Cloud engineer by day, security researcher by habit. Background in pen testing, bug bounties, and security engineering at scale. Mostly self hosted, and write about what actually works for privacy and security , testing a lot of stuff along the way.
News
A maintained reference of critical vulnerabilities, security incidents, and industry shifts covered on this site. Organized by year. Each entry has the essential facts, current status, and what to do about it. 2026 CVE-2026-24061 — GNU InetUtils telnetd Authentication Bypass (February 2026) Severity: 9.8 Critical · Status: Patched in
Security
DarkSword is a six-vulnerability iOS exploit chain that silently compromises an iPhone the moment a vulnerable device loads an infected page — no tap, no download, no warning. Lookout Threat Labs identified at least three separate hacking groups deploying it against real targets; the full exploit code leaked to GitHub
Privacy
One company now owns four of the most heavily marketed VPN brands — ExpressVPN, Private Internet Access, CyberGhost, and ZenMate — and in early 2026, that company went fully private. No more public stock filings. No transparency reports that anyone outside can independently verify. What you need to know: * Kape Technologies (formerly
Privacy
Every VPN homepage says the same thing. No logs. Military-grade encryption. Your privacy, guaranteed. Finding the best VPN for privacy in 2026 is harder than it should be because the marketing is indistinguishable across the entire industry. What actually separates a trustworthy VPN from a marketing exercise is audit
Guides
Ghost removed its native Kit integration. Zapier's Ghost trigger is broken on self-hosted v5+. Here's how to wire Ghost members directly into Kit using n8n — free, self-hostable, ten minutes.
Guides
A production-ready n8n install on a Linux VPS — Docker Compose with PostgreSQL, nginx reverse proxy, SSL, firewall rules, and correct persistence so nothing breaks on restart.
Guides
Most people set up a password manager, feel good about it, and never open the health reports. The weak passwords they imported from Chrome in 2021 are still in there. The reused credentials spread across five accounts are still in there. The manager organized the problem — it didn't
Guides
The gap between Apple's privacy marketing and what iOS actually does — and the settings that close it. Covers ADP, Siri data transmission, ATT limits, and the UK ADP removal story.
Guides
Shodan indexes every open port and service banner on the public internet. Here's how to use it to see what your own servers are exposing — before someone else does.
Guides
theHarvester pulls emails, subdomains, and IPs from public sources in seconds. Run it on your own domain and you might not like what you find.
Guides
Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. Run it on a $5 VPS and your passwords never touch someone else's infrastructure.
TOTP and push MFA are bypassed at industrial scale. Hardware keys aren't. Here's which YubiKey to buy and how to set it up on every account that matters.