Hardened Bastion on Debian 13: Extreme Hardening with KSPP, Seccomp-BPF and SIEM Telemetry
Most Linux distributions follow a default-permit model: everything is allowed until the administrator restricts it. This post inverts that m
Cybersecurity (99 articles)
DirtyDecrypt (CVE-2026-31635): Linux privilege escalation via rxgk pagecache write
"What is DirtyDecrypt? DirtyDecrypt (also known as DirtyCBC) is a local privilege escalation vulnerability in the Linux kernel that allows a
CVE-2026-7270: local privilege escalation on FreeBSD via exec_args_adjust_args
"CVE-2026-7270 is a local privilege escalation vulnerability in the FreeBSD kernel that allows an unprivileged user to gain root on systems
Nginx Rift (CVE-2026-42945): RCE via heap overflow in ngx_http_rewrite_module
What is Nginx Rift (CVE-2026-42945)
Fragnesia (CVE-2026-46300): LPE on Linux via ESP-in-TCP and page cache
What is Fragnesia (CVE-2026-46300)
CVE-2026-46333 ssh-keysign-pwn: Unprivileged SSH and /etc/shadow key theft
What is ssh-keysign-pwn (CVE-2026-46333)
CVE-2026-43284 + CVE-2026-43500 Dirty Frag: privilege escalation via page cache on Linux
What is Dirty Frag (CVE-2026-43284 + CVE-2026-43500)
CVE-2026-31431 Copy Fail: Privilege escalation in Linux since 2017
What is Copy Fail (CVE-2026-31431)
Lab PoC: SSH Reverse Tunnel over Tor (APT SandWorm technique)
Context: what SandWorm does with SSH and Tor
OpenCode Security Agent: Runtime Protection for AI Agents
The problem: AI agents with full access to your system
DevSecOps with OpenSpec: Security Integration in Spec-Driven Development
Context: from specs to enforcement