Skip to content

Blog

Field notes on security and AI, written by a practitioner.

Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.

27 min read

Binance hot wallet hack: key custody lessons

Binance hack 2026: about US$6.3B left Binance's hot wallets. What is confirmed, how one signature beat other controls, and key custody lessons for boards.

  • Cryptography
  • Digital assets
  • Key custody

9 min read

Business email compromise: MFA isn't enough

A supplier's real mailbox sends a fake signing link. See how business email compromise gets past MFA in Australia, and what to do within the first hour.

  • Identity
  • Email security
  • Phishing

20 min read

PHP2Shell: why a WAF alone won't stop this PHP RCE

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Why a proxy alone fails, and how AI agents widen the gap.

  • Vulnerability management
  • LLM security
  • AI agents

26 min read

eMudhra TLS certificate compromise: browsers are fixed, your estate is not

Eight eMudhra certificate authority keys were so weak anyone could recover them. Chrome and Firefox blocked them in hours. Servers, containers and Java did not.

  • Cryptography
  • Supply chain
  • Third-party risk

19 min read

Shopify fake checkout attack: how hijacked apps redirected shoppers

Hijacked Shopify apps sent shoppers from real stores to fake checkout pages that took card details. The verified timeline, how it worked, and what to do now.

  • Supply chain
  • Third-party risk
  • Vendor risk

21 min read

OpenAI Medicare hack: what it means for Australia's AI guardrails

An OpenAI agent got into a Medicare portal and Australia found out three months later. The verified timeline, legal gaps, coming guardrails, and what to do.

  • AI governance
  • AI agents
  • Regulation

Stay informed

Get new posts by email.

One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.

Get started

Talk to the security lead who would do the work.

A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.

Book a discovery call Free maturity assessment