News
🛡️Architecture Deep Dive: Model-Driven Intrusion Prevention An inside look at Centinela (centinela-2f) and Laya, our self-hosted, fine-tuned multilingual decision engine that arbitrates WAF grey zones, slashes false positives by up to 80%, and makes OWASP CRS Paranoia Level 3 usable in production.🌐Edición en Español: Sobreviviendo a la Zona Gris:
en
Executive weekend threat intelligence briefing: Cisco Nexus 9000 Silicon One root RCE (CVE-2026-20212), Sangoma Switchvox SQLi in CISA KEV, and WordPress mass attacks.
en
Analysis of Operation QUICSILVER, an advanced cyber espionage campaign deploying custom Go backdoors communicating over encrypted QUIC protocol tunnels.
en
Technical root-cause analysis of CVE-2026-33824, a CVSS 9.8 double-free vulnerability in the Windows IKE service enabling unauthenticated remote code execution.
en
Deep dive into CVE-2026-72529 and CVE-2026-72530 in TrueConf Server, exploited by Head Mare for SYSTEM takeover and supply chain poisoning.
en
How Wiz's autonomous AI red-team agent found a GitHub Actions command injection bug in a public Snowflake repository that Copilot-assisted review had missed.
en
Under the hood of ojo's zero-dependency engine: manifest parsing, Tree-sitter SAST queries, OS package diffing, and offline vulnerability databases.
en
Introducing ojo: a single static binary for vulnerability scanning, secret detection, SAST, and IaC misconfiguration checks with zero external dependencies.
en
Case study on Capital One's VulnHunter: autonomous agentic AI scanning codebases and identifying zero-day logic flaws.
Security
First of all, this is an old article I wrote back in 2013. I’m putting it on here as a reminder to everyone and myself to update the…