Field notes
On 1 June 2026, the Kubernetes Security Response Committee updated CVE records for older unfixed issues so scanners and operators see accurate affected-version information. The project blog "Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs"…
Kubernetes v1.36 made pod user namespaces generally available, and that is worth adopting. It is also worth refusing hype. User namespaces are necessary for serious multi-tenant node security; they are not sufficient. This article explains residual…
By mid-2026, cloud-native security conversations keep returning to two stubborn themes: shared-kernel escape risk and the concentration of power in GitOps and secret operators. This article stays high-level and practical. Where public reporting is noisy or…
Kubernetes v1.36 graduates fine-grained kubelet API authorization to GA. That matters because many monitoring agents historically needed the blunt nodes/proxy permission—the same broad key that covers powerful endpoints—to read comparatively innocent surfaces like pod lists or…
Mixed cloud estates are the default for growing engineering companies: a primary public cloud for product workloads, a second provider for resilience or acquisitions, a handful of SaaS platforms that hold customer data, and leftover on-prem…
Email remains the most successful fraud and malware transport for many organizations—not because filters are useless, but because identity, business processes, and DNS authentication are misaligned. SPF, DKIM, DMARC, and BIMI are necessary pieces of an…
Tabletop exercises fail when they become theater: a slide deck, a hypothetical so vague nobody sweats, and action items that die in a shared folder. They succeed when they are short, specific, and uncomfortable enough to…
APIs are where modern products meet the internet—and where authorization bugs quietly become data breaches. A secure API is not a gateway plugin checklist. It is a baseline that covers authentication, authorization, and abuse controls as…
Traditional VPNs grant a wide network path once a user authenticates—often more path than the task requires. Attackers who phish VPN credentials inherit that width. Zero trust network access (ZTNA) and related secure remote access patterns…
Threat hunting does not require a dedicated research org or a lake full of exotic telemetry. Many high-value hunts are structured questions you can ask weekly with logs you already have: identity, endpoint, cloud audit, email,…