Security
Why MFA Isn't Enough — and What Attackers Do When It Fails
MFA stops most attacks. Not all. Here's what attackers do when they can't beat your second factor — and what actually makes accounts hard to compromise.
Frankline Wegulo
Cloud engineer by day, security researcher by habit. Background in pen testing, bug bounties, and security engineering at scale. Mostly self hosted, and write about what actually works for privacy and security , testing a lot of stuff along the way.
Security
Crypto Thieves Are Mailing Letters Now. Your Address Came From a Breach.
Trezor and Ledger users have been receiving physical letters with QR codes designed to steal seed phrases. The addresses came from breach data that's been circulating since 2020 — and refreshed by a second leak in January 2026.
Going Passwordless in 2026: What Actually Works, and What Still Doesn't
Passkey adoption has hit real numbers — 800 million Google accounts, Amazon's 175 million users, Microsoft making them the default. Here's what going passwordless actually looks like in practice, and where the friction still is.
Security
The First 24 Hours on a New VPS
Six things to run on any fresh Ubuntu or Debian VPS before you do anything else — in the correct order, with the reasoning behind each step.
Security
CrowdSec: Open-Source IPS With a Crowd-Sourced Brain
CrowdSec is a free, open-source intrusion prevention system that shares threat intelligence across every instance running globally. This guide covers installation, bouncers, configuration, and everything in between.
Security
Google API Keys Were Public by Design. Then Gemini Arrived
Google told developers their API keys weren't secrets — and they were right, until Gemini launched on the same key infrastructure. Truffle Security found 2,863 exposed keys in the wild, including on Google's own websites.
Takes
6 Everyday Devices That Track You — And What to Do About It
You already know your phone tracks you. That's table stakes at this point. But what about your car? Your smart TV? The robot vacuum quietly circling your living room? These are not hypothetical threats. Real companies have sold real data on real people — sometimes without their knowledge, sometimes
Privacy
Ring's Super Bowl Ad Was a Feel-Good Story. The Tech Behind It Might Be Something Else
Ring ran a Super Bowl ad this year about finding lost dogs. The technology they were advertising scans your neighborhood's cameras in real time using AI, it's on by default, and Ring is already planning to expand it beyond pets. They said the feature was "
Privacy
Your Browser Has a Face. Advertisers Know It.
In 2019, Google published a blog post calling browser fingerprinting "wrong." Their exact words: it "subverts user choice." They positioned themselves as advocates for a more private web — the company fixing tracking, not enabling it. In February 2025, Google announced that advertisers on its network can
Privacy
The Devices in Your Home Are Listening — Here's What They Actually Do With It
Something about the Apple settlement that doesn't get discussed enough: the conversations Siri captured weren't edge cases. They were the kind that happen when you forget the device is there — which, with always-on assistants, is most of the time, which is exactly the problem. The
Security
What AI Chatbots Actually Do With Your Data (And What You're Silently Agreeing To)
Someone's therapy session ended up in Google's search index last summer. Not because they were hacked. Not because OpenAI had a breach. Because they clicked a Share button — the one ChatGPT had quietly added to conversations — without realizing that "sharing" could mean "publicly
Security
Fortinet's Critical SSO Bypass Vulnerability
Fortinet has recently confirmed active exploitation of a critical authentication bypass vulnerability in its FortiCloud Single Sign-On (SSO) service. Despite an earlier patch, attackers are successfully compromising FortiGate firewalls, prompting urgent action from affected organizations globally. Understanding the Vulnerability The vulnerability, tracked as CVE-2025-59718 and CVE-2025-