PageIndex: Reasoning-Based Retrieval for Security Intelligence
How document trees can improve investigations, preserve evidence and support attack-path analysis without granting retrieved content authority over access or actions.
Latest Articles
24 articles · newest first
CVE-2026-2270: When StatefulSet History Crosses a Namespace Boundary
Trace the StatefulSet confused-deputy flaw from ControllerRevision data to cross-namespace pod creation: affected versions, patch anatomy, RBAC checks and detection evidence.
Docker Layers Are Not a Secret Vault: Build Clean, Run Confined
Trace deleted secrets through image layers, isolate build credentials with BuildKit, design multi-stage images and constrain runtime capabilities before they become host-access paths.
Shrink, Scan, Confine: A Container Hardening Playbook from Base Image to Unikernel
Minimal base images and distroless trade-offs, slim and unbase_oci minification, signed supply chains, separating real CVEs from scanner noise, least-privilege runtime controls with Secrets Store CSI and Istio, alert triage, and unikernel isolation with urunc.
Docker's Layered Model: Secrets, Multi-Stage Builds and Runtime Capabilities
Why deleting a file in a Docker layer never removes the bytes, how multi-stage builds and BuildKit secret mounts keep credentials out of the image, and how over-granted Linux capabilities turn a clean image into a host escape.
Kubernetes 1.37 and Kyverno 1.19.1: A Security Hardening Blueprint
Turn Kubernetes 1.37 identity and storage improvements plus Kyverno 1.19.1 policy controls into a tested, fail-closed cluster hardening program.
2026 Container Image CVE Blocklist: Build a CI/CD Gate That Fails Closed
A verified CVE ledger, a testable promotion gate, and the boundaries an image scan cannot cover—from base libraries to container runtimes and CI controllers.
Hermes Agent CVE Chain: GitSpawn RCE, Session Authorization and SSRF
A source-grounded analysis of four Hermes Agent CVEs: the verified GitSpawn command-execution path, adjacent session and URL-fetch boundaries, detection evidence and hardened deployment controls.
The Anatomy of a Modern Agentic Attack
Trace an agentic attack from untrusted input to tools, delegated identities and Kubernetes—and distinguish a model proposal from an independently proven effect.
Argo CD: When GitOps Becomes a Data-Breach Bridge
Separate real Argo CD vulnerabilities from dangerous configuration, trace token authority into Kubernetes, and review the controls that break each attack path.
GitLab 2026: File Read, Credential Exposure and the RCE Boundary
Understand the September GitLab flaws without conflating them: affected releases, a version checker, conditional attack paths, detection priorities and a 2026 advisory timeline.
JFrog Artifactory Under Attack: CVE Routes & Supply-Chain Risk
An interactive investigation map, read-only runbook and practical controls linking registry authority to artifact trust and workload evidence.
containerd Under Fire — Chaining the July 2026 Runtime CVEs
How CRI checkpoint and image-config flaws combine into a node-level container runtime attack path.
Docker AuthZ Bypass CVE-2026-34040
When a truncated authorization request and the full daemon request create a fail-open security layer.
Malicious Admission Webhooks — the Cluster Backdoor in Plain Sight
How admission configuration can observe Secret writes, mutate workloads, or disable defenders cluster-wide.
PKI, Certificates & Secrets on OpenShift
Mapping platform trust domains, the application-PKI gap, and cert-manager integration patterns.
Workload Confinement on OpenShift — SCC + SELinux
How admission-time Security Context Constraints and runtime SELinux boundaries compose—and where they break.
AKS Privilege Escalation CVE-2026-33105
Auditing an improper-authorization flaw across the managed Kubernetes trust boundary.
Kubernetes Audit Logs: Detect Attacks Before It Is Too Late
Turn API-server audit logs into high-signal detections for pod exec, secret access, RBAC escalation, privileged workloads, persistence, and SIEM correlation.
Lateral Movement on Kubernetes
Flat pod networking, over-permissive service accounts, weak egress controls, and missing NetworkPolicies turn one compromised workload into a cluster-wide attack path.
NGINX Rift CVE-2026-42945: What to Check in Ingress NGINX
The bug lives inside NGINX native C rewrite logic, not the ingress-nginx Go controller. Check the rendered nginx.conf, rewrite shape, NGINX version, ASLR posture, and admission controls.
Start Securing Your Pods: Seccomp, SELinux, Secrets & the Misconfigurations That Undo Everything
Every cluster-level control you’ve hardened is meaningless if the pod spec hands attackers the keys.
Kubernetes Compliance: CIS Benchmarks, NSA/CISA Hardening, and What Actually Matters
Not all 200+ CIS controls matter equally. Security-first prioritization ranked by real-world exploitability — not auditor comfort.
Nginx Ingress Controller: Migration & Security Guide
Production-grade migration path for Nginx Ingress on Kubernetes — TLS configuration, annotation hardening, rate limiting, and the security misconfigurations that expose clusters.
No articles match these filters.