Security notes from production, not from a template library
CVE and KEV analysis, Active Directory and Kerberos internals, and defensive write-ups, written by a working security practitioner.
Browse the tooling & runbooks Start with Kerberos abuse in AD →
Latest posts
The DORA Register of Information: Structure, Common Failures, and What Supervisors Check
Most financial entities did not fail their first DORA Register of Information on content. They failed on structure: a flat spreadsheet where the regulation asked for a relational dataset, Legal Entity Identifiers left blank or pointed at the wrong company, and a critical-or-important-function flag filled in per contract. This is how to build one that survives the ESA collection, the ITS template structure, the LEI and critical-function pitfalls, and what supervisors actually check.
NIS2 Supply Chain Security: Building a Supplier Register With No Template
NIS2 asks you to secure your supply chain in a single sub-clause and hands you nothing to fill in. Article 21(2)(d) leaves the format, depth, and evidence to you, and that freedom is the trap. How to build a supplier register you can defend: direct suppliers, criticality tiering, contractual requirements, incident flow-down, and what the competent authority actually checks.
ISO 27001:2022 Supplier Relationships: A.5.19–A.5.23 in Practice
The most common supplier nonconformity is a control marked Applicable in the Statement of Applicability with nothing operating behind it. The five supplier controls as one lifecycle, the register they imply, the new cloud control A.5.23, and exactly what a certification auditor samples for each.
NIST CSF 2.0 GV.SC: Supply Chain Risk as a Govern Outcome
CSF 2.0 moved supply chain risk out of Identify and into the new Govern function as GV.SC, and that placement is the point. The ten C-SCRM subcategories as a program not a checklist, building the prioritized supplier inventory, and using Current and Target Profiles to drive third-party risk maturity a board can act on.
CIS Control 15: Service Provider Management, IG1 to IG3 in Practice
Every framework tells you to manage third-party risk; CIS tells you the order to do it in. Control 15's seven safeguards sequenced across Implementation Groups 1 to 3, building the 15.1 inventory from procurement plus Entra plus egress logs, and the evidence each safeguard produces, including the most-forgotten one, secure decommissioning.
CVE-2026-55255: Langflow IDOR Lands on CISA's KEV List
A CVSS 9.9 authorization bypass in Langflow: the flow lookup checks ownership when you query by name but not when you query by UUID, so any valid API key plus a flow ID (which show up in share links and logs) runs someone else's flow and its stored credentials. Why it's a same-week patch, what exploitation looks like, and why detection is genuinely weak before 1.9.1.
From Hotel Wi-Fi to ISP Tracking, A Practical VPN Security Guide with NordVPN
Disclosure: This article may contain affiliate links. If you purchase through these links, NULL PACKET may earn a commission at no additional cost to you. We only recommend tools relevant to the security workflows discussed here. Public Wi-Fi networks, ISP telemetry collection, DNS leaks, regional content restrictions, aggressive tracking ecosystems, these have transformed VPNs from niche privacy tools into practical security infrastructure. Most VPN marketing focuses on streaming but the real
SolarWinds Serv-U CVE-2026-28318: What you Need to Know
SolarWinds Serv-U 15.5.4 Hotfix 1 fixes CVE-2026-28318. The mechanics matter less than the position: Serv-U is usually internet-facing, domain-joined, and over-privileged, the same profile Cl0p mass-exploited on MOVEit and GoAnywhere. The detection order I'd use, the Splunk and KQL hunts for post-exploitation, and why segmentation is what actually saves you.
The Hidden Security Risks of Online Advertising: How Malvertising Became a Modern Cybersecurity Threat
Disclosure: This article may contain affiliate links. If you purchase through these links, NULL PACKET may earn a commission at no additional cost to you. We only recommend tools relevant to the security workflows discussed here. For years, online advertising has been treated as a normal part of the internet experience. Pop-ups, autoplay videos, tracking cookies, and targeted banners have become so common that many users barely notice them anymore. What most people do not realize is that the
Why Modern SOCs Fail Against Advanced Persistent Threats
Most Security Operations Centers are drowning in telemetry while simultaneously starving for visibility. On paper, modern SOCs appear stronger than ever: * SIEM platforms ingest terabytes of logs daily * EDR agents monitor every endpoint * Cloud providers expose massive audit datasets * Threat intelligence feeds update in real time * SOAR platforms automate response workflows Yet major intrusions continue to evade detection for weeks or months. This is not a tooling problem alone. It is a
Weaponizing OAuth Misconfigurations: How Modern Attackers Abuse Trust to Bypass Traditional Security Controls
OAuth was designed to solve a legitimate problem: delegated access between applications without exposing passwords. In practice, however, OAuth has evolved into one of the most abused trust mechanisms in modern enterprise environments. Attackers increasingly target OAuth integrations because they offer something traditional malware often cannot: persistent access that looks legitimate. A compromised OAuth workflow does not necessarily require malware execution, credential dumping, or even MFA
Kerberos Abuse in Active Directory
Modern enterprise authentication depends heavily on Kerberos. Within Active Directory environments, Kerberos acts as the primary trust mechanism responsible for validating users, granting service access, and enabling secure communication across systems. From a defensive standpoint, Kerberos was designed to improve security over older authentication methods such as NTLM by reducing plaintext credential exposure and introducing ticket-based authentication. However, the protocol’s deep integration
Active Directory Security in Hybrid Enterprise Environments
Modern enterprise identity infrastructure has evolved far beyond the traditional Windows domain controller model. Today’s organizations operate in hybrid identity ecosystems where on-premises Active Directory integrates directly with cloud identity providers such as Microsoft Entra ID, SaaS applications, VPN platforms, endpoint management systems, and third-party federation services. This convergence has transformed Active Directory (AD) from a simple directory service into the operational core
Cybersecurity Best Practices for Individuals and Organizations
An Enterprise Security Operations & Infrastructure Hardening Playbook Modern cybersecurity is no longer centered around a single firewall, antivirus platform, or isolated security team. Enterprise environments now span hybrid infrastructure, multi-cloud deployments, SaaS ecosystems, remote workforces, APIs, mobile endpoints, third-party integrations, and highly distributed identity systems. At the same time, threat actors have evolved significantly. Modern attacks leverage ransomware-as-a-serv
Trend Micro Apex One CVE-2026-34926: CISA Adds Exploited Endpoint Management Vulnerability to KEV
A directory-traversal flaw in Trend Micro Apex One (On-Premise), KEV-listed and exploited. It "only" needs local access, but local access to an endpoint-management server means an attacker can push code to every agent it manages. Why "local only" doesn't lower the priority, the deployment-then-fan-out signal to detect on, and treating the console as Tier 0.
Langflow CVE-2025-34291: CISA Adds Critical AI Workflow RCE Chain to KEV
The earlier of two KEV-listed Langflow bugs: four ordinary web mistakes, wildcard credentialed CORS, a SameSite=None refresh cookie, browser-carried token theft, authenticated code execution, chained into account takeover and RCE on Langflow ≤ 1.6.9. Why a CORS bug matters more here than on most apps, the chain in order, and keeping Langflow off the internet.
Drupal Core SQL Injection Vulnerability Actively Exploited: What You Need to Know
An unauthenticated SQL injection in Drupal Core, KEV-listed and exploited. Drupalgeddon worked through as the still-relevant example (attacker-controlled array keys becoming SQL), how to pin your exact version and advisory, the access-log and webshell hunts, and why "patched" and "not compromised" are two different questions after this one.