Gemini Hacked Real Companies During Testing: Where AI Containment Failed
Google's Gemini testing incidents expose the gap between an agent's assigned task and its actual reach. A technical guide to scope, egress controls, detection, and response.
Threat Detection
16 articles
JFrog Artifactory CVEs: Your Artifact Repository Is a Build Boundary
CISA KEV activity and a fresh critical Artifactory authentication bypass show why package repositories need incident-grade monitoring, not just routine patching.
npm Mirrors Are Becoming Phishing Hosts, Not Just Package Mirrors
A fake Cloudflare CAPTCHA campaign used npm packages and mirror CDNs as trusted-looking web hosting. The packages were not the payload; the mirror URLs were.
Cordyceps and GitHub Actions: When CI/CD Trust Boundaries Become the Supply Chain Attack
Novee's Cordyceps research is a reminder that GitHub Actions workflows are executable attack surface, not harmless YAML. Here is how to audit the trust boundary before an outside pull request borrows maintainer authority.
Insider Threat in 2026: The Risk Is Not Who You Trust, But What They Can Reach
Insider threat is not only about malicious employees. It is about trusted access, forgotten accounts, stolen sessions, and the controls that decide how far one identity can go.
AD Attack Chains: From Initial Access to Domain Admin
A complete purple team walkthrough of Active Directory attack chains — from initial foothold through Kerberoasting, DCSync, and Golden Tickets to full domain compromise, with detection rules for every technique.
What It Really Takes to Become a True SOC Professional
Discover the real skills, mindset, and strategies needed to become a genuine SOC professional—from technical mastery to standing out in job hunts.
C2 Without Owning C2: When Attackers Use Your Trusted Services
Attackers no longer need their own infrastructure. Learn how Dead Drop C2, Living off Trusted Services, and reputation laundering work—and why traditional defenses fail.
The Build Is the Target: CI/CD Pipeline Attacks and How to Detect Them
Your CI/CD pipeline stores production credentials, runs code automatically, and trusts pull requests. Here's how attackers exploit that — and the detection logic to catch them.
Identity-First Attacks in Cloud: How Permissions Become the New Perimeter
Cloud attackers exploit IAM permissions, not vulnerabilities. Learn the 4-phase attack chain from initial access to data exfiltration and detection strategies.
Purple Teaming on a Budget: Free Tools and Frameworks That Actually Work
A practical guide to building a purple team program using only free, open-source tools. Covers Atomic Red Team, MITRE Caldera, Sigma rules, Wazuh, and VECTR with real setup examples.
Starkiller: Inside Empire's C2 GUI — Red Team Playbook and Blue Team Detection
A technical deep dive into Starkiller and PowerShell Empire — how red teams deploy and operate it, and exactly how defenders can detect and disrupt it.
XDR Explained Clearly — What Does It Do That EDR Doesn't?
Discover the critical differences between XDR and EDR security solutions. Learn why XDR provides cross-domain threat detection that EDR can't match, and which solution fits your organization in 2026.
Telegram as a C2 Server: How It Works and How to Detect It
Attackers use Telegram's Bot API as command-and-control infrastructure — no Telegram install needed on the victim machine. Here's the mechanics, real-world examples, and blue team detection strategies.
PathSentry: Detecting and Preventing Windows PATH Hijacking Attacks
Windows PATH hijacking enables attackers to execute malicious code through writable directories. PathSentry uses two-phase detection to identify vulnerable PATH entries before exploitation.
Antivirus vs EDR vs XDR — What's the real difference in 2026?
A modern breakdown of Antivirus, EDR and XDR — including features, use-cases, attack detection logic and why traditional antivirus is no longer enough.