What the unpatched AhsayCBS zero-day changed about what my homelab exposes
An unpatched backup console RCE, and the reachability audit it triggered across my homelab.
Hi, I’m Caleb
Information Security Analyst | Safeguarding Higher EducationCySa+, PenTest+, Security+, Network+, A+, ISC2 CC, SSCP, ITIL
Recent Posts
What moving the blog pipeline onto Hermes Bot profiles changed about how a post gets written and reviewed
I run the blog pipeline as separate Hermes Bot profiles. The split changed how a post gets written and reviewed.
What I check when a firewall rule stands in for the PeopleSoft patch
The PeopleSoft patch is the fix. The bypass changed how I verify a mitigation.
What I assess and relay when CVE-2026-88779 lands on the SAML identity path
A NetScaler SAML overflow hit the KEV catalog. How I triage the precondition before relaying it.
The agent that narrated its own breach: what the DIVD signatures change about how I hunt on my endpoints
An AI agent narrated its breach in code comments. What that changes about my endpoint hunting.
Zammad's chained zero-day is on CISA's KEV catalog: what I checked on my swarm when the LPE hits an app I do not run
A chained Zammad zero-day, exploited in the wild and now on the KEV catalog. What I checked.
Docker's CopyEscape: a docker cp destination escape and what I checked on my swarm
docker cp could write files outside the destination you pick and take over the host.
CISA gives FortiMail three days to remediate: what I relay while the fix is outstanding
Unauthenticated file write on a mail gateway, a three-day KEV clock, and the workaround that holds.
How my homelab keeps the llama stack current and measured
A self-updating llama stack with four daily source builds, a release smoke-test gate, and measured decode numbers.
What the Akira MFA bypass campaign on SonicWall SSL VPNs says about OTP MFA at the edge of a higher-ed network
Akira actors logged in to OTP-protected VPNs because the seed itself had already been stolen.