Basic Security

Latest — 01 May 2026

~60 Days as Root: A Practitioner's Take on the cPanel Pre-Auth Bypass

If you have spent any time around shared hosting, you have spent time around cPanel. I have been running into cPanel and WHM servers for longer than I care to admit, in just about every shape they come in: a single reseller box where someone wanted me to clean up

More issues

The Long Tail of External Asset Discovery: Enriching NodeZero EAD with Tenant-Specific Knowledge

External Asset Discovery is genuinely hard. The public attack surface of any organization is a moving target: domains registered last quarter, third-party SaaS endpoints provisioned this morning, certificates rotated yesterday. Any tool that promises to find all of it on its own is either oversimplifying or running on a budget

Ramblings from the field

I thought necessary to try and dump my thoughts here to share. Some for wisdom, some to help break up the monotony, and some to share pain of the process. The stories, lessons learned and otherwise personal feedback may help the next person. There will be a lot of random

More issues

Subscribe to Basic Security