Long-form investigations, method notes, tooling analysis, reproducible experiments, deep dives, and security research writeups.
cve
A deep-dive on CVE-2026-53359 Januscape: KVM x86 shadow MMU use-after-free enabling guest-to-host escape when nested virtualization is exposed. Includes Proxmox impact, attack chain, and hardening steps for homelab and enterprise operators.
research
Hands-on checklist for homelab operators: detect, fingerprint, and harden exposed MCP endpoints running on Ollama, Claude Code agents, or custom self-hosted AI services. Based on Trend Micro research documenting ~1,500 unauthenticated servers in 2026.
research
GhostLock is a 15-year-old use-after-free in the Linux kernel's priority-inheritance futex path that enables container escape from zero capabilities. Technical breakdown of the exploit chain plus patching guidance for Proxmox, Docker, Kubernetes, and CI runner operators.
AI/LLM Generated
A data-driven analysis of 30 days of reverse proxy traffic reveals 1.16 million malicious requests — about one attack every 22 seconds. Here's what attackers actually want and how to defend against each family on a homelab budget.
Malware Analysis
Executive Summary: Operation Cronos Failed to Kill It Operation Cronos was supposed to end LockBit. In February 2024, the FBI, UK's NCA, Europol, and agencies from eight other countries took down the group's infrastructure, seized its source code, arrested its ringleader Dmitry Khoroshev's alleged