Knowledge Base
Showing 24 of 362 guides. Use the numbered pages to browse the complete archive.
Kernel TLS trades a process boundary for throughput: the record parser that handles every byte a remote peer sends runs in ring 0. Here is what that buys, what it costs, and how to tell if you use it.
Blocking a vulnerable kernel module buys time before a reboot, but only if it is done the right way and you know what it disables. A step-by-step guide with the decision points spelled out.
Exploited kernel bugs now arrive with 72-hour deadlines and every one needs a reboot. How to pay down reboot debt, ring your fleet, and do forensic triage without missing the window.
On a multi-tenant host the attacker is already logged in. Seven steps to keep a compromised customer account from becoming a compromised server: inventory, restricted shells, audits, detection.
The software that can read and restore everything can also take everything. What a compromised backup agent gives an attacker, why it escapes review, and how to put it on the privileged asset list.
A privileged process, content it trusts, and a location an ordinary user can write to. That is the whole bug class behind CWE-276, and why it keeps surfacing in agents that run as root.
Infrastructure ACLs only work if you know every listener an appliance exposes. Six steps to enumerate API surfaces, map their authentication, enforce reachability upstream, and log access off the box.
A firewall decides what crosses one boundary. A NAC server decides who may exist on the network and what every switch enforces. Root on it is ownership. How to plan for that day.
Appliances have one login page and dozens of API doors. When a single endpoint skips its authentication check, the page becomes decoration. Why the bug class behind the Cisco ISE zero-day recurs.
The fastest way to survive a vCenter zero-day is to make the appliance unreachable. Segment the management interfaces, force access through a jump host, filter egress, and monitor the little traffic that remains.
One bug in a management appliance ended with ransomware on every workload. The cause is not a chain of exploits but the trust model that makes vCenter useful: root on the appliance is authority over the estate.
Attacking ESXi instead of individual VMs collapses the math: one host holds many workloads, the guest's defenses do not apply, and only backups the attacker cannot reach save you.
SQL injection is filed under data theft, yet on an appliance it routinely ends in a root shell. The database engine's own file and program features are the bridge, and privilege is the only gate.
The vendor's grep command is where the check starts, not where it ends. A root-level attacker can edit the appliance's logs, so the real evidence lives in egress, directory, and flow data.
A mail gateway must parse arbitrary content from strangers before it can decide anything about it. You cannot firewall that surface, so planning has to focus on what a successful exploit reaches.
Site-to-site VPN peers have known addresses, yet most firewalls accept IKE from the whole internet. Here is how to replace implied rules with explicit peer allowlists and verify the change.
Automatic in-memory patches shrink the exposure window for edge devices, but they skip end-of-life releases, need verification, and cannot undo a prior compromise. Plan for the gaps.
A VPN gateway must decode a peer's certificate before it can trust the peer. That ordering makes the ASN.1 parser reachable by anyone on the internet, and it is where two classic bug types live.
Remote-access tools are built to run code on other machines. When the authorization check fails, a trusted file-transfer feature becomes a malware pipeline. Here is how and why.
When attackers abuse your remote-support software, the activity hides in normal-looking sessions. Learn where to hunt in audit logs and endpoint telemetry to catch it.
Cleaning one host at a time loses to malware that reinfects as you go. Here is why worm-like threats demand you cut the spread first, then rebuild.
Path traversal turns a filename parameter into a read of any file the server can open. Learn why filters fail, what confinement means, and why a file read can be a full compromise.
Public projects give anonymous users an API surface on your GitLab server. Here is how to inventory them, reduce the set, and stop new ones from appearing without an admin.
A CI/CD server holds the keys to every environment it deploys to. Here is why an information-disclosure bug on GitLab is a credential-theft event, and how to limit the blast radius.