UEFI Secure Boot and BlackLotus: The Boot Chain of Trust Under Attack
How UEFI Secure Boot anchors trust in firmware, how BlackLotus bypassed it via CVE-2022-21894, and why revocation took years to roll out.
Weekly Threat Intel: Edge CVEs, MCP Agent Abuse, Stealer Cashouts
Edge CVEs under active exploitation, AI-agent abuse patterns, and infostealer cash-out trails — the week’s threat picture and what defenders should do about each.
Dependency Confusion Lab: Reproduce and Defend Your Pipeline
Build a CTF-style lab that reproduces dependency confusion and namespace squatting — then lock them down with scoped registries, lockfile pinning and reproducible builds.
Cosign Signing and Verification Lab: Sign, Verify, Enforce
Sign and verify artifacts step-by-step with Sigstore Cosign: keyless signing, transparency log entries, and admission-time verification in a hands-on lab.
Kerberos Attack Paths: Golden Tickets, Silver Tickets and Kerberoasting
Golden Ticket, Silver Ticket and Kerberoasting explained: what each forgery needs, what it bypasses, and the log signals that catch them.
DNSSEC Explained: Chain of Trust, NSEC3 and the October 2026 Root Rollover
How DNSSEC signs the DNS: RRSIG, DS chains anchored at the root, NSEC3 trade-offs, and the KSK rollover landing October 11, 2026.
BOLA and Broken Auth API Attacks with Burp Suite: Lab Guide
Hijack your own lab: find and exploit BOLA and broken-auth flaws in a vulnerable API using Burp Suite — then learn the authorization checks that actually fix them.
OWASP ZAP DAST Lab: Authenticated API Scanning Explained
Break your own API with OWASP ZAP: active scanning, authenticated scan contexts and API definitions in a step-by-step DAST lab you can rebuild for any target.
SSRF to Cloud Metadata: The Attack Behind Capital One and How to Stop It
How SSRF turns one forged request into cloud-wide credential theft — the Capital One chain, IMDSv2, and the controls that actually block it.
Decode ACARS and VDL2 with acarsdec and dumpvdls2: SDR Lab
Decode live aircraft ACARS and VDL2 datalink traffic with about $30 of SDR hardware, acarsdec, dumpvdls2 and Wireshark — a complete hands-on radio lab.
Weekly Threat Intel: Agentic AI Abuse and Edge CVEs
Agentic-AI abuse, the fall 2026 Edge CVE wave and infostealer tradecraft — this week’s defensive priorities in one briefing.
Certificate Transparency: How Merkle Logs Ended Blind Trust in CAs
How Certificate Transparency Merkle logs, SCTs and monitors make every TLS certificate publicly auditable — and how they caught Symantec in 2015.