Unauthenticated full account takeover in Keycloak's reset-credentials flow (CVE-2026-18963, CVSS 9.1) - a sticky form-flag defect chained with an action-token check that never verifies the email link. Manual walkthrough plus a patched control.

A practical guide to patching vulnerabilities in Go modules, covering different scenarios and utilizing Go-native tooling like govulncheck.

An introduction about Code Review Security in Python

A step-by-step guide to setting up NVIDIA CUDA for Hashcat password cracking on Ubuntu.

Secure access to services running inside a Kubernetes cluster using Cloudflare Zero Trust - useful for Dev teams requiring testing without exposing development environments.