Forensics
Scope: Where each component writes logs, what it records, what it doesn’t, defaults, and the forensic/detection implications for the lab. Basis: Verified against the running lab (Ollama 0.32.1 on the Windows host + remote 3090; Agent Zero container, Kali-based image). Paths/behaviors confirmed live where noted.
Read more “Logging Reference — Ollama & Agent Zero”
Research
What better way to test than to eat ones own dogfood right! This site runs WordPress, it is fronted by Cloudflare, has wordfence and has automatic patching enabled (the default) in WordPress. So what better example to show that we can use an LLM + LLM created scripts to conduct assurance activities. This is mixing deterministic and non deterministic technologies to test and then assess.
Read more “Using an LLM for assurance (WP2SHELL)”
Strategy
TL;DR: wp2shell (CVE-2026-63030 chained with CVE-2026-60137) matters because it is a core, pre-authentication RCE reachable on a stock, plugin-free install. That is the rare category. In 25 years, unauthenticated code execution against a bare WordPress install has happened only a handful of times. The overwhelming majority of WordPress mass compromise has ridden the plugin and theme supply chain and infrastructure abuse, not core. This post maps the history so you can see where wp2shell actually sits.
Read more “From TimThumb to wp2shell: 25 Years of WordPress Mass Exploitation”
AI
I’m in a bit of a rush with this one but the TLDR; the USA senate was told:
“On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”
This isn’t really great… and you will hopefully see why!
Read more “Mythos, isn’t magic!”
Threat Intel
When you compromise a firewall you have lots of options in terms of next steps, from using the VPN, changing configurations, creating backdoors or perhaps using the firewall to PCAP. In this post I’m going to explore the ‘Fortibleed’ campaign. I have to note, we can see in honeypot logs this TA did not seem to limit themselves to Fortinet exploitation, however the area of analysis has a heavy Fortinet element. You will see they deployed a capture and analysis platform. Treat everything with a pinch of salt because I’m using a mad probability based machine (LLM) to support me for this!
Read more “Bleeding Out”
Leadership
Our cyber world is full of myths and FUD:
Attackers only have to be right once, Defenders have to be right all the time!
Firstly, let’s cut straight to the chase, I can only assume that someone who says this is ignoring or is unaware of how computer systems and intrusions work. But surely this is a true phrase, I’ve seen it repeated over and over again on LinkedIn, so it must be true right?
Read more “Cyber Myth: Attackers only have to be right once, Defenders have to be right all the time!”
Threat Intel
We can see from Defused honeypots and conducting a triage that CVE-2026-34910 (updated as I had the wrong CVE number, wrong as in this packet does show a traversal but is the using command exec) is being exploited in the wild!
Read more “CVE-2026-34910 Exploitation ITW – building a botnet (MIRAI)”
Education
SPF and DMARC stop criminals from sending email as you. MTA-STS stops attackers from intercepting email sent to you. They defend different things, and you need all three. Here’s what each one actually protects against — and why MTA-STS, the one almost nobody has enabled, is the obvious next step.
Read more “Lock Down Your Email: SPF and DMARC as the Baseline — Then Turn On MTA-STS”
Vulnerabilities
Ok, fun things to learn about me, I don’t like CVEs or CVSS because my brain can’t really read them! I have the same challenge with some server naming standards. I need something like SRV-UK-ADDS-01 if it’s not goy hyphens I need a tool to read them for me! (true story!). So lets look at CVSS (I know I’m full of fun topics).
Read more “CVSS Scoring is fun they said!”
Leadership
Most organizations treat email authentication as a checkbox exercise. Deploy SPF, publish DMARC in reporting mode, call it done. But the real story isn’t about maturity tiers—it’s about what you unlock at each phase of implementation. And frankly, the gap between where organizations are and where they need to be is brutal.
This post outlines an enablement journey: each phase builds on the previous one and creates new capabilities that weren’t possible before.
Read more “Email Security: An Enablement Journey, Not a Maturity Ladder”