Trust systems1 have long been a contentious topic in cloud computing. Standard cloud models operate on a passive assumption that you trust your cloud provider and you trust the underlying host OS, and more importantly, you trust the hypervisor not to...

Modern cloud architecture is facing a massive identity crisis. We are asking infrastructure to run workloads that software engineers a decade ago would have deemed hopelessly ill-advised. Third-party user plugins executing arbitrary code, autonomous ...

Webernetes1 is an experimental project developed by ngrok that ports a functional subset of Kubernetes directly into the browser, executing completely on the client side without relying on any backend server infrastructure. Built primarily as an inte...

Container escapes typically occur when a container gains direct access to host resources due to excessive permissions or shared namespaces. I'm working on a few Github projects to explore these risky misconfigurations in reproducible PoCs. The 3 cate...

The shift toward autonomous AI agents running arbitrary, unreviewed code in production environments has ultimately forced the security community to confront the harsh reality that our traditional container abstractions are wholly inadequate for untru...

Github Source: https://github.com/ndouglas-edera/hostpid-risk/tree/main In a multi-tenant or shared Kubernetes node environment, containers are supposed to be isolated environments. However, this demo proves that if a malicious or compromised pod is...

The software supply chain landscape changed forever in early-to-mid 2026. What began as a series of isolated credential-theft incidents quickly mutated into a highly coordinated, multi-registry, self-propagating worm campaign. By abusing trusted rel...

For years, security teams viewed container breakout attacks as an operational nuisance. The kind of nuisance that was largely confined to misconfigured Kubernetes clusters, over-privileged dev environments, or cloud cryptojacking campaigns. The secur...

Last weekend I was looking for a new project for my Raspberry Pi. I was looking for ways to set up a KVM on my Pi5 since it has 8GB of RAM, which is beefy enough for additional virtualisation tasks. Once I started Googling how I should start this tas...

Liran Tal of Snyk published a really useful Github repo called “Awesome npm security best practices1”. In this repo, Liran discusses structural constraints within the CLI toolchain, highlighting many practical, architectural shifts away from npm’s hi...