Topic · 18 articles

Security.

Practical security writing for production systems: CI and dependency supply chain, Kubernetes and container isolation, post-quantum migration, real CVE response, and the AI agents now running inside all of it. By Indra Gusti Prasetya, security leader and co-founder of Temika Cyber.

Most of what takes down a production system is not exotic. It is the build that will run whatever a dependency asks it to, the cluster where one role quietly reaches everything, and the CVE nobody triaged. These articles cover that ground, with the newer AI agent layer as one part of it rather than the whole story. Written from production experience, not vendor slides.

Supply chain: dependency cooldowns, install-script gating, and patch cadence under 206 CVEs
Container & kernel: Kubernetes user namespaces, Fission escapes, io_uring and rootkit surface
Cryptography & compliance: post-quantum TLS already breaking routers, migration deadlines, and EU AI Act enforcement
AI agents: identity, trust boundaries, prompt injection, and A2A agent card poisoning

SecurityAugust 26, 20269 min read

Stop Trusting C2PA Content Credentials on Android

Treat verified C2PA Content Credentials as weak evidence: forged manifests pass the official verifier on rooted Pixels. Pin anchors, log the signer.

SecurityAugust 21, 20269 min read

arrayref Attack Shows cargo build.rs Runs Any Code

Commit Cargo.lock, build --locked, add a 3-day cooldown: the arrayref build.rs ran code during cargo build, and Cargo has no --ignore-scripts.

SecurityJuly 14, 20269 min read

Fix MCP OAuth 2.1 Before the July 28 Rewrite

Only 8.5% of MCP servers use OAuth. Audit audience validation and add the resource parameter before the July 28 OAuth 2.1 spec rewrite lands.

SecurityJuly 10, 20268 min read

Trivy vs Grype 2026: Pick by the Job, Not Speed

Trivy vs Grype in 2026: Trivy scans everything, Grype matches CVEs from an SBOM. Pick by the job, and pin your scanner after Q1's supply-chain hit.

SecurityJune 30, 20267 min read

Falco vs Tetragon vs Tracee: Pick the Right One

Falco detects, Tetragon enforces in the kernel, Tracee does forensics. Picking one as a drop-in for another is the costly mistake. How to choose.

SecurityJune 21, 20267 min read

io_uring Security: The Linux Speedup That Hides Rootkits

io_uring skips system calls for speed, and that same trick lets a rootkit run while Falco, Tetragon, and Defender see nothing. Here is how to close the gap.

SecurityJune 15, 20268 min read

A2A Agent Card Poisoning: JWS Proves Origin, Not Intent

A signed A2A agent card still lets attackers inject instructions into the description field your orchestrator feeds directly to the LLM router.

SecurityJune 14, 20268 min read

AI Browser Prompt Injection Hands Over Your Sessions

One crafted URL drained Comet's Gmail and ChatGPT Atlas blocked just 5.8% of phishing. Agentic browsers run with all your logged-in sessions, and that is the bug.

SecurityJune 14, 20268 min read

Post-Quantum TLS Is Already On, and It Broke Your Router

Hybrid post-quantum TLS (X25519MLKEM768) is negotiating by default right now, and the operator problem is a 1,400-byte ClientHello that fragments and breaks SNI routing.

SecurityJune 12, 20267 min read

GreatXML BitLocker Bypass Means TPM-Only Is the Bug

An unpatched WinRE exploit, GreatXML, bypasses BitLocker on any Windows 11 machine that ran a Defender offline scan. The fix is TPM+PIN, not a patch.

SecurityJune 12, 20268 min read

MCP RCE Lives in the SDK, and No Patch Is Coming

A remote code execution flaw sits in Anthropic's official MCP SDKs across 150M downloads. It's stdio command execution by design, and Anthropic calls it expected.

SecurityJune 11, 20268 min read

Patch Tuesday Hit 206 CVEs and Broke Your Cadence

Microsoft's June 2026 Patch Tuesday fixed a record 206 CVEs and 3 zero-days. The real shift is AI-found bugs outrunning the human patch cycle.

SecurityJune 10, 20268 min read

AI Agent Identity Needs SPIFFE and OAuth, Not One Key

The fix for AI agent identity is two layers: SPIFFE proves what the agent is, OAuth token exchange proves what it may do right now and for whom.

SecurityJune 9, 20268 min read

Hunting Shadow AI Before It Becomes Your Breach Path

Shadow AI now factors into 1 in 5 breaches and adds $670K in cost. Why banning tools backfires, and how to actually find ungoverned GenAI in 2026.

SecurityJune 8, 20268 min read

EU AI Act High-Risk Rules Hit August 2, 2026

The EU AI Act's high-risk obligations become enforceable on August 2, 2026, a deferral isn't law yet, and ISO 42001 won't cover you. Here's the engineering work.

SecurityJune 5, 20264 min read

The AI Agent You Deployed Last Quarter Is Probably Your Weakest Login

88% of enterprises hit an AI agent security incident in the past year. The cause isn't exotic attacks, it's identities nobody logged out or audited.

SecurityJune 5, 20267 min read

Dependency Cooldowns Beat Fast Supply Chain Attacks

Dependency cooldowns delay installing brand-new package versions a few days, blocking most npm and RubyGems supply chain attacks before malware lands.

SecurityJune 5, 20265 min read

RSA Is on a Clock Now: The 2026 Deadlines Forcing the Post-Quantum Switch

NIST's finalized post-quantum standards plus FIPS and CNSA 2.0 deadlines put RSA and ECC on a countdown. Here's why 2026 is the year to start migrating.

Browse other topics

AI 5 Checklist 1 Cloud 5 DevOps 15 Hardware 1 Infrastructure 1 Leadership 1 Mobility 1 Robotics 1 Tips & Tricks 15 Tutorial 13

All writing

Subscribe to the Technical Journal

Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the infrastructure security checklist I work from.