Author

Alex Kim

Threat intelligence editor

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim (121)

Illustration of ephemeral workload credentials replacing long-lived API keys in non-human identity management

Non-Human Identity Management: Why Ephemeral Credentials Are Replacing Static API Keys

Service accounts, CI/CD runners, workload certificates and AI-agent principals form a sprawl traditional joiner-mover-leaver programs never governed.

Conceptual illustration of a Jenkins-style CI/CD controller at the center of a software factory, with pipeline lines to code, cloud, and artifacts and a cracked supply-chain link on one plugin package

Cloud Security Research

Jenkins Plugin Security: Hardening the CI/CD Supply Chain Before Attackers Do

*A conceptual view of Jenkins as the high-privilege control plane of the software factory—and of plugins as the supply-chain links that can break it.*

Illustration of the DarkSword pure-JavaScript Safari watering-hole full chain on iOS 18, from compromised site to kernel and hit-and-run exfil

Cloud Security Research

DarkSword: Pure-JavaScript iOS 18 Watering-Hole Full Chain Used by Multiple Actors

The chain moves from Safari RCE through sandbox escape to kernel read/write, exfiltrates data within minutes, then cleans up and exits with no user interaction.

On-premises SharePoint Server farm under active incident response for a zero-day privilege-escalation exploit

Cloud Security Research

Microsoft SharePoint Zero-Day CVE-2026-56164 Under Active Attack: On-Prem Farms Face Unauthenticated Privilege Escalation

Microsoft and CISA confirmed exploitation on 14 July 2026 and shipped same-day patches. SharePoint Online is unaffected; self-hosted farms need action now.

Illustration of enterprise DHCP server infrastructure under elevated risk during Microsoft July 2026 Patch Tuesday

Cloud Security Research

Microsoft July 2026 Patch Tuesday Hits Record 622 CVEs With Critical DHCP Server RCEs

Roughly triple June's previous record, the release is led by CVE-2026-50518, an unauthenticated Windows DHCP Server RCE rated Exploitation More Likely.

Illustration of an on-premises Dynamics NAV and Business Central ERP server under unauthenticated remote code execution risk via a crafted login path

Cloud Security Research

CVE-2026-55944: Critical Unauthenticated RCE Hits Microsoft Dynamics NAV and Business Central On Premises

Patched in the record July 2026 Patch Tuesday, the flaw puts finance, supply-chain and operations systems at risk wherever ERP login endpoints remain reachable.

Editorial illustration of an AD FS server with a forged SAML assertion hovering above it in a data center

Golden Saml Research

Why Golden SAML Still Haunts Hybrid Identity: Hardening AD FS Token-Signing Keys and DKM Access

Golden SAML still threatens hybrid identity via AD FS token-signing keys. Learn how to harden DKM access, detect key theft, and lock down federation servers.

Illustration of chained SonicWall SMA1000 zero-days CVE-2026-15409 SSRF and CVE-2026-15410 code injection from internet exposure to full appliance compromise.

Cloud Security Research

SonicWall SMA1000 Zero-Days CVE-2026-15409 and CVE-2026-15410 Actively Exploited; Patch Alone Is Not Enough

CISA set a July 17 remediation deadline, but patching alone leaves an already-compromised appliance in place — credential rotation and hunting are mandatory.

Desks covered

Operations Research

Latest

Sep 12, 2026, 12:37 PM EDT · Research · Mlx12 minMLX vs llama.cpp on Apple Silicon: Which Local LLM Runtime to Actually Use

One is a portable inference engine, the other an array framework that also trains — and that single difference settles almost every practical question.

Sep 12, 2026, 12:37 PM EDT · Operations · Llm Evaluation14 minHow to Build an LLM Evaluation Harness That Catches Real Regressions

Public benchmarks only shortlist a model; your own cases decide whether to ship it. Here is the dataset, the scorers and the CI gates that catch real drift.

Sep 12, 2026, 12:37 PM EDT · Research · Prompt Caching11 minPrompt Caching Explained: Cutting Agent Costs Without Touching the Model

Your agent re-sends the same long prefix on every step and pays to recompute it. Here is the KV mechanism, the ordering rule it forces, and the break-even math.

Sep 12, 2026, 12:37 PM EDT · Research · Speculative Decoding11 minSpeculative Decoding and Multi-Token Prediction: How LLMs Generate Faster

Decode is memory-bound, so checking several tokens in one pass is nearly free. Here is the mechanism, the arithmetic behind it, and why quality never moves.