Indra G. PrasetyaGenerate an SBOM with Syft, Filter Grype with VEX
Generate a CycloneDX SBOM with Syft, scan it with Grype, and suppress non-exploitable CVEs with VEX not_affected statements in your CI gate.
Read more
Archive 2026
Field Notes.
Honest notes on infrastructure, security, and running technical teams, documenting the shift from human-scale systems to autonomous technical architectures.
Fix MCP OAuth 2.1 Before the July 28 Rewrite
Only 8.5% of MCP servers use OAuth. Audit audience validation and add the resource parameter before the July 28 OAuth 2.1 spec rewrite lands.
Read more
Trivy vs Grype 2026: Pick by the Job, Not Speed
Trivy vs Grype in 2026: Trivy scans everything, Grype matches CVEs from an SBOM. Pick by the job, and pin your scanner after Q1's supply-chain hit.
Read more
GitHub Actions OIDC to AWS: Drop Static Keys for Good
Wire GitHub Actions OIDC to AWS correctly: scope the sub claim, handle the July 15 immutable-claim change, and avoid the trust policy traps tutorials skip.
Read more
Kubernetes Default-Deny Egress Stops Pod Exfiltration
Run a default-deny egress NetworkPolicy to stop a compromised pod from phoning home. Two manifests, one DNS gotcha that breaks it, and the CNI fix.
Read more
Falco vs Tetragon vs Tracee: Pick the Right One
Falco detects, Tetragon enforces in the kernel, Tracee does forensics. Picking one as a drop-in for another is the costly mistake. How to choose.
Read moreSubscribe to the Technical Journal
Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the 2026 AI-agent & infrastructure security checklist.
Cosign v3 Breaking Changes: Sign, Verify, Fix Harbor
Cosign v3 flips three flags on by default and breaks Harbor detection. Here are the fallback flags that keep CI signing and verification working.
Read more
io_uring Security: The Linux Speedup That Hides Rootkits
io_uring skips system calls for speed, and that same trick lets a rootkit run while Falco, Tetragon, and Defender see nothing. Here is how to close the gap.
Read more
Agentic SOC in 2026: 10 Tips for Safe Triage
Battle-tested agentic SOC tips: gate autonomy on 90% shadow-mode concordance, split verdict from action, and treat every log line as attacker-authored.
Read more
A2A Agent Card Poisoning: JWS Proves Origin, Not Intent
A signed A2A agent card still lets attackers inject instructions into the description field your orchestrator feeds directly to the LLM router.
Read more
Fission CVE-2026-50566: Stop the Container Escape
Find, patch, and block the CVSS 9.9 Fission container escape (CVE-2026-50566) on Kubernetes with version 1.24.0, Pod Security Standards, and a Kyverno rule.
Read more
AI Browser Prompt Injection Hands Over Your Sessions
One crafted URL drained Comet's Gmail and ChatGPT Atlas blocked just 5.8% of phishing. Agentic browsers run with all your logged-in sessions, and that is the bug.
Read more
Post-Quantum TLS Is Already On, and It Broke Your Router
Hybrid post-quantum TLS (X25519MLKEM768) is negotiating by default right now, and the operator problem is a 1,400-byte ClientHello that fragments and breaks SNI routing.
Read more
Run AI Fuzzing on Your Own Repo Before Attackers Do
OSS-Fuzz-Gen, Buttercup, and Atheris run on a laptop with one LLM key. Ten practical commands to fuzz your own repo before attackers do.
Read more
GreatXML BitLocker Bypass Means TPM-Only Is the Bug
An unpatched WinRE exploit, GreatXML, bypasses BitLocker on any Windows 11 machine that ran a Defender offline scan. The fix is TPM+PIN, not a patch.
Read more
MCP RCE Lives in the SDK, and No Patch Is Coming
A remote code execution flaw sits in Anthropic's official MCP SDKs across 150M downloads. It's stdio command execution by design, and Anthropic calls it expected.
Read more
GR00T N1.7's ZMQ Port Is an Open Robot Remote Control
The default Isaac GR00T N1.7 inference server binds to 0.0.0.0:5555 with no auth. Here is how to lock it to loopback behind mutual TLS.
Read more
Patch Tuesday Hit 206 CVEs and Broke Your Cadence
Microsoft's June 2026 Patch Tuesday fixed a record 206 CVEs and 3 zero-days. The real shift is AI-found bugs outrunning the human patch cycle.
Read more
AI Agent Identity Needs SPIFFE and OAuth, Not One Key
The fix for AI agent identity is two layers: SPIFFE proves what the agent is, OAuth token exchange proves what it may do right now and for whom.
Read more
npm allowScripts warning: fix "install scripts not covered" before npm 12
Run npm approve-scripts --allow-scripts-pending to list every pending package, then approve each one. npm 12 turns this warning into a hard install failure in July 2026.
Read more
Hunting Shadow AI Before It Becomes Your Breach Path
Shadow AI now factors into 1 in 5 breaches and adds $670K in cost. Why banning tools backfires, and how to actually find ungoverned GenAI in 2026.
Read more
OWASP API Top 10: Shadow APIs and BOLA Tips for 2026
Battle-tested OWASP API Security Top 10 tips for 2026: hunt shadow and zombie APIs at runtime, test BOLA in CI, and close the gaps that breached Optus.
Read more
EU AI Act High-Risk Rules Hit August 2, 2026
The EU AI Act's high-risk obligations become enforceable on August 2, 2026, a deferral isn't law yet, and ISO 42001 won't cover you. Here's the engineering work.
Read more
Tetragon 1.7 Runtime Enforcement: Block Processes in the Kernel
Build a Tetragon TracingPolicy that kills a process at the kernel before it reads a secret, plus the CONFIG_BPF_KPROBE_OVERRIDE gotcha that breaks it.
Read more
Prompt Injection Defense: 10 Tips That Hold Up
Why LLM agent guardrails fail under adaptive attack, and the architectural patterns that actually contain prompt injection in 2026.
Read more
Migrate Ingress-NGINX to Gateway API Before Retirement
A hands-on 2026 guide to migrating off the retiring Ingress-NGINX to the Gateway API with ingress2gateway 1.0 and Envoy Gateway, including the annotations that silently drop.
Read more
Kubernetes User Namespaces GA: hostUsers false Node Prep
Kernel 6.3 (not 5.12), containerd 2.0+, and /etc/subuid setup for Kubernetes 1.36 user namespaces. Covers the silent failures that cost you an afternoon.
Read more
Sandboxing AI Agent Code: A 2026 Runtime Guide
AI agent sandboxes isolate untrusted AI-generated code with Firecracker microVMs and gVisor. Here's how to pick an execution runtime in 2026.
Read more
Harden MCP Servers Against Tool Poisoning
A practical 2026 guide to securing MCP servers: inspect tool descriptions, scan for poisoning, pin versions against rug pulls, and add a runtime guardrail.
Read more
Non-Human Identity Governance: Field Tips for 2026
How to discover, scope, and govern service accounts, API keys, tokens, and AI agents before machine credentials become your breach path.
Read more
Dependency Cooldowns Beat Fast Supply Chain Attacks
Dependency cooldowns delay installing brand-new package versions a few days, blocking most npm and RubyGems supply chain attacks before malware lands.
Read moreNo articles match your search. Try a different term or topic.