Cybersecurity
Vulnerabilities, exploits, cryptography and defensive engineering — written by people who patch real servers.
$ ls -t ~/cybersecurity
Eight eMudhra intermediate CA keys turned out to be recoverable from their own public certificates. Not stolen — computable, because the key generation produced almost no entropy. A researcher pulled all eight in under a second and signed a message with each one to prove it.
I could spot a nulled forum in about four seconds, and it never stopped being funny. Here's why the copyright line gives it away, what a measured 97% of nulled add-ons actually contain, and why MyBB quietly became the smart choice for everyone who wanted the look without the paper trail.
A Minecraft host has one port that must face the internet and a dozen that must not. The JVM flag that turns your server into a remote shell, the protocol that broadcasts its own password, the SSH default that is actually the problem, and the second computer inside every dedicated box.
A fake GTA 6 ISO used a believable installer error to cover remote-access malware, browser-data theft, and destructive file wiping. The “License not found” message wasn’t the crack failing. It was there so the victim would stop looking.
Four tools solve four different problems that all get pitched as the same problem. Here's what each one does, where each one breaks, and the combination that covers a real homelab without paying an SSO tax you didn't see coming.
A growing list of open-core self-hosted projects, from Grafana to Planka, gate single sign-on behind an Enterprise tier. Here's which protocol actually gets paywalled, and what to check before you deploy.
Forum Archaeology #2. Three free PHP forum platforms started from the same premise a generation ago. One got hit with a CVSS 9.8 authentication bypass this June. One had eleven CVEs last year. One has stayed almost quiet. Same premise, three completely different fates.
A logic bug in screensharingd let attackers skip authentication entirely and land as root — no password required. Here's how it was found, patched, reverse-engineered, and finally weaponized.
Part 1 ended on a 70-gigabyte breach in 2021. Since then, hacktivists derailed trains, dumped molten steel on camera, and reached grids in three countries.
Cloudflare open-sourced its internal AI workspace. A technical breakdown of Dynamic Workers, Gatekeepers, capability-based access, and what it takes to self-host it.
There's a specific kind of silence that happens right after you realize an AI agent just deleted everything you own. Not the polite "let me
Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.
$ ssh community@sudosecurity
Ask in the forums, share a snippet, or work through a course on Learn.
