Tag: #security

한국어English日本語中文

← All posts

• DMARC Becomes a Standard After 11 Years — RFC 9989's Tree Walk, the pct Sunset, and the p=reject Warning

  DMARC (RFC 7489), the de facto standard for email authentication since March 2015, was actually an Informational document that never went through IETF working-group consensus. In May 2026 the IETF replaced it with three

  2026-07-17 · 15 min read #email#dmarc#dns#security#rfc

• Keycloak 26.7 — SCIM Promoted to Preview, Multi-Cluster v2 Without External Infinispan, and What to Watch in the Upgrade

  Keycloak 26.7.0, released on July 9, 2026, promoted the SCIM API — a request that had been open for nearly four years — to preview, and shipped multi-cluster v2 in preview, which builds multi-cluster HA out of the databa

  2026-07-17 · 16 min read #security#keycloak#sso#iam#scim

• The Road to 47-Day TLS Certificates — Step-by-Step Dates from the SC-081v3 Ballot Text, Let's Encrypt's 45-Day Transition, and ACME ARI

  As of March 15, 2026, the maximum lifetime of publicly-trusted TLS certificates has already dropped from 398 days to 200 days, and under the schedule locked in by the CA/B Forum ballot (SC-081v3) it keeps falling — to 10

  2026-07-17 · 16 min read #security#tls#certificates#webpki#automation

• The 18 CVEs in curl 8.21.0 — the "High-Quality Chaos" That Followed the End of the Bug Bounty

  On June 24, 2026, curl 8.21.0 set a new project record by shipping 18 CVEs in a single release. Yet all 18 are Low or Medium, and there hasn't been a single High since October 2023. Behind that number is a project that,

  2026-07-17 · 15 min read #network#security#curl#cve#open-source

• Who Maintains OPA Now — Styra's Team Joins Apple, and 11 Months of Verifiable Record

  On August 20, 2025, an announcement said OPA's founders and a number of Styra team members were joining Apple, and a rumor spread through the community that 'Apple acquired OPA.' Checking primary sources tells a differen

  2026-07-17 · 12 min read #security#opa#authorization#open-source

• October 11, 2026: The Root KSK Changes — What's Actually in the Root Zone Right Now

  The root KSK — DNSSEC's trust anchor — moves from KSK-2017 to KSK-2024 on October 11, 2026. For most resolvers this is a non-event thanks to RFC 5011, but for a validating resolver that failed to pick up the new trust an

  2026-07-16 · 25 min read #network#dns#dnssec#security#protocol

• Why Post-Quantum Certificates Are Not Here Yet — ML-DSA Signature Size, the 10kB Wall, and Merkle Tree Certificates

  In the post-quantum transition, key exchange (encryption) is already well underway, but certificates and signatures are still at the starting line. The reason isn't cryptography — it's size. The ML-DSA-44 signature defin

  2026-07-16 · 21 min read #security#post-quantum-cryptography#tls#webpki#certificates

• Passkey Portability Only Half Arrived — CXF Became a Standard, CXP Is Still a 2024 Working Draft

  FIDO has two credential-exchange specs. CXF, which defines what gets exchanged, became a Proposed Standard on August 14, 2025 and even got an errata on March 9, 2026 — but CXP, which defines how it gets exchanged, is sti

  2026-07-16 · 16 min read #security#passkeys#webauthn#fido#standards

• AWS Lambda MicroVMs — Running Agent-Written Code Under VM Isolation, and the New Problem Snapshots Create

  AWS launched Lambda MicroVMs on June 22, 2026. It sells Firecracker micro-VMs as a service, and the market it's aiming at is clear — running user- or AI-generated code, isolated per tenant. It moves the container's share

  2026-07-16 · 17 min read #security#firecracker#microvm#aws-lambda#sandboxing

• One Issue, the Whole Supply Chain — How an Agent Inside CI Broke, and What the Defenses Actually Bought

