Logs
Lab walkthroughs, security write-ups, and automation notes. Every post is tagged like a syslog message, %BLOG-severity-FACILITY: the lower the number, the sooner it's worth reading.
edge# show logging facilities
- NEWS-22 crit
- Security news CVEs, breaches and advisories worth acting on, explained in plain language. 5 posts
- AI-33 err
- AI AI in networking and security: tools I test, how attackers use it, and where it breaks. 3 posts
- NETWORK-44 warning
- Networking Routing, switching, subnetting and packet captures. CCNA labs live here. 1 post
- SEC-55 notice
- Security Blue team work: SOC labs, detection, hardening and vulnerability management. 12 posts
- PYTHON-66 info
- Automation Python, Netmiko and PowerShell scripts that remove the boring parts of admin work. 2 posts
- SUPPORT-77 debug
- IT support Troubleshooting and systems: Active Directory, Microsoft 365, ITSM and runbooks. 5 posts
October 2026
REA Can Reverse Engineer Almost Anything. Here Is What That Actually Changes
REA lets an AI coding agent decompile and explain software you have no source for, and it trended hard in October 2026. Past the hype: what it actually does, why it is not magic, the legitimate uses, what to change if you ship client-side code, and the prompt-injection risk of feeding a binary to an AI.
Threat Hunting Casebook 01: Hunting a Hijacked Microsoft 365 Copilot Session
Incident 01 of my Threat Hunting Casebook. A poisoned email hijacked a Microsoft 365 Copilot session: no malware, no stolen password, 13 sensitive files read and leaked through Markdown image links. How I proved it with KQL across three audit tables, ruled out the alternatives, and where the evidence ends.
Threat Intelligence in Sentinel, Part 2: Python, STIX and IOC Matching
Part 2 of the Sentinel threat intelligence project. A standard-library Python script turns 220 failed-logon IPs into scored STIX 2.1 indicators with an audit file, Sentinel imports them, and KQL matches them against logons, NSG flows, outbound connections and a 90-day retrohunt. Not everything came back clean.
Threat Intelligence in Sentinel, Part 1: Inventory What You Already Have
Part 1 of a three-part Microsoft Sentinel threat intelligence project. I inventory the built-in indicators with KQL, learn why active row counts mislead, mine 220 brute force source IPs from my own failed logons, and run the failed-then-succeeded check that separates noise from an incident.
Threat Intelligence in Sentinel, Part 3: EICAR, Analytics Rules and Incidents
Part 3 of the Sentinel threat intelligence project. I prove a file hash rule with the EICAR test file and learn why antivirus events carry SHA-1, build three scheduled rules, triage the incident one of them created, and measure the feeds. One alert came from over 120,000 indicators, and two of my three rules have yet to fire.
One IPv6 Address, Two Readings: How NAT64 Fooled OpenClaw's SSRF Guard
A write-up by researcher Anurag Mewar showed OpenClaw's SSRF guard misreading an RFC 8215 NAT64 address: the guard saw a harmless public IP while a compliant NAT64 gateway routed the request to the cloud metadata address. A walk through the RFC 6052 byte layout behind the trick, a short Python demo of the two readings, and the habits that stop this class of bug.
Build a Claude Code Mod That Blocks Force Pushes, and Test It Offline
A walk through building a small Claude Code mod that refuses git force pushes: the three-file layout, the rule, the validator and offline test runner, and a tested table of commands it blocks and the ones that slip past, plus why a protected branch on the server is the control that actually holds.
September 2026
ShinyHunters Beat a WAF With One Percent Sign, and the FBI Found Out the Hard Way
ShinyHunters revived a patched Oracle PeopleSoft zero-day, CVE-2026-35273, by encoding a single character in the vulnerable URL path so it slipped past WAF rules written to block the literal string. The technique hit the FBI's own job application portals along with dozens of other organizations. A walk through exactly how /%50SEMHUB/ defeats a firewall, and why a patch would have stopped it from the start.
Two Citrix NetScaler Zero-Days Were Exploited for Weeks Before Anyone Outside Was Told
CVE-2026-88771 and CVE-2026-88772 are unauthenticated remote code execution bugs in Citrix NetScaler ADC and Gateway, both CVSS 9.5, exploited by likely nation-state-aligned attackers for weeks before watchTowr's honeypot network forced public disclosure ahead of Citrix's own patch. Because exploitation predates the fix, patching is necessary but not sufficient. A walk through what these bugs do, why NetScaler is such a high-value target, and what to check before assuming a patch means you're clean.
Wireshark 4.6.9: When the Tool You Trust to Read Traffic Has 19 Ways to Bite Back
Wireshark 4.6.9 and the parallel 4.4.19 release patch 19 CVE-numbered bugs, mostly dissector crashes and infinite loops, plus several code-execution bugs reported through Trend Micro's Zero Day Initiative that do not have CVE numbers yet. A plain-language walk through what actually broke, why a passive-looking analysis tool has an attack surface in the first place, and what to check before opening your next capture.
