Recent Posts
Pwn2Own 2025: When Security Researchers Break Everything (And Why That's Good)
TL;DR Three Pwn2Own competitions in 2025 (Tokyo, Berlin, Cork) resulted in 150 zero-day vulnerability disclosures across automotive, enterprise, and consumer IoT systems, with $2,989,750 awarded to researchers.
Key findings:
Memory corruption (45%): 68 instances of buffer overflows (CWE-787, CWE-121/122), use-after-free (CWE-416), integer overflows (CWE-190), and type confusion (CWE-843) Injection attacks (30%): 45 instances of command injection (CWE-78) and format string vulnerabilities (CWE-134) Authentication failures (13%): 20 instances including hard-coded credentials (CWE-798), missing authentication (CWE-306), and authentication bypasses (CWE-287) Notable exploits:
read more
Why Your Cloud Security Is Probably Broken (And How Keylime Fixes It)
Hot take: Most “secure” cloud deployments are just expensive theater. You’ve got firewalls, access controls, endpoint protection - but what if someone compromises your bootloader before any of that even starts?
This isn’t theoretical. Real attackers are targeting the boot process, hypervisors, and kernel-level compromises that happen before your security stack loads. Your fancy SIEM won’t help if the system reporting to it has been compromised from day one.
The Trust Problem No One Talks About Here’s what keeps me up at night: How do you trust a system you can’t physically touch?
read more
SPIFFE: Secure Production Identity Framework for Everyone
If you’re running microservices in production, you’ve probably hit this wall: how do services actually authenticate to each other?
The old approach of “throw everything behind a firewall and call it secure” doesn’t work when your services are scattered across multiple clouds, spinning up and down constantly, and talking to each other over networks you don’t fully control.
Most teams end up with some combination of:
API keys stuffed into environment variables Certificates that someone manually rotates (when they remember) Service accounts with way too many permissions That one shared secret that’s been in the codebase since 2019 SPIFFE is designed to solve this mess.
read more