Detection-engineering walkthroughs, threat analysis, and mitigation guides. Sourced, reproducible, and defensive in scope. Nine published so far - this index grows as writeups ship.
CVE-2026-72898 turns Metabase's password reset endpoint into unauthenticated administrator access, and a BI tool is pre-joined access to everything it is credentialed to reach. Patch available 6 August, intrusion 10 August, CISA KEV 11 August, data gone 27 August. The timeline, what the CVSS vectors predicted, a Sigma rule and a hunt, and why this was an inventory failure rather than a patching one.
N-central is the RMM platform your MSP uses to manage your fleet, and in early August 2026 two authentication bypasses in it were exploited in the wild. You cannot patch someone else's server - but every artifact the operators left behind ran on your machines. The timeline, what the advisories actually tell you, endpoint-side detections, and the questions to put to your provider this week.
SafePay is a centralized ransomware crew now claiming Australian victims, and real-estate agencies fit its target profile almost perfectly - data-rich, cash-handling, thinly defended, and spread across franchise offices under one brand. The playbook stage by stage - edge devices, infostealer-harvested logins, living-off-the-land movement, commodity exfiltration - mapped to the Essential Eight controls that break each link.
INC Ransom is a RaaS crew actively claiming Australian victims, and the firms it lands on look a lot like yours. The affiliate playbook stage by stage - phishing, unpatched edge devices, bought credentials, living-off-the-land movement, commodity exfiltration - mapped to the Essential Eight controls that break each link in the chain.
The moment you give a model tools, its output stops being text and becomes actions. The agent threat surface - excessive agency, indirect injection via tool output, the MCP supply chain, the confused-deputy identity problem - what to log, and the detections and containment architecture that keep one bad instruction from becoming an incident.
An authenticated command injection in LiteLLM's MCP preview endpoints - in CISA KEV and actively exploited - that chains with the Starlette "BadHost" bug (CVE-2026-48710) into unauthenticated RCE. The mechanism, what to log, and two runnable Sigma rules with tuning notes.
The OWASP LLM Top 10 read as a defender's checklist: why prompt injection has no patch, the "lethal trifecta" behind incidents like EchoLeak (CVE-2025-32711), what to log in LLM-integrated apps, and canary, egress, and behavioral detections you can deploy today.
The phishing class that never asks for a password and sails through MFA - illicit OAuth consent grants (MITRE ATT&CK T1528) in Entra ID, the audit-log artifacts they leave, and KQL detections with tuning notes.
How Kerberoasting (MITRE ATT&CK T1558.003) works, why RC4 service tickets give it away, and three layered Sigma detections - RC4 downgrade, request fan-out, and a honeypot SPN - with tuning and false-positive notes you can run against your own logs.
New writeups ship as the threats worth covering surface. Want to suggest a topic, request a detection, or flag an error in what's published? Open an issue →