Threat briefs, exploit breakdowns and lab write-ups. New posts land here first, then on LinkedIn.
Topic 21 of the AI track: six posts of breaking things, and not one of the fixes was new. Output encoding, prepared statements, argv execution, a CSP header and least privilege all predate LLMs by decades. The five layers, what each one actually stops, and an honest word about why sandboxing is the control teams reach for first and the one that changes least.
Topic 20 of the AI track, a short reference: hallucination gets filed under accuracy, but a wrong answer that repeats is a package name an attacker can register first. The measured rates by model, why repeatability matters more than the rate, and the six checks before you install anything a model named.
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE in PaperCut NG and MF, exploited as a zero-day. Why the auth check ran, passed, and still missed.
Topic 19 of the AI track: markdown is the safe subset only if you think danger means execution. An image tag is a silent outbound GET, and four access logs show my own password, a secret called strikebreaker and another user's discount code arriving at my server with nobody clicking anything.
Topic 18 of the AI track: a support bot listed its own admin function, refused to run it, then ran it once I claimed to be an administrator. Three separate bugs share the name function calling, and a harmless question about XSS proved the handler was piping the model straight into a Python interpreter.
Topic 17 of the AI track: I typed the same sentence twice and got two different shell commands, one safely quoted and one that ran id as user_2. A lab log on LLM command injection, why the classic payload list is useless here, and the one design change that ends it.
CVE-2026-59310 is a CVSS 9.8 path traversal in the VMware vCenter Syslog server, exploited five days after patch. How a log write became root code execution.
Topic 16 of the AI track: I read the admin table and got an INSERT out of a chatbot without writing a line of SQL. Text-to-SQL is an authorisation problem wearing injection's clothes, and the UNION payload only came out once someone bolted a filter onto the wrong string.
Topic 15 of the AI track: the model refused my XSS payload on safety grounds, and two prompts later the same page popped an alert box. Insecure output handling end to end, reflected and stored, plus the one-prompt bold-tag probe that decides whether any of it is worth chasing.
Topic 14 of the AI track: a folder of DAN prompts is not a test methodology. Jailbreak families sorted by which defence they actually break, and the measurement that turns a screenshot into a finding. The DAN text everyone copies is 7,070 characters; the sentence completion that beat a system prompt was 131.
Topic 13 of the AI track, a short reference: six channels that carry the same prompt injection payload, from an HTML comment to a row in a CSV export to an email body. Plus the thing I found by accident, where a quoted-printable line break split the payload and grep on the raw message returned zero matches.
CVE-2026-72898 is a CVSS 10.0 unauthenticated SQL injection in Metabase's password reset. How an undeclared JSON key reached HoneySQL, and how to fix it.
Topic 12 of the AI track: I fired eight prompt-leak payloads at the two filters everyone ships. The input blocklist stopped 1 of 8, output redaction stopped 5, and running both together stopped nothing extra. A base64 transform, an acrostic poem and "give me the first five characters" beat every configuration.
Topic 11 of the AI track: I attacked my own AI support bot from four directions. The model's guardrail blocked a direct jailbreak, then obeyed the same instruction hidden in a retrieved document. The app leaked a session cookie and one request tied the service up for 20 seconds.
Topic 10 of the AI track: I poisoned 3.29% of a spam filter's training data and planted a trigger phrase that switches the filter off on demand. Accuracy stayed at 94.12% before and after, and my canary tests passed 5 of 5 on the backdoored model.
The finale of my Kubernetes journey: all 42 topics in one bookmarkable field guide, mapped by the attacker's path and by defence, from RBAC to runtime, with the 90-note pentest playbook. The one page to save before I turn to AI and LLM security.
Topic 41 of my Kubernetes journey: a read-only root filesystem is worth setting, but it's sold as something bigger than it is. What readOnlyRootFilesystem actually stops, what it misses (a shell, memory, privileged), and why PodSecurityPolicy is the wrong way to enforce it now.
Topic 40 of my Kubernetes journey: a short Falco reference. The two drivers, the file paths, the five required rule keys and the output channels, plus the three install steps that stopped being true since the 0.28 era guides everyone still copies.
