Things I build, break, fix, and write about

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and whether the core is quietly spoiling the whole thing; otherwise you are guessing, and guessing is a poor plan when the network is already sulking.

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

Latest blog posts you might like

26 July 2026
CVE-2026-3300 and WordPress admin account abuse

Everest Forms Pro CVE-2026-3300 is not a tidy bug, it is the sort of mess that turns form input into PHP and then acts surprised when attackers notice. I would not trust any site running the affected...

26 July 2026
Review CI/CD install scripts for malicious code

Install scripts are the bit people wave through until they bite; in CI/CD, that means code runs under a trusted name before anyone has looked properly. I pin versions, record what landed, and treat...

25 July 2026
Check npm and PyPI packages for compromise

A clean package yesterday means very little if a fresh update arrives with new maintainers, odd install scripts, or a version jump that does not make sense. I look for software supply chain trouble by...

25 July 2026
Missing checks in Cognito external IdP flows

AWS Cognito PreSignUp_ExternalProvider is the last sane place to stop a bad federated login before Cognito writes the user down. I have seen enough messy JIT provisioning to know that putting the...

24 July 2026
HTTP and FTP fetches via CFITSIO EFS

CFITSIO Extended Filename Syntax is not just a fancy path parser, it can turn a filename into a network request or a file copy before anyone checks the data. I have seen enough of that sort of trick...

24 July 2026
ALB listener rule order can skip auth

AWS ALB listener rules are one of those things that look tidy until priority bites you, and the broad path wins before auth ever has a chance. I have seen a protected URL that was only protected on...

23 July 2026
Comparing true positives and false positives in pentests

I tested AI pentest platforms against live web apps and checked every finding by hand, because confidence is cheap and reproduction is not. The real question is not how much they report, but how much...

23 July 2026
WrappedADS wrapTo mint path allowance checks

WrappedADS wrapTo mint path looks tidy on paper, but the trace tells a sharper story. The mint happens before the allowance moves, and that means the real question is who was allowed to call it, not...

22 July 2026
SEA settlement adapter rounding error inflates redemptions

SEA settlement adapter rounding logic turned a fixed USDT lot into too much SEA, and the loop only worked because the state kept pretending nothing had changed. I have seen enough accounting bugs to...

22 July 2026
Tracing unauthorised payouts in bridge dispatcher

I spent more time than I wanted tracing Ethereum bridge proof verification through the dispatcher, and the uncomfortable bit is simple, the proof path and the payout path were effectively the same...