The Sudo Bug That Turns Your Clock Against You: CVE-2026-96512
CVE-2026-96512 lets an already-authenticated local user manipulate sudo's TZ environment variable to shift its notion of time by roughly 25 hours, making expired NOTAFTER sudo rules look current or NOTBEFORE rules usable early. It only matters if your sudoers file uses time-bound rules without a trailing Z, and the fix for now is one character.
Cisco ISE's Perfect-10 Zero-Day: What CVE-2026-76460 Actually Breaks
Cisco's ISE auth bypass, CVE-2026-76460, is a perfect CVSS 10.0 and already added to CISA's exploited list. A plain-language walk through what the flaw actually does, why identity infrastructure is a uniquely bad place for it, and the exact command to check your own logs.
Best AI Tools for Network Engineers in 2026: What's Actually Worth Using
The CCNA exam now expects you to explain generative AI in network operations. Here is an honest, hands-on sort of which AI tools actually help, from studying for the exam to drafting configs to testing automation before it touches anything real.
Reading My Own SIEM: A 24-Hour Threat Hunt Through the Home Lab
A full 24-hour Wazuh threat hunting report from the SOC home lab, read cold: eight level-15 Shellshock alerts pulled apart record by record, a Zeek detection I had documented as broken turned out to be live, and an honest look at zero authentication failures.
First Alerts: What My SOC Home Lab Caught, What It Missed, and How I Triaged It
Predictions written before running a single command, then a real scripted attack against my SOC home lab: SYN scan, SQL injection confirmed by three independent tools, a beacon caught at a 0.001 coefficient of variation, and the triage tickets that followed.
One Pipeline, Three Jobs: Wazuh, Zeek and Grafana in a SOC Home Lab
Wazuh as the SIEM, Zeek as a second pair of eyes on the same interface, and Loki with Grafana for hunting: the rule that keeps a home SOC lab's memory budget sane, and a real Zeek notice that corrected an earlier assumption.
Suricata on the SOC VM: Installing and Tuning a Host-Based IDS
Installing Suricata from the OISF PPA on a two-VM SOC home lab: why HOME_NET has to be one address instead of a subnet, three custom rules that always fire, and reading real EVE JSON alerts end to end.
Designing a Two-VM SOC Home Lab: Small Scope, Real Detection Work
Why I cut a segmented, multi-firewall SOC design down to two VirtualBox VMs, the networking and memory budget that came out of that decision, and the threat model that decided what belonged in the lab.
I Built a Netmiko Config Backup Tool So I'd Stop Losing Arguments With My Own Router
A Python CLI that SSHes into every device in an inventory with Netmiko, backs up the running config, diffs it, and emails an alert on change, tested against a real two-router VyOS lab that caught two genuine bugs a mocked test suite never could.
What Nine Packet Captures Taught Me About Networks I Thought I Already Understood
Nine real packet captures, DNS, TCP, HTTP vs HTTPS, ICMP, packet loss, ARP, DHCP, Telnet vs SSH, and FTP, each one generated, read, and explained by hand for CCNA study and a networking portfolio.
What Twenty Fake Helpdesk Tickets Taught Me About Real IT Support
Building a full Freshservice service desk from scratch: three SLA tiers, a category taxonomy, a service catalog, and twenty simulated helpdesk tickets designed to be genuinely representative of a real support queue.
I Built an Active Directory Home Lab That's More Than Three OUs and a Password Policy
A from-scratch Active Directory lab on Windows Server 2022: OU design, Fine-Grained Password Policies, Windows LAPS, delegated help desk rights, WSUS patching, scripted provisioning, and a backup I actually tested.
Building an IT Runbook That Would Actually Survive Contact With a Real Service Desk
A five-document IT runbook covering onboarding, offboarding, password reset, laptop setup, and network troubleshooting, built from NIST, CIS Controls v8, and Microsoft's own documentation, including the lockout threshold assumption that turned out backwards.
I Kept Getting VLSM Wrong By Hand, So I Wrote a Tool That Can't
A dependency-free Python CLI that plans VLSM subnetting from a CSV of departments and host counts, no manual bookkeeping, 30 tests, and the allocation-order decision that stops wasted address space.
I Ran a Real Security Audit Against My Own Linux Machine, Here Is What Actually Broke
Lynis and rkhunter against a real Ubuntu workstation: three warnings triaged, a crashed Fail2ban jail caught, and an honest account of the thirty eight suggestions I skipped.
August 2026
I Built a Vulnerability Management Program From Scratch, Policy to Remediation
Policy, stakeholder buy-in, Tenable scanning across Windows and Linux targets, and ten confirmed remediations in PowerShell and Bash, including the two attempts that didn't work out.
I Automated the Seven Microsoft 365 Admin Tasks That Actually Fill an IT Ticket Queue
Onboarding, offboarding, groups, delegated admin roles, mail flow, and service health, automated with the Microsoft Graph PowerShell SDK, with a real audit trail.
Free Microsoft 365 Sandbox: The Real Setup Guide (2026)
The Microsoft 365 developer sandbox isn't actually free for individuals. Here's the real accessible path (30-day E3 trial) and how to avoid getting billed.
% No log entries match. Try a shorter search or clear the filter.