Infrastructure-Hardening
Checked Is Not Used: Four Bugs in Two Weeks Where the Verified Thing Wasn't the Thing That Ran
APT, LXD, WordPress and SonicWall all shipped fixes this month for the same design error: a security check performed on one object or path, and an action taken on another. Here is how to find that gap in your own estate.
No Exploit Required: October 2026 Was Four Stolen-Credential Breaches in a Trench Coat
LiteLLM, Gheist, UpdraftCentral, and Railway had no common CVE, but one common root cause: long-lived, over-scoped credentials sitting where attackers could reach them. A trend analysis, and the controls that would have changed each outcome.
Your CI Runner Holds the Keys: A Field Guide to Hardening GitHub Actions After GhostAction, Megalodon, and TanStack
Three different attacks in 2026 reached the same place: a GitHub Actions runner with secrets and an OIDC token in scope. Here's the attacker's checklist and a concrete, ordered hardening plan, with config snippets and detections, for infra teams that own CI.
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
Two Parsers, One URL: The Interpretation-Conflict Bug Is Eating Authentication in 2026
Cisco SD-WAN, UniFi OS, Starlette and Clerk all fell to the same flaw this year: the component that decides who gets in and the component that decides where the request goes read the URL differently. Here is why it keeps happening and how to stop shipping it.
The Skeleton Key Problem: Why 2026's Worst RCEs All Trace Back to a String Literal
SolarWinds ARM, ManageEngine, ASUS Control Center, Cisco FMC, Dell SCG, and a Tenda router backdoor all failed the same way this year: a secret baked into shipped code instead of generated per install. CWE-798 isn't a legacy bug class — it's still how management planes get owned.
The ECC Excuse Is Dead: A Hardening Guide for Multi-Tenant GPU Infrastructure After GPUThor
For four months, 'enable ECC' was the official fix for GPU Rowhammer. GPUThor just showed that advice was wrong. Here's what to actually change on GPU fleets that run untrusted CUDA code from more than one tenant.
Your Backup Server Is a Domain-Admin Factory: The Kill Chain Ransomware Operators Have Automated
The backup server is the highest-privilege machine in most environments and the least-hardened. Ransomware operators have known this for years and built repeatable kill chains around it. This is how they work and what it takes to stop them.