Security for AWS, Azure, GCP, networks, containers, Kubernetes and delivery pipelines: architecture, configuration, observability and change control.
Under certain conditions, a low-privileged authenticated user could move from a package path to code execution. Analysis of affected versions, risk and response.
A User-role tenant could bypass validation of nested Metalink URLs, trigger SSRF and reach root command execution on a shared KVM compute host.
CVE-2026-66785, 66787, 66788, 67567 and 73137 let a tenant or spoke redirect traffic, inject resources or exfiltrate Kubernetes secrets.
A provider-cache symlink, expensive ZIP files and an older sensitive-value leak show why IaC directories and package sources are security inputs.
TAR path traversal enables arbitrary file writes while a DAA decompression bomb exhausts the analyser. We explain the fixes in Pandora 1.12.6.
The Net Check feature accepts Socket.io input and executes it as root. We explain the OT risk, the 3.50.1.19 update and effective segmentation.
A legacy gcp auth-provider cmd-path bypassed the existing exec check. A malicious Kubernetes configuration could launch a process on a shared worker.
A 35-CVE wave covers command injection, cross-tenant access and authorization flaws. Here is the scope, the 0.29.13 fixes and a safe response plan.
A use-after-free in the KVM/x86 shadow MMU broke isolation under nested virtualisation. We explain recursive page zapping, prerequisites and mitigations.
A 22-year-old IPMI 2.0 weakness still exposes the server management plane. We explain RAKP, offline cracking and secure BMC isolation.
Forescout disclosed hardcoded keys, weak certificate validation and a device-adoption race in Omada zero-touch provisioning. Here is the risk and response plan.
SAST, DAST or IAST? Compare coverage, SDLC timing, strengths, limitations, false positives and a practical AppSec rollout without alert overload.
Apple is moving selected PCC workloads to confidential computing on Google Cloud. We examine attestation, administrator access and trust boundaries.
Secure container images from Dockerfile and CI through signing, registries and runtime. Use this practical checklist for dependencies and deployment.
BGP does not have built-in authentication, so routes can be hijacked and traffic redirected. We explain hijacking, route leaks and RPKI, ROA and ROV validation.
Security at the end of the process is expensive and long overdue. We show you how to incorporate SAST, SCA, secret scanning, and pipeline auditing into your CI/CD pipeline - without killing your team.
Microsoft 365 is the heart of most companies — and the top target of account attacks. Ten configurations that close common takeover paths.
Kubernetes gives huge flexibility and an equally large attack surface. We cover the most common mistakes — RBAC, secrets, networking — and hardening priorities.
Most cloud breaches don't come from the provider's flaws, but from the customer's misconfiguration. Here are the five most common traps.
The 'hard shell, soft centre' model no longer works. We explain what Zero Trust is, where to start a rollout and what to avoid.
Replace static CI/CD cloud keys with OIDC, restrict trust by audience, subject and environment, and test AWS, Azure and Google Cloud federation.
Secure Terraform from module to apply: provider supply chain, state and plan data, CI identity, policy as code, drift, detection and testing.
A technical container-escape model without exploit payloads: namespaces, capabilities, seccomp, AppArmor, OCI runtime, detection and hardening.
Audit Kubernetes RBAC safely: bind, escalate, impersonate, ServiceAccounts, pod subresources, audit detection, admission and hardening.
Test AWS IAM privilege escalation safely: policy evaluation, PassRole, trust policies, CloudTrail detection, least privilege and remediation.
A technical SSRF testing methodology for webhooks, URL parsers, DNS rebinding, redirects, AWS IMDSv2, Azure and GCP metadata, and egress hardening.
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
