{ "@context": "https://schema.org", "@type": "TechArticle", "headline": "Catch a Poisoned Dependency: A Hands-On Lab for Dependency Confusion and Reproducible Builds", "description": "Build a CTF-style lab that reproduces dependency confusion and namespace-squatting…
Verify Before You Install: Sigstore Cosign Signing and Verification Lab Step-by-Step { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Verify Before You Install: Sigstore Cosign Signing and Verification Lab Step-by-Step", "description": "Hands-on…
Field notes from automating hmmnm.com publishing: missed schedules, lying caches, design drift — and the rules each failure produced.
How DNSSEC signs the DNS: RRSIG, DS chains anchored at the root, NSEC3 trade-offs, and the KSK rollover landing October 11, 2026.
TL;DR: How BOLA and Broken Auth Attacks Work in One Paragraph BOLA and Broken Auth API Attacks with Burp Suite: Step-by-Step Lab BOLA lets you read or modify other users'…
Break Your Own API with DAST: OWASP ZAP Scans and Authenticated API Testing Lab Break Your Own API with DAST: OWASP ZAP Authenticated Testing Yes—you can break your own API…
How eBPF runs verified, JIT-compiled programs safely in the Linux kernel — and why networking and security tools bet their stacks on it.
How SSRF turns one forged request into cloud-wide credential theft — the Capital One chain, IMDSv2, and the controls that actually block it.
TL;DR: Yes, Anyone Can Decode Aircraft Datalink Traffic with ~$30 of Hardware Decode Live ACARS and VDL2 Traffic with acarsdec, dumpvdls2 and Wireshark ACARS and VDL2 are unencrypted, unauthenticated broadcast…
TL;DR: What You Need to Defend Against This Week Agentic AI systems are now a first-class attack surface, edge devices remain your most urgent patch priority, and infostealers are shifting…
How Certificate Transparency Merkle logs, SCTs and monitors make every TLS certificate publicly auditable — and how they caught Symantec in 2015.
This week’s threat landscape converges on three fronts: attackers are abusing agentic AI systems through prompt injection and over-privileged tool access, infostealer log dumps are flooding criminal marketplaces with session…