What the unpatched AhsayCBS zero-day changed about what my homelab exposes
An unpatched backup console RCE, and the reachability audit it triggered across my homelab.
Posts
What moving the blog pipeline onto Hermes Bot profiles changed about how a post gets written and reviewed
I run the blog pipeline as separate Hermes Bot profiles. The split changed how a post gets written and reviewed.
What I check when a firewall rule stands in for the PeopleSoft patch
The PeopleSoft patch is the fix. The bypass changed how I verify a mitigation.
What I assess and relay when CVE-2026-88779 lands on the SAML identity path
A NetScaler SAML overflow hit the KEV catalog. How I triage the precondition before relaying it.
The agent that narrated its own breach: what the DIVD signatures change about how I hunt on my endpoints
An AI agent narrated its breach in code comments. What that changes about my endpoint hunting.
CISA gives FortiMail three days to remediate: what I relay while the fix is outstanding
Unauthenticated file write on a mail gateway, a three-day KEV clock, and the workaround that holds.
Docker's CopyEscape: a docker cp destination escape and what I checked on my swarm
docker cp could write files outside the destination you pick and take over the host.
Zammad's chained zero-day is on CISA's KEV catalog: what I checked on my swarm when the LPE hits an app I do not run
A chained Zammad zero-day, exploited in the wild and now on the KEV catalog. What I checked.
How my homelab keeps the llama stack current and measured
A self-updating llama stack with four daily source builds, a release smoke-test gate, and measured decode numbers.
Fake sexual misconduct and Title IX emails are pushing Zoho Assist onto university staff: breaking down the Google Drive lure and how to spot abused legitimate remote access tools before they install
Fake Title IX emails push an abused Zoho Assist RAT at university staff through a Google Drive lure.