Things I build, break, fix, and write about

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and whether the core is quietly spoiling the whole thing; otherwise you are guessing, and guessing is a poor plan when the network is already sulking.

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

Latest blog posts you might like

21 May 2026
Rebuild WinRE trust after CVE-2026-33825 changes

BitLocker zero-day mitigations are easy to half-apply and then forget, which is exactly how trouble lingers. I had to rebuild WinRE trust after CVE-2026-33825 changes, because removing autofstx.exe is...

21 May 2026
Malicious VS Code extensions and workstation compromise

Malicious VS Code extensions do not need to look suspicious to do damage. I care less about the marketplace listing and more about what the thing can reach once it is installed, because that is where...

20 May 2026
Arch Linux PinTheft patch validation steps

PinTheft Arch Linux root escalation is only interesting if the kernel still exposes RDS, so I start there, not with exploit code. If the patched build really closes the hole, it should fail cleanly,...

20 May 2026
Least privilege for agentic AI tool calling

Agentic AI is easiest to trust when it has very little to do, and even less power. I prefer to treat tool calling like any other risky admin path, with tight permissions, short-lived credentials, and...

19 May 2026
Fraud detection signs in redirector and payment domains

website fraud toolchains are rarely clever at first glance, which is why I trust the ugly details, the redirects, duplicate card prompts, and any thank-you page that appears after a decline. Once you...

19 May 2026
Using ISC Stormcast to set patch priority

ISC Stormcast strips the noise out of vulnerability watching, and that matters when patch windows are tight. I use it to decide what jumps the queue, what stays logged, and what is simply not worth...

18 May 2026
Outlook Junk folder link preview bypass

Outlook Junk Folder link preview bypass is a neat reminder that preview text is not validation. I trust the HTML, or I do not trust the mail at all; anything in between is how people get caught out.

18 May 2026
Reading exploit trends from ISC Stormcast

ISC Stormcast is only useful if you treat it as live signal, not background noise. I watch for repeated behaviour around the same service or exploit family, because that is what changes patch...

18 May 2026
Amazon Fire TV Stick 4K Plus and 2 more Amazon tech bargains

Discover the Amazon Fire TV Stick 4K Plus and more tech deals this week.

17 May 2026
hassh drift breaks Outlaw SSH detection

hassh drift is exactly why I do not trust one fingerprint for long; malware library updates change the banner and the hash, while the real mess sits in the commands and file writes after login. If you...