Things I build, break, fix, and write about

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and whether the core is quietly spoiling the whole thing; otherwise you are guessing, and guessing is a poor plan when the network is already sulking.

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

Latest blog posts you might like

5 June 2026
Kernel ring-buffer drops in Inspektor Gadget

Inspektor Gadget is only useful if I can trust the trace, and a full kernel ring-buffer makes that harder than it ought to be. Once events start dropping, the neat output is lying by omission, which...

4 June 2026
Patch diffing Adobe Acrobat PDF prototype pollution

Adobe Acrobat PDF prototype pollution is one of those bugs that only looks neat after the fact. The diff shows three separate failures, and the ugly bit is how ordinary object lookup, trusted...

4 June 2026
Human-led AI-assisted pentesting and review limits

AI-assisted pentesting is useful in the boring middle, where it can sort noise, group candidates, and keep a large target set moving. The trouble starts when it sounds certain about nonsense, so I...

3 June 2026
F_SETPIPE_SZ and soft page quota effects

Soft page quota effects are easy to miss, until a pipe that should be 65536 bytes turns up at 8192 and your spray no longer lands where you expected. I have seen pipe_buffer capacity limits quietly...

3 June 2026
Public GitHub leaked AWS GovCloud credentials

A public GitHub repository should not have been holding AWS GovCloud credentials, yet there they were, alongside backups, passwords and internal deployment files. I spent too long on the dull bit,...

2 June 2026
Audit RFI history offline with CSV export

Cloudflare Security Center CSV export is one of those dull features that matters once you need a clean paper trail. I prefer the file on disk, where I can sort it, cross-check it, and stop relying on...

2 June 2026
React Server Components DoS patterns and WAF limits

Some Next.js Server Components vulnerabilities are crude enough for a WAF to catch, but the awkward ones sit in routing, cache behaviour, and middleware. I prefer patching first, because a broad block...

1 June 2026
Cloudflare WAF rule merges for CVE-2025-53693

Cloudflare is folding a new Sitecore cache poisoning detection into an older Java deserialisation rule, and that is exactly the sort of tidy merge that makes tracking awkward. With Cloudflare WAF rule...

1 June 2026
Cloudflare Managed Ruleset changes in Security Events

Cloudflare Managed Ruleset updates do not always announce themselves politely; the useful clues often turn up first in Security Events. I keep checking there, because a rule can keep the same name...

1 June 2026
Weekly Tech Digest | 01 Jun 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.