Skip to content

Obsession

The topics we keep coming back to.

7 categories, 106 tags, 52 articles, because nobody ever agreed on what to call anything. A category opens its own page, a tag filters in place.

Frontend Architecture21Security12AI Development08Red Team04AI SecOps03Blue Team03Reverse Engineering01
A dark Egnworks banner representing malicious instructions taking control of an AI coding agent.

Reverse Engineering

DUSTMAKER Malware Hijacks AI Coding Agents

Reverse engineer how DUSTMAKER turns trusted AI coding files and CI workflows into execution, credential theft, persistence, and propagation paths.

Jacob Strix

A dark Egnworks security banner representing malicious style data crossing into Magento template execution.

Security

CVE-2026-75650 StyleSmuggler Magento RCE

A technical analysis of CVE-2026-75650, the actively exploited Magento template injection that gives unauthenticated attackers remote code execution.

Jacob Strix

A Red Team visualization of one compromised Windows cluster node exposing every connected node and virtual identity.

Red Team

Own One Node, Own the Cluster

A Red Team analysis of how WSFC identities, RBCD, shared secrets, and BloodHound paths turn one compromised node into cluster-wide control.

Jacob Strix

A Red Team banner depicting two Active Directory identities converging inside a Kerberos authentication path.

Red Team

ResetNightmare: When a Writable UPN Becomes Domain Admin

A technical Red Team analysis of ResetNightmare, where writable UPN attributes, Kerberos name confusion, and kpasswd can create a domain takeover path.

Jacob Strix

A dark security operations banner representing an encrypted relay connecting a hidden Linux backdoor.

Blue Team

Inside the GSocket Backdoor

Attackers turn a legitimate encrypted relay into a persistent Linux backdoor. Dissect GSRN, process masquerading, secret files, and host detection.

Jacob Strix

A dark generated banner with a luminous sphere represents command-and-control traffic outside DNS visibility.

Blue Team

The C2 Traffic DNS Security Never Sees

Direct-to-IP malware bypasses DNS controls entirely. Build a TTL-aware detector that correlates Zeek DNS answers with outbound connections.

Jacob Strix