Things I build, break, fix, and write about

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and whether the core is quietly spoiling the whole thing; otherwise you are guessing, and guessing is a poor plan when the network is already sulking.

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

Latest blog posts you might like

28 June 2026
Access control in WrappedADS authorised mint flow

WrappedADS wrapTo() mint path is not hiding much, and that is the point. If the caller is trusted, the mint goes through; if that trust is wrong, supply moves just as easily.

27 June 2026
redeemPosition rounding turns fixed deposits noisy

A fixed deposit should not unlock more SEA just because the round counter shifts. The SEA settlement adapter let that line blur, and a flash-loan loop made the mistake expensive; once redemption...

27 June 2026
MMR proof indexing in a bridge dispatcher audit

The ugly part of an Ethereum bridge dispatcher is not the proof itself, it is the gap between a tidy verification trace and the bytes that finally reach custody logic. If those two ever diverge, the...

26 June 2026
Uniswap V2 spot reads distort reward payouts

A pair reserve is a terrible price feed when someone can shove it around for one transaction. I have seen the same bad read turn cheap stake entry into inflated principal, then pay out rewards from...

26 June 2026
Web shell persistence in BadIIS loaders

BadIIS is not clever, just persistent, and that is what makes it unpleasant. It survives IIS restarts, rewrites selected traffic, and leaves behind enough build artefacts, like demo.pdb, to give...

25 June 2026
OpenVPN vulnerabilities and patch priority

OpenVPN vulnerabilities are easy to shrug off until they hit the client, where malformed packets can knock out remote access before the tunnel is even trusted. I would patch that before almost...

25 June 2026
Operational threat intelligence for IIS hijacking

IIS hijacking is boring until it is not, which is exactly why a threat intelligence programme has to watch for the awkward bits, not the headline alert. When redirects, 503 spikes, and odd proxying...

24 June 2026
GitHub source code exposure via third-party tooling

GitHub source code exposure rarely starts with the platform itself, it starts with something trusted too much. I care less about the headline breach than the awkward bit underneath, where a...

24 June 2026
Data exfiltration signs from signed Setup.exe flows

Signed `Setup.exe` did not fool me for long, because the runtime behaviour was wrong from the start. The interesting bit in cloud environment exfiltration is usually the small `.config` file beside it...

23 June 2026
Hardening ig build against command injection

Inspektor Gadget OCI images sound harmless until a build value slips into shell syntax and the pipeline starts executing it for you. I prefer build steps that stay boring, because once they stop being...