What the Akira MFA bypass campaign on SonicWall SSL VPNs says about OTP MFA at the edge of a higher-ed network
Akira actors logged in to OTP-protected VPNs because the seed itself had already been stolen.
Posts
Building a SOC from a green field
Standing up a first SOC from nothing and what the green field taught me.
What the exploited Cisco Secure Email Gateway zero-day teaches about log trust
A root zero-day in a mail appliance, exploited in the wild, and the log trust problem underneath it.
The record Patch Tuesday: research the criticals, relay the order
September 2026 brought a record 974 fixes and two exploited zero-days. With deployment automated, my patch day is research and handoff.
How BigBear 2.0 beat MFA at 258 organizations
BigBear 2.0 beat MFA at 258 organizations by stealing finished sessions. The technique and the fix.
Kali365 and the OAuth Device Code Phishing Wave
A Telegram-distributed phishing kit is bypassing MFA on Microsoft 365 with the OAuth device code flow. Here is how I detect and block it.
Running a Private Local LLM as the Engine Behind My Homelab Automations
How llama-swap and llama.cpp power my homelab automation behind one private OpenAI-compatible endpoint.
Writing with my AI co-pilot: how I run a security blog with Hermes, and why disclosure beats co-authorship
How I run this security blog with a local AI co-pilot, and why disclosure beats co-authorship.
CompTIA SecurityX (CAS-005) - The Architectural Command Layer: Architecting Advanced Cybersecurity Leadership
The advanced security architecture, operations, and governance layers that define enterprise resilience.
CompTIA PenTest+ - The Adversarial Testing Layer: Architecting Offensive Validation
The reconnaissance, exploitation, and reporting layers of professional penetration testing.