How to Write Kubernetes NetworkPolicies: Default Deny to Egress (2026)
Step-by-step Kubernetes NetworkPolicy guide for 2026: default deny, allowing DNS, namespace and pod selectors, egress control, Cilium and Calico support, ClusterNetworkPolicy v1alpha2, testing with netshoot, and a troubleshooting table for blocked traffic.
14 minOct 20, 2026GitHub Actions Security in 2026: 76 Hijacked Tags and the Fixes That Work
GitHub Actions security in 2026: what tj-actions, trivy-action, TanStack and issues-helper taught us about mutable tags and pull_request_target, plus SHA pinning policy, workflow lockfiles, immutable releases, attestations, zizmor and the new runner prices.
13 minOct 20, 2026How to Use GitHub Actions OIDC With AWS, GCP and Azure (2026)
Step-by-step GitHub Actions OIDC setup for AWS, Google Cloud and Azure with no stored secrets: trust policies pinned to sub claims, immutable subjects, environments, pinned actions, and fixes for sts:AssumeRoleWithWebIdentity, audience and AADSTS700213 errors.
14 minOct 20, 2026How to Detect Runtime Threats with Falco on Kubernetes (2026)
Step-by-step Falco 0.45 setup on Kubernetes: Helm chart 9.2.0 with the modern eBPF driver, default and custom rules, Falcosidekick alerts to Slack, tuning noise, Falco Talon response actions, drop metrics, and a troubleshooting table for driver errors.
15 minOct 20, 2026How to Use External Secrets Operator with Vault on Kubernetes (2026)
Step-by-step External Secrets Operator v2.13 setup with HashiCorp Vault, OpenBao or AWS Secrets Manager: Helm install, Kubernetes auth, ClusterSecretStore, ExternalSecret, rotation and reloads, ESO's 2025 release pause, alternatives, and fixes for SecretSyncedError.
14 minOct 20, 2026Hardened Container Images in 2026: DHI Free, Bitnami Gone, 515 CVEs to 0
Container base images in 2026 compared: Docker Hardened Images went free under Apache 2.0, Bitnami moved its catalog to bitnamilegacy, Chainguard cut its free tier to five images, and a grype scan of 12 base images found 515 CVEs in python:3.13 and zero in four minimal images.
12 minOct 20, 2026How to Scan Container Images with Trivy and Grype (2026)
Step-by-step guide to scanning container images with Trivy v0.76 and Grype v0.121: verified installs after the March 2026 Trivy compromise, image and SBOM scans, CI gates on fixable criticals, .trivyignore, VEX, and fixes for DB download errors.
12 minOct 20, 2026How to Set Up cert-manager with Let's Encrypt and Fix Errors (2026)
Install cert-manager v1.21 with Helm, create Let's Encrypt ClusterIssuers for HTTP-01 (Gateway API or Ingress) and DNS-01, then debug a Certificate stuck not ready by walking CertificateRequest, Order and Challenge, with rate limits, ARI and alerts.
14 minOct 20, 2026AI Agent Failures in Production: 5 Incidents, 14 Failure Modes (2026)
What actually goes wrong when AI agents run in production: the Replit, Amazon Kiro, PocketOS and PromptPwnd incidents, the MAST taxonomy of 14 failure modes from 1,642 traces, cost loops, permission mistakes, and the guardrails that stopped them.
12 minOct 5, 2026Policy as Code for AI Agents in 2026: Cedar at the Gateway, Rego in the Hook, and the 11.2% the Model Still Lets Through
What actually enforces limits on AI agents in 2026: OPA 1.21 and Rego v1 after the founders moved to Apple, Cedar in Amazon Bedrock AgentCore Policy (GA 3 March 2026, 13 regions, default deny), Kyverno 1.19 retiring ClusterPolicy for CEL, Claude Code hooks that deny even in bypass mode, Codex's Seatbelt and bwrap sandboxes, the MCP 2026-07-28 authorization spec, and why none of it is optional while browser-agent injection success sits at 11.2% and OpenAI says the problem is unlikely to ever be fully solved. With a tested Rego policy and a Cedar policy for tool calls.
13 minOct 5, 2026CRA Reporting Went Live on 11 September: 24 Hours to ENISA, 3.08 Billion Rekor Entries, 17% of PyPI Attested, 92% SBOM False Positives
Supply-chain compliance in 2026: what the Cyber Resilience Act's Article 14 duty requires since 11 September 2026 (24-hour early warning, 72-hour notification, ENISA's Single Reporting Platform), what waits until 11 December 2027, how the open-source steward role works, where SBOMs stand (CISA's 2026 minimum elements, CycloneDX 1.7, a 92 percent false-positive rate in a 2,414-repo study), how far provenance has got (SLSA 1.2, 20 percent of PyPI uploads via trusted publishing, Rekor at 3.08 billion entries), the US retreat from mandates, and the pipeline I would run.
13 minOct 5, 2026AI SOC Agents in 2026: 98% Accuracy Claims, 23 to 34% on the Benchmark, and 0% of Teams Letting Them Act Alone
What the security-operations agents from Microsoft, Google, CrowdStrike, Palo Alto, SentinelOne, Torq and a billion-dollar startup cohort actually do in 2026 and what is measured: a median of 100 alerts a day and 28 percent never investigated, 75-minute mean investigations, Microsoft's $4-an-hour compute units and Google's token meter, CrowdStrike's 98 percent triage claim against Meta's 23 to 34 percent benchmark, Anthropic's and Google's reports of attackers running agents against defenders, and a Sigma rule and CI step that keep a human on the merge button.
14 min