Another day of Cybersecurity
On my way to another vulnerability (which was submitted to MSRC), I found vast misconfigurations and abuses in Azure IMDS.
What do you call a scenario where nothing is broken, yet everything is exposed? A bug, an abuse, or a … Read the rest
When you hunt for vulnerabilities long enough, you keep tripping over abuses hiding in plain sight. Some have been quietly farmed for years while others spill out of fresh features and rushed integrations. This piece lives in that messy middle, … Read the rest
We’re in 2026, and inbox persistence is still here, and it’s one of the core pillars of the Microsoft 365 attack playbook. Once an attacker lands in a mailbox, they don’t rush to chase noisy privilege escalation. They go for … Read the rest
Exchange Online’s split architecture creates blind spots that BEC operators have been quietly exploiting. This post walks through four distinct techniques for creating inbox rules that evade standard detection surfaces, then examines the evasion combinations that leave most SIEM stacks … Read the rest
I love middleware, if it’s on Cloud Vendor, AI components, etc. This time is the AI Desktop Middleware.
As you remember, in the old days, AI was merely a guest in a browser, maybe locked securely within a browser sandbox … Read the rest
