Everything

Sharing this for anyone that may find it helpful.

• 
  I Passed MCRTA - A Beginner Cloud Red Team Exam4?5 November 2026

  I passed CyberWarFare Labs' MCRTA exam. I found it very easy, but useful for introductory cloud attack practice alongside my Google Cloud certification studies. I paid $29 on discount.

• 
  How I Passed Google’s Professional Cloud Security Engineer Exam Using AI

  How I used AI questions and feedback to prepare for Google PCSE, what made the exam difficult, and what I would recommend to other candidates.

• 
  Building a DevSecOps Pipeline with GitHub Actions

  How my GitHub Actions security checks fit together, what their reports establish, and why enforcing a deployment gate and adopting GitOps remain separate steps.

• 
  Google Cloud Cybersecurity: The Labs Made It StickLearning notes

  A red teamer's take on five Google Cloud cybersecurity courses, the practical labs, and the data breach exercise that made recovery feel real.

• 
  How Does an AI Agent Get Its Identity?Day 14 of 100 · AI cybersecurity

  Follow Pip from its first login to its next delegated task: who gives an agent access, how OAuth works, and why a valid token can still do the wrong thing.

• 
  Why Kubernetes Exists: From One Container to Forty Servers

  Docker solved how to package and run an application. Kubernetes helps keep many copies running across servers when things change or fail.

• 
  How to Sandbox an AI Agent: Linux Boundaries and Real RisksDay 13 of 100 · AI cybersecurity

  Where an agent's code runs, what Linux isolation can enforce, how to choose a boundary, and what real incidents crossed.

• 
  How to Build an Agentic Vulnerability Research Harness (Like the Pros)Day 12 of 100 · AI cybersecurity

