Microsoft has fully remediated a CVSS 10.0 remote code execution flaw in Entra ID caused by unsafe deserialization, detailing the vulnerability’s origin, affected services, timeline, related high‑severity bugs, and offering blue‑team detection and response guidance.
The article analyzes common Nginx privilege‑escalation attack chains, enumerates vulnerable CVEs and configuration mistakes, and demonstrates how the Safedog HIDS detects each stage—from web‑shell upload to SUID abuse—while providing step‑by‑step remediation and verification procedures.
In 2025, twin brothers with prior cyber‑crime convictions exploited a privileged‑account gap at a federal‑service contractor, erased 96 government databases within six minutes, used AI to seek log‑clearing methods, and triggered a multi‑layered forensic and legal response that highlights critical gaps in identity‑access management, backup integrity, and insider‑threat detection.
This guide shows how to use AWS CLI and CloudWatch Agent to automatically collect, centralize, and alert on EC2 SSH login events, providing a reproducible security‑audit solution that turns invisible system activity into searchable, actionable cloud data.
The article explains how to enable Kubernetes audit logging and use its detailed fields—such as userAgent, responseStatus, requestURI, and object references—to detect CDK‑generated attacks and other threats like CVE‑2022‑3172, privilege escalation, and backdoor deployment, offering practical detection examples and security recommendations.
This article examines the evolving security risks of cloud‑native architectures, explains why traditional perimeter defenses are insufficient, introduces zero‑trust principles for Kubernetes, outlines common K8s threat vectors, and presents a complete data‑collection and monitoring solution based on the open‑source iLogtail agent.
This article explains what log auditing is, why a unified audit platform is essential for compliance and security operations, outlines its core goals, main functions such as unified collection, correlation analysis, real‑time alerts, forensic reporting, and describes typical deployment architectures and modules.
This article presents a comprehensive design of a real‑time security monitoring and alert platform, detailing challenges in high‑concurrency risk control, an architecture that replaces OLAP polling with scalable compute services, event‑time processing, dynamic thresholding using fbprophet, and practical optimizations with Redis and ClickHouse.
This article introduces GSIL, a near‑real‑time GitHub sensitive‑information‑leakage monitoring tool, and provides step‑by‑step instructions for installing the Python package, configuring email and GitHub token settings, defining scanning rules, and scheduling automated scans and reports via cron.
This guide walks through setting up a comprehensive security log collection pipeline—covering WAF, firewall, and Nginx logs—using ELK, Logstash, Kafka, and Flume, and then configuring real‑time alerts with Sentinl or ElastAlert integrated with DingTalk and email notifications.
This article explains the fundamentals of Kubernetes audit logs, their JSON format, recording stages and levels, and shows how to configure policies, analyze logs, and use Alibaba Cloud's integrated solution to create visual reports, custom alerts, and advanced queries for security monitoring.
A sudden 50% server load increase was traced to a malicious PHP file uploaded via an Nginx %00 null‑byte vulnerability, revealing how the exploit works, how it was detected, and steps to prevent future attacks.