  The Claude Code GitHub Actions vulnerability that GMO Flatt Security researcher RyotaK disclosed on June 1, 2026 traces, end to end, how an agent dropped into a CI pipeline can become the channel that hands over an entir

  2026-07-16 · 21 min read #security#ai#prompt-injection#supply-chain#ci-cd

• What ROV Blocked, What ASPA Still Can't — the June 2026 Telegram Hijack and the Next Layer of Routing Security

  On June 16, 2026, India's Rcom (AS18101) hijacked Telegram's prefixes, and Kentik's measurement shows the hijacked path reached only 1.6% of Kentik's own BGP sources — a case where RPKI ROV actually worked. But that's be

  2026-07-16 · 23 min read #network#bgp#rpki#routing#security

• The 3-Hour axios Account Takeover — Provenance Was On, and Nobody Checked It

  At 00:21 UTC on March 31, 2026, a malicious version 1.14.1 landed on axios, a package with over 80 million weekly downloads. What makes this case interesting is that axios was already using npm trusted publishing — the l

  2026-07-16 · 18 min read #security#supply-chain#npm#nodejs#devsecops

• QuadRF and Software-Defined Radio — What "Seeing WiFi Through a Wall" Really Means

  QuadRF, featured by Jeff Geerling, is a development kit that stacks a 4×4 MIMO software-defined radio and a phased-array antenna on a Raspberry Pi 5. The provocative headline — "see WiFi through my wall" — is not X-ray v

  2026-07-11 · 6 min read #sdr#rf#radio#raspberry-pi#hardware

• Why npm supply-chain attacks won't go away — what npm-scan actually checks, and the defenses that work

  npm supply-chain attacks are not isolated accidents but a recurring product of install scripts, transitive dependencies, and typosquatting. In 2025 the Shai-Hulud worm self-replicated through install scripts and harveste

  2026-07-11 · 7 min read #npm#supply-chain#security#javascript#nodejs

• GhostLock: a stack use-after-free that hid in Linux rtmutex for 15 years (CVE-2026-43499)

  GhostLock (CVE-2026-43499) is a stack use-after-free in the Linux kernel's real-time mutex code that, per the nebusec.ai IonStack part II writeup, sat in mainline from 2.6.39-rc1 in 2011 until a fix in April 2026 — about

  2026-07-11 · 6 min read #linux-kernel#security#use-after-free#privilege-escalation#rtmutex

• EU Chat Control 1.0: what actually passed, and the client-side scanning question

  On 9 July 2026 the European Parliament let a message-scanning regulation pass even though more MEPs in the room voted against it than for it. The label Chat Control hides two very different things: a voluntary derogation

  2026-07-11 · 6 min read #privacy#encryption#eu-regulation#client-side-scanning#messaging

• Building SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features

  Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re

  2026-07-09 · 9 min read #keycloak#sso#oidc#security#devops

• Hunting Bugs with AI — The Era of Automated Security Research

  Cases of AI automatically probing APIs at scale to uncover vulnerabilities are on the rise. From how fuzzing, differential analysis, and LLM-assisted triage work, to the asymmetry of attackers also using AI, the implicat

  2026-06-25 · 20 min read #devops#security#ai#bug-bounty#fuzzing

• Cybersecurity Investing in the AI Era - Both Attack and Defense Run on AI

  AI is accelerating both attack and defense. As AI-driven threats, supply-chain attacks, and quantum risk lift security spending, we map the sub-fields of cybersecurity and the key company landscape, and examine the defen

  2026-06-18 · 15 min read #finance#cybersecurity#ai#investing#security

• Operator Security — Least-Privilege RBAC, Multi-Tenancy, Supply Chain

  An Operator runs cluster-wide with powerful privileges, so a single compromise can endanger the whole cluster. This article covers Operator security end to end — generating least-privilege RBAC with markers, choosing Rol

  2026-06-15 · 21 min read #kubernetes#operator#rbac#security#supply-chain