Topic 39 of my Kubernetes journey: a stock cluster will pull an image from any registry on the internet, and the built-in ImagePolicyWebhook fails open. Private registries and imagePullSecrets, three ways to allowlist trusted registries, and the defaultAllow trap.
Topic 38 of my Kubernetes journey: KubeLinter found five problems in a Deployment that applied without a complaint, then the fixes it wanted stopped nginx from starting. Static analysis for your YAML, the security context trap, and wiring the linter into CI.
Topic 37 of my Kubernetes journey: swapping one base image took my Trivy count from 124 findings to zero, and nothing was patched. Minimal and distroless bases, multi-stage builds, SBOMs with Syft and Grype, and the CI step that went green while producing no artefact at all.
Topic 36 of my Kubernetes journey: a quota is a ceiling, not a referee. API Priority and Fairness, Pod Priority and Preemption, and the QoS class that quietly makes a "no resources block" pod first to die, plus the DNS default that leaks across namespaces.
Topic 35 of my Kubernetes journey: isolation isn't one control, it's a stack. Control plane vs data plane, and the two layers most clusters leave half-built, storage and node isolation, including the taint-without-nodeSelector trap that scatters "dedicated" pods across shared nodes.
Topic 34 of my Kubernetes journey: a namespace is a label, not a wall. What actually keeps tenants apart on a shared cluster (RBAC, quotas, network policy), and the honest line where soft isolation for trusted teams stops being enough for hostile customers.
Topic 33 of my Kubernetes journey: one-way TLS proves the server and asks you for a password, mutual TLS makes both sides show a certificate first. A ten-minute openssl and curl lab where the server refuses a client with no cert, plus where mTLS already runs in your cluster.
Topic 32 of my Kubernetes journey: kill a container's process from the host to see why the shared kernel matters, then what gVisor and Kata Containers actually change, and how RuntimeClass lets you sandbox one pod without paying for all of them.
Topic 31 of my Kubernetes journey: read a Secret straight out of etcd with etcdctl, then turn on encryption at rest step by step, and see why anyone who can create a pod can read every Secret in the namespace. With a decoder you can try in the browser.
Topic 30 of my Kubernetes journey: pulling the yes/no out of application code with Open Policy Agent, unit-testing Rego with opa test, then letting Gatekeeper enforce the same idea at the Kubernetes API, plus the five gotchas that cost me an evening.
Topic 9 of the AI track: turning malware bytes into greyscale images, training a small CNN from scratch with no PyTorch or pretrained ResNet50 in reach, 95.65% weighted accuracy, and the 40-image family it kept confusing for another.
Topic 8 of the AI track: training a Random Forest on NSL-KDD-style traffic, 99.7% weighted accuracy, a confusion matrix that found the class it was quietly missing, and why the rarest attack is always the hardest one.
Topic 7 of the AI track: Bayes' theorem in plain words, a spam filter built from scratch in thirty lines, the underflow bug everyone hits, and the one false positive worth more than the score.
Topic 6 of the AI track: cleaning 2,000 rows of deliberately broken network logs with pandas, encoding and splitting them, training a threat classifier, and why 86.6% accuracy meant zero attacks caught.
Topic 29 of my Kubernetes journey: Pod Security Policies, the admission control removed in 1.25, the RBAC trap that broke clusters, and the three-profile system that replaced it.
PodSecurity can't tell you which registry an image came from. I built a validating webhook that can, plus a mutating one that patches in a missing seccomp profile. Real Flask code, real TLS gotcha.
RBAC checks if you can create a pod. It never opens the pod spec. Admission controllers do, and can mutate or reject the object before it ever reaches etcd. Hands-on lab.
Seccomp filters syscalls but can't say which files a container touches or scope its root powers. AppArmor confines paths; Linux capabilities slice up root. Hands-on.
Docker filters dangerous syscalls out of the box. Kubernetes ships pods Unconfined. How seccomp works, why it's off by default, and turning it on with one line, then tightening it.
Before you can restrict a container's syscalls with seccomp, you have to see them. What a syscall is, why the shared kernel makes it a boundary, and tracing with strace and Tracee.
