Hands-on tutorial: configure GitHub Actions OIDC federation to cloud IAM, then walk through real misconfigurations that let attackers mint cloud…
How to Hash Passwords in 2026: Argon2id, bcrypt and the NIST Baseline
Argon2id, bcrypt, scrypt and PBKDF2 compared: memory-hardness, OWASP baselines, NIST 800-63B rules, and the perennial mistakes.
Terraform State: The Most Sensitive File in Your Infrastructure
How Terraform state works, why it stores secrets in plaintext, and the remote-backend, locking and drift practices that make it safe.
Hands-On Container Escape Lab: Privilege Escalation from Pod to Node with Real Commands
Build a safe, vulnerable minikube lab and practice real container escape techniques step by step: privileged pods, hostPath mounts, service account abuse, and node privilege escalation — with verified commands and blue-team detection tips.
JWT Security: alg=none, Key Confusion and Why the Header Lies
The JWT vulnerability class explained: alg=none, RS256/HS256 key confusion, jwk and kid injection — and the RFC 8725 defenses.
Weekly Threat Intel: Supply Chain Compromises, Autumn CVE Exploitation and Infostealer Trends
Supply-chain compromise of a maintained npm package, active exploitation of autumn KEV CVEs, and infostealer delivery trends — the week’s threat picture and what defenders should do about each.
UEFI Secure Boot and BlackLotus: The Boot Chain of Trust Under Attack
How UEFI Secure Boot anchors trust in firmware, how BlackLotus bypassed it via CVE-2022-21894, and why revocation took years to roll out.
Weekly Threat Intel: Edge CVEs, MCP Agent Abuse, Stealer Cashouts
Edge CVEs under active exploitation, AI-agent abuse patterns, and infostealer cash-out trails — the week’s threat picture and what defenders should do about each.
HTTP/3 and QUIC: How the Web Moved to a New Transport
How QUIC rebuilt web transport on UDP: per-stream delivery, 1-RTT handshakes with TLS 1.3 inside, connection migration — and the real costs.
Dependency Confusion Lab: Reproduce and Defend Your Pipeline
Build a CTF-style lab that reproduces dependency confusion and namespace squatting — then lock them down with scoped registries, lockfile pinning and reproducible builds.
Cosign Signing and Verification Lab: Sign, Verify, Enforce
Sign and verify artifacts step-by-step with Sigstore Cosign: keyless signing, transparency log entries, and admission-time verification in a hands-on lab.
Kerberos Attack Paths: Golden Tickets, Silver Tickets and Kerberoasting
Golden Ticket, Silver Ticket and Kerberoasting explained: what each forgery needs, what it bypasses, and the log signals that catch them.