Build a safe, vulnerable minikube lab and practice real container escape techniques step by step: privileged pods, hostPath mounts, service account abuse, and node privilege escalation — with verified commands and blue-team detection tips.
The JWT vulnerability class explained: alg=none, RS256/HS256 key confusion, jwk and kid injection — and the RFC 8725 defenses.
Supply-chain compromise of a maintained npm package, active exploitation of autumn KEV CVEs, and infostealer delivery trends — the week’s threat picture and what defenders should do about each.
How UEFI Secure Boot anchors trust in firmware, how BlackLotus bypassed it via CVE-2022-21894, and why revocation took years to roll out.
Edge CVEs under active exploitation, AI-agent abuse patterns, and infostealer cash-out trails — the week’s threat picture and what defenders should do about each.
How QUIC rebuilt web transport on UDP: per-stream delivery, 1-RTT handshakes with TLS 1.3 inside, connection migration — and the real costs.
Build a CTF-style lab that reproduces dependency confusion and namespace squatting — then lock them down with scoped registries, lockfile pinning and reproducible builds.
Sign and verify artifacts step-by-step with Sigstore Cosign: keyless signing, transparency log entries, and admission-time verification in a hands-on lab.
Golden Ticket, Silver Ticket and Kerberoasting explained: what each forgery needs, what it bypasses, and the log signals that catch them.
How DNSSEC signs the DNS: RRSIG, DS chains anchored at the root, NSEC3 trade-offs, and the KSK rollover landing October 11, 2026.
Hijack your own lab: find and exploit BOLA and broken-auth flaws in a vulnerable API using Burp Suite — then learn the authorization checks that actually fix them.
Break your own API with OWASP ZAP: active scanning, authenticated scan contexts and API definitions in a step-by-step DAST lab you can rebuild for any target.
New threat analyses, tool guides and hardening playbooks — delivered straight to your inbox, the moment they go live.