News
Current reporting, reactions, and incidents with actual operator value.
Intro / Live feed
Operator writing for noisy security days.
If the internet insists on turning every bug, breach, and dashboard into a dramatic monologue, this site is here to be less theatrical and more useful.
News is for the stories that matter now. Articles are for ideas worth keeping. Tracks are for learning the machinery in the right order, instead of collecting half-understood fragments like rare trading cards for people with terminal tabs.
- 80
- Posts published
- 3
- Reading lanes
- Sep 6
- Latest dispatch
Read By Lane
Articles
Longer essays, technical judgment, and pieces meant to age decently.
Tracks
Stepwise lessons in networking, virtualization, systems, and security craft.
01 News
What is worth slowing down for right now.
Current reporting and incidents, read for operator value instead of headline drama.
Lead News
SonicWall's SMA1000 gets the same SSRF-to-RCE chain twice in two months
CVE-2026-83548 and CVE-2026-83549 pair an unauthenticated SSRF with a command-injection flaw to hand attackers root on SonicWall's SMA1000 VPN appliance — the same architecture that produced a ransomware-linked zero-day chain on the same product line seven weeks earlier.
Read the dispatchNews
Metabase turns a merge bug into unauthenticated admin access
CVE-2026-72898 shows how an undocumented JSON field, a permissive Clojure merge, and a query builder's literal-SQL escape hatch combined into unauthenticated database admin access — and why a BI tool's blast radius is every...
News
N-able N-central turns an incomplete patch into an MSP-wide compromise path
A second N-able N-central bypass shows why patching a single-server RMM vulnerability is never the whole job when the console has standing remote access into every client it manages.
News
Cisco Unified CM turns an unused feature into a root-shell emergency
CVE-2026-20230 shows how one optional, disabled-by-default feature in Cisco Unified Communications Manager became an unauthenticated path to root, and why CISA gave defenders only three days to close it.
News
Cisco SD-WAN KEV update is a control-plane warning
CISA's April 20, 2026 KEV update matters because it pulls another Cisco Catalyst SD-WAN Manager flaw into the exploited bucket, turning what might look like a narrow information disclosure bug into a control-plane hunting...
News
SGLang RCE makes model files part of the attack surface
CVE-2026-5760 matters because it turns an AI model artifact into a server-side code execution path, which means inference teams need model provenance, template sandboxing, and runtime containment before the next charmingly named model shows...
News
SharePoint zero-days do not care that the bug says spoofing
CVE-2026-32201 matters because a medium-rated SharePoint spoofing flaw still shipped with exploitation already detected, which is a reminder that trusted internal portals can become attack infrastructure long before anyone gets around to arguing about...
News
nginx-ui turns MCP into a reverse-proxy takeover
CVE-2026-33032 matters because it did not break nginx with exotic memory corruption; it let attackers drive a production reverse proxy through an unauthenticated MCP message endpoint, which is a much more practical way to...
News
W3LL was never just a phishing kit
The April 13, 2026 takedown of W3LL matters because the real target was not one fake-login toolkit but an access market that packaged AiTM phishing, session theft, and account resale into something cheap enough...
02 Articles
Ideas worth keeping after the week's headlines fade.
Longer essays and technical judgment, meant to age decently.
Article
Silence is not the same as success
Most systems treat the absence of an alert as proof that everything is fine, but nothing fired and everything is fine are different claims, and the gap between them is exactly where backups quietly...
Read articleArticle
Backpressure is a security control, not a performance knob
Backpressure — the discipline of refusing or slowing work a system cannot safely absorb — is usually filed under performance tuning, but the systems that skip it fail exactly the way attackers want them...
Read articleArticle
Blast radius is a design parameter, not a disaster measure
How far a breach travels is not determined during incident response — it is fixed months earlier by segmentation decisions, credential scope, and which services share trust, making blast radius a design constraint that...
Read articleArticle
Expiration is a security property, not a cleanup chore
Expiration bounds how long a leaked credential, cached permission, or stale grant remains useful, which makes time-to-live a security control in its own right rather than a background cleanup detail.
Read articleArticle
Authority should travel as a capability, not hang in the air
Authorization gets safer when systems stop relying on ambient permission checks and instead pass explicit, narrow capabilities that describe exactly what an operation is allowed to do.
Read articleArticle
Idempotence is a security property, not just an API nicety
Idempotence matters because systems under stress retry, replay, and repeat work, and a design that produces the same safe result for the same intent is harder to break by accident, abuse, or panic.
Read article03 Tracks
Knowledge lanes for building actual skill.
The long-running routes through the site, meant to compound over time.
Track
Dijkstra's algorithm is how programs find the cheapest path through a weighted graph
Dijkstra's algorithm answers the question breadth-first search can't: when edges have different costs, the shortest path by hop count and the cheapest path by total cost are not the same path, and finding the...
Read trackTrack
Graph traversal is how programs decide which node to visit next
Breadth-first and depth-first search are the two disciplined answers to the same question a graph always asks — which node do you visit next — and the answer you pick determines whether you find...
Read trackTrack
Greedy algorithms are how programs make the locally best choice without looking back
A greedy algorithm makes the locally optimal decision at each step and never revisits it, which produces elegant and efficient solutions when the greedy choice provably leads to a global optimum — and quietly...
Read trackTrack
Dynamic programming is how recursion stops paying for the same answer twice
Dynamic programming takes a recursive function that keeps re-solving the same subproblems and gives it a memory, turning exponential blowup into work that grows only as fast as the number of distinct subproblems.
Read trackTrack
Algorithmic complexity is how work grows
Algorithmic complexity describes how a program's work grows as the input grows, giving us a practical way to compare approaches before production traffic turns small inefficiencies into expensive alarms.
Read trackTrack
Binary search is how order turns guessing into elimination
Binary search uses the promise of sorted data to compare against the middle item, discard half the remaining possibilities, and find answers without trudging through every value one by one.
Read track