News
Current reporting, reactions, and incidents with actual operator value.
Intro
Operator writing for noisy security days.
If the internet insists on turning every bug, breach, and dashboard into a dramatic monologue, this site is here to be less theatrical and more useful.
News is for the stories that matter now. Articles are for ideas worth keeping. Tracks are for learning the machinery in the right order, instead of collecting half-understood fragments like rare trading cards for people with terminal tabs.
Read By Lane
Articles
Longer essays, technical judgment, and pieces meant to age decently.
Tracks
Stepwise lessons in networking, virtualization, systems, and security craft.
News
Cisco SD-WAN KEV update is a control-plane warning
CISA's April 20, 2026 KEV update matters because it pulls another Cisco Catalyst SD-WAN Manager flaw into the exploited bucket, turning what might look like a narrow information disclosure bug into a control-plane hunting problem.
News
SGLang RCE makes model files part of the attack surface
CVE-2026-5760 matters because it turns an AI model artifact into a server-side code execution path, which means inference teams need model provenance, template sandboxing, and runtime containment before the next charmingly named model shows up in production.
News
SharePoint zero-days do not care that the bug says spoofing
CVE-2026-32201 matters because a medium-rated SharePoint spoofing flaw still shipped with exploitation already detected, which is a reminder that trusted internal portals can become attack infrastructure long before anyone gets around to arguing about the CVSS.
News
nginx-ui turns MCP into a reverse-proxy takeover
CVE-2026-33032 matters because it did not break nginx with exotic memory corruption; it let attackers drive a production reverse proxy through an unauthenticated MCP message endpoint, which is a much more practical way to ruin someone’s week.
News
W3LL was never just a phishing kit
The April 13, 2026 takedown of W3LL matters because the real target was not one fake-login toolkit but an access market that packaged AiTM phishing, session theft, and account resale into something cheap enough for ordinary fraud crews to operate at scale.
News
SharePoint turns spoofing into an internal trust incident
Microsoft’s April 14, 2026 fix for CVE-2026-32201 matters because an exploited SharePoint 'spoofing' bug is not a cosmetic problem inside a trusted collaboration platform; it is a way to poison internal content, workflows, and decisions at network speed.
News
Iran does not need a zero-day if your PLC is on the internet
The April 7, 2026 PLC advisory matters because the attack path was not exotic OT malware but internet-exposed controllers reachable through legitimate engineering tooling, which turns a public IP on a PLC into a direct operational risk.
News
APT28 turns SOHO routers into a cloud identity problem
The April 7, 2026 APT28 router disclosures matter because they show how an unmaintained edge device in a home or branch office can quietly become the upstream control point for Microsoft 365 credential theft and adversary-in-the-middle collection.
News
Adobe Reader turns a PDF into endpoint selection logic
CVE-2026-34621 matters because the malicious PDF was not just a document-borne exploit but a selective access mechanism that fingerprinted endpoints, stole local data, and kept the expensive follow-on stage for machines the attacker actually cared about.
News
Marimo makes advisory publication an initial-access event
Marimo's April 8, 2026 pre-auth terminal bug matters because attackers did not wait for a public exploit kit, a KEV entry, or even a settled CVE record. The advisory itself was enough to turn exposed notebook instances into initial access within 9 hours and 41 minutes.
News
FortiClient EMS turns endpoint management into a tier-zero incident
CVE-2026-35616 matters because a pre-auth compromise of FortiClient EMS is not just a server bug but a live path into the security control plane that governs endpoint policy, VPN access, and compliance state across the fleet.
News
Axios turns npm install into endpoint triage
The Axios compromise matters because installing the malicious releases was not a dependency hygiene issue but a host-compromise event that could land a cross-platform RAT on developer laptops and CI runners before anyone noticed the application still worked.
News
Citrix NetScaler turns memory disclosure into an identity problem
CVE-2026-3055 matters because it shows, again, that a memory-disclosure bug on an internet-facing identity appliance is not a minor information leak but a practical route to session theft and control-plane compromise.
News
F5 BIG-IP shows how stale triage becomes live exposure
The F5 BIG-IP APM story matters because it is a clean example of how an old vulnerability ticket can quietly become an actively exploited internet-facing RCE while defenders are still trusting the first label it was given.
News
TrueConf turns trusted updates into a malware switchboard
The TrueConf CVE-2026-3502 story matters because it turns compromise of one on-prem collaboration server into a trusted code-delivery path for every connected client, which is a much bigger operational problem than the CVSS line item suggests.
