Trust systems1 have long been a contentious topic in cloud computing. Standard cloud models operate on a passive assumption that you trust your cloud provider and you trust the underlying host OS, and more importantly, you trust the hypervisor not to...

Modern cloud architecture is facing a massive identity crisis. We are asking infrastructure to run workloads that software engineers a decade ago would have deemed hopelessly ill-advised. Third-party user plugins executing arbitrary code, autonomous ...

Webernetes1 is an experimental project developed by ngrok that ports a functional subset of Kubernetes directly into the browser, executing completely on the client side without relying on any backend server infrastructure. Built primarily as an inte...

Container escapes typically occur when a container gains direct access to host resources due to excessive permissions or shared namespaces. I'm working on a few Github projects to explore these risky misconfigurations in reproducible PoCs. The 3 cate...

The shift toward autonomous AI agents running arbitrary, unreviewed code in production environments has ultimately forced the security community to confront the harsh reality that our traditional container abstractions are wholly inadequate for untru...

Github Source: https://github.com/ndouglas-edera/hostpid-risk/tree/main In a multi-tenant or shared Kubernetes node environment, containers are supposed to be isolated environments. However, this demo proves that if a malicious or compromised pod is...

The software supply chain landscape changed forever in early-to-mid 2026. What began as a series of isolated credential-theft incidents quickly mutated into a highly coordinated, multi-registry, self-propagating worm campaign. By abusing trusted rel...

For years, security teams viewed container breakout attacks as an operational nuisance. The kind of nuisance that was largely confined to misconfigured Kubernetes clusters, over-privileged dev environments, or cloud cryptojacking campaigns. The secur...

Last weekend I was looking for a new project for my Raspberry Pi. I was looking for ways to set up a KVM on my Pi5 since it has 8GB of RAM, which is beefy enough for additional virtualisation tasks. Once I started Googling how I should start this tas...

Agent Skills provide an opportunity to scale engineering, but also opens potential new attack surfaces, as highlighted in a previous blog post1 I wrote for the Platform Engineering community. In this tutorial, we'll discuss how devs can securely cons...

Liran Tal of Snyk published a really useful Github repo called “Awesome npm security best practices1”. In this repo, Liran discusses structural constraints within the CLI toolchain, highlighting many practical, architectural shifts away from npm’s hi...

Instead of a Dockerfile, we write YAML-based files for apko1. This file tells apko exactly which repositories to trust and which packages to materialise into the image. mkdir apko-demo && cd apko-demo && cat ...

I’m working in software supply chain security, with a specific focus on secure Kubernetes deployments. In a DevOps capacity, I’m focused specifically on ensuring that my container images have as few software vulnerabilities as possible. I believe Wol...

Since its inception in 2013, OWASP Dependency-Track1 has been at the forefront of analysing Software Bill of Materials SBOM for cybersecurity risk identification and reduction. Dependency-Track allows organisations and governments to operationalise S...

I started working on a bash script called exploit-check.sh1 some time ago. The script does a bunch of odd jobs, but one specific task is to query a known vulnerability CVE ID to get a description of the vulnerability and more importantly tie it back ...