One idea, two locks: cloud IAM roles for who can do what, and a UFW host firewall for who can reach what. With a hands-on default-deny walkthrough.
A fresh node runs services you never chose, modules you'll never use, and ports you didn't mean to expose. How to audit and shut all three.
CISA says four chained on-prem SharePoint bugs, CVE-2026-58644 among them, are being used to steal IIS machine keys. The chain, the detection signals, and the fix.
Topic 5 of the AI track: how generative models create instead of classify, how transformers and self-attention power LLMs, and how diffusion sculpts images from noise.
Topic 4 of the AI track: what a neuron really is, why hidden layers matter, and how backprop trains a network. With thirty lines of numpy you can actually run.
sudo -l is the first thing I run on a box in a lab, because one lazy sudoers line is often the whole privilege escalation. How sudo works, and how to audit it.
SSH is the front door to every node, and default SSH leaves it on the latch. Keys instead of passwords, no root, no password login, in a hands-on lab you can copy.
I once bound a pod to cluster-admin just to make it work. Least privilege is the habit that stops that: trim ports, services, modules and RBAC, with a hands-on lab.
Part 3 of my AI track: how an agent learns by trial and error, the Q-table and Bellman update, epsilon-greedy, and why Q-learning and SARSA split on one word.
On a default cluster, nobody can say who deleted that deployment. Audit logging gives the cluster a memory: the four policy levels, a kind lab, and what to alert on.
Your node objects quietly leak kubelet and kernel versions, internal IPs and taints. Why that's a gift to attackers, and how to shut it with least-privilege RBAC.
The daemon runs as root, so an exposed 2375 is instant host takeover. Ports 2375 vs 2376, and locking it down with TLS and client certs.
One clean URL and one cert for many services, instead of a load balancer per app. Path vs host routing, the controller-vs-resource split, and a curl lab.
Pods talk to everything by default. How to fence that in with network policies: ingress, egress, selectors, and the AND/OR gotcha.
The five classic ML algorithms, linear and logistic regression, decision trees, Naive Bayes and SVMs, explained simply, nothing skipped.
Two habits that keep a cluster trustworthy: verify a binary's SHA-512 before you run it, then upgrade with kubeadm without dropping traffic.
Three CVEs being hit right now and added to CISA KEV: a SharePoint RCE, a perfect-10 ColdFusion file-write, and a Langflow auth bypass.
One bug, a hundred outfits. What injection really is, and the overlooked flavours people forget to guard: XPath, LDAP and HTML-to-PDF.
Topic 1 of the AI track: what AI, ML and deep learning actually are, how they nest, and a tiny model you can train in eight lines.
Two clean, authenticated ways to reach the API and internal ClusterIP services from your laptop, hands-on with a 5-minute kind lab.
On a lot of clusters you can list a node's pods with no login, and from there run commands inside them. Here's how to shut that door.
Why a namespaced Role can't touch a node, how ClusterRoles fix it, and the binding trick that decides the real blast radius.
The second door every request hits: the authorization modes, how the API server chains them, and a hands-on RBAC walkthrough.
The file that becomes you if it's stolen, and the map of how the Kubernetes API is grouped, resourced and verbed.
A hand-rolled SAML parser forgets that a newline ends an attribute, and NetScaler bleeds memory to anyone, no login required.
How TLS and PKI really work, which certificate every cluster component carries, and how to create, sign and audit them with OpenSSL.
How the API server decides who you are, why static credential files are a trap, and how service account tokens changed in 1.22 and 1.24.
How to stop guessing whether a cluster is secure: CIS Benchmarks, CIS-CAT scoring, and checking your cluster with kube-bench.
The 4Cs model explained, then a real chain from an exposed Docker port to a container escape and a rigged poll database.
Back after a break with Topic 3 — shifting focus to the DevOps side of Kubernetes and the groundwork real security testing depends on.
Before diving into security concerns, it's important to understand how Kubernetes actually works from a developer's point of view.
Starting from zero — what Kubernetes is, why it matters, and the first steps into K8s and its security model.
Inside