News
Mercor makes LiteLLM an incident, not a warning
Mercor's March 31 and April 1, 2026 disclosures matter because they confirm what defenders should have assumed on March 24: the LiteLLM PyPI compromise was not a tidy open-source hygiene problem. It was an incident path into real environments.
News
NetScaler memory leaks are identity-edge emergencies
Citrix's March 2026 NetScaler disclosure matters because CVE-2026-3055 is not just another appliance bug. It is a memory leak on the authentication edge, and that turns patching into incident response very quickly.
News
DarkSword turns iPhone exploitation into reusable infrastructure
Google's March 18, 2026 DarkSword research matters because the real story is not one more iPhone exploit chain, but the fact that multiple actors are reusing the same full-device compromise pipeline across countries and missions.
News
KEV does not care which stack you prefer
CISA's March 20, 2026 KEV additions matter because they cut across Apple endpoints, Craft CMS sites, and Laravel Livewire apps, which is a polite federal way of saying attackers do not care how your org chart labels the problem.
News
Cisco FMC is a management-plane emergency
Cisco's March 2026 FMC emergency matters because the vulnerable target is the control plane for other security controls, and that changes how fast sane teams should move.
News
Wing FTP is a reminder that exploited beats severe
The interesting security lesson in the recent Wing FTP coverage is not the product itself. It is the reminder that active exploitation and exposure path matter more than a comforting severity label.
News
Secret scanning gets more specific, and that is good news
GitHub added new partner and generic secret-scanning patterns in March 2026, which sounds small until you remember how much modern incident response still begins with somebody leaking a credential into plain sight.
News
Iran-linked campaigns are still a systems problem
Palo Alto Networks' March 2, 2026 threat brief on Iran-linked activity is a useful reminder that headline attribution matters less than the old, stubborn system weaknesses the operators keep reusing.
News
The 2026 IR report says the quiet part out loud
Palo Alto Networks' 2026 incident response report says attacks are faster, more creative, and more focused on data theft, which is a polite way of saying defenders do not get to warm up anymore.
News
Mobile fleets are infrastructure too
Apple's February 11, 2026 iOS 26.3 and iPadOS 26.3 security release is a reminder that phones are not lifestyle accessories in enterprise environments. They are infrastructure with payroll access and MFA tokens.
News
FortiCloud SSO auth bypass is a trust-boundary story
Fortinet's January 27, 2026 advisory for a critical FortiCloud SSO authentication bypass is another reminder that internet-facing trust boundaries age badly when nobody revisits the assumptions underneath them.
Article
Authority should travel as a capability, not hang in the air
Authorization gets safer when systems stop relying on ambient permission checks and instead pass explicit, narrow capabilities that describe exactly what an operation is allowed to do.
Read articleArticle
Idempotence is a security property, not just an API nicety
Idempotence matters because systems under stress retry, replay, and repeat work, and a design that produces the same safe result for the same intent is harder to break by accident, abuse, or panic.
Read articleArticle
Rollback is a security control, not just an ops courtesy
Rollback is one of the few controls that reduces the blast radius of both mistakes and attacks, because a system that can back out change cleanly is a system that can recover before small failures become large ones.
Read articleArticle
Every fallback is a trust decision
Fallback paths are where systems reveal what they really trust, which makes them both operationally useful and quietly dangerous.
Read articleArticle
Launching the blog
Why this site exists and how it becomes the canonical home for daily writing.
Read articleTracks
Knowledge lanes for building actual skill.
These are the long-running routes through the site, meant to compound over time.
Track
Algorithmic complexity is how work grows
Algorithmic complexity describes how a program's work grows as the input grows, giving us a practical way to compare approaches before production traffic turns small inefficiencies into expensive alarms.
Read trackTrack
Binary search is how order turns guessing into elimination
Binary search uses the promise of sorted data to compare against the middle item, discard half the remaining possibilities, and find answers without trudging through every value one by one.
Read trackTrack
Sorting is how programs turn comparisons into order
Sorting is the disciplined process of repeatedly comparing and moving values until scattered data becomes ordered data, which lets later algorithms search, merge, and reason with far less confusion.
Read trackTrack
Priority queues are how programs let urgency outrank arrival time
A priority queue stores pending work with an ordering rule stronger than arrival time, letting programs remove the most important item first without sorting the whole world every time they need the next decision.
Read trackTrack
Queues are how programs remember which work happens next
A queue stores pending work in first-in, first-out order, which lets programs process arrivals fairly, coordinate producers with consumers, and turn 'later' from a hand-wave into concrete state in memory.
Read track