Long-form investigations, method notes, tooling analysis, reproducible experiments, deep dives, and security research writeups.
vulnerabilities
Hook The fix ships in a routine release. The CVE arrives weeks later. The release notes say nothing. Most operators never update. The problem is the gap between the code and the public signal. A vendor can fix a vulnerability in February and not name it until May. In the
research
A clean job log does not prove the data is recoverable. A field guide to backup verification: what S3 Object Lock actually protects, why delete markers break restores even when retention locks hold intact, and how to build a restore drill that catches the failures your cron job never reports.
research
Six runtime families, one pattern: the same five architectural flaws across Ollama, llama.cpp, vLLM, NVIDIA Triton, MLflow, and MCP — an evergreen operator deep-dive of the 2026 CVE wave, with per-flaw detection commands and a durable 12-item checklist.
self-hosting
Five agencies published a joint PLC advisory. Its reconnaissance playbook works against a homelab with a public IP just as well as a PLC rack. A first-person external audit of the Malwlab surface: enumeration checklist, before/after delta, and controls left behind to catch anyone scanning back.
cve
A deep-dive on CVE-2026-53359 Januscape: KVM x86 shadow MMU use-after-free enabling guest-to-host escape when nested virtualization is exposed. Includes Proxmox impact, attack chain, and hardening steps for homelab and enterprise operators.
research
Hands-on checklist for homelab operators: detect, fingerprint, and harden exposed MCP endpoints running on Ollama, Claude Code agents, or custom self-hosted AI services. Based on Trend Micro research documenting ~1,500 unauthenticated servers in 2026.
research
GhostLock is a Linux kernel use-after-free in futex priority inheritance. Patch and verification guidance for operators running containers, virtual machines, and CI jobs.
self-hosting
A data-driven analysis of 30 days of reverse proxy traffic reveals 1.16 million malicious requests — about one attack every 22 seconds. Here's what attackers actually want and how to defend against each family on a homelab budget.
Malware Analysis
Executive Summary: Operation Cronos Failed to Kill It Operation Cronos was supposed to end LockBit. In February 2024, the FBI, UK's NCA, Europol, and agencies from eight other countries took down the group's infrastructure, seized its source code, arrested its ringleader Dmitry Khoroshev's alleged