I work on security engineering. Everything I learn ends up here.
I have spent close to a decade on the offensive side: offensive AI development, web, internal network, mobile and API penetration testing, red team work and DevSecOps. Everything here is based on public vulnerability reports and experiments in my own lab — these are personal notes. Enjoy the read.
Writing
161 posts · page 1 / 14Prompt Injection Cannot Be Solved With Classical Security Models
Prompt injection is not a parsing error; it is the natural consequence of an LLM's inability to distinguish between instruction and data, and therefore a permanent patch should not be expected.
The Cold Breath of a Zero-Day: When Lazarus Hits the Kernel
Sedat Özdemir breaks down the Lazarus group's kernel-level zero-day exploit, the FudModule rootkit, and the high-stakes world of kernel-mode defense.
Green Ticks Won’t Save You: The End of Security Theater
Compliance is just an illusion of security. Real attackers don't care about your SOC2 or ISO 27001 certificates when they find a simple logic flaw.
Automation Won’t Save You: The False Sense of Security in DevSecOps
Security tools without context are just technical debt. From my time in the field, I've seen how over-automation actually creates more vulnerabilities than it fixes.
Not the Backdoor, but the Front Door: Metabase and the 'Secure' Internal Tools Fallacy
A deep dive into the Metabase zero-day and why the 'internal network is safe' mindset is a dangerous myth in modern DevSecOps environments.
Trivy: Leveraging the Swiss Army Knife of Container Security
Why looking for CVEs isn't enough. My experience with Trivy in DevSecOps pipelines and how it exposes the 'security illusion' beyond just image scanning.
Vulnerabilities Behind the Surface: Navigating Container Depths with Trivy
Container security is more than just a checkbox. Explore how Trivy uncovers critical vulnerabilities in images and why static analysis is vital for DevSecOps.
Trivy: Silent Sentry or CI/CD Pipeline Headache?
A deep dive into using Trivy for container and IaC security, from midnight pipeline failures to managing false positives in a DevSecOps workflow.
Trojan in the Mailbox: Zimbra and the Invisible Leak
A deep dive into why enterprise mail platforms like Zimbra remain a goldmine for attackers and how DevSecOps can mitigate zero-day risks.
Midnight Signal: SonicWall and the Broken Perimeters
A 3:14 AM alert, cold coffee, and a flashing dashboard. PulseCom's VPN gateway is acting up. Let's talk about the SonicWall SMA 100 series zero-day.
Do Certificates Lie? Ten Thousand Hours at the Terminal
A candid look at why real-world experience, broken home-labs, and protocol knowledge outweigh fancy paper certificates in the world of ethical hacking.
The Shift Left Illusion: Are We Building Security or Just Generating Noise?
Why are remediation times still 200+ days if we're 'shifting left'? A deep dive into the trap of over-relying on automated security tools in CI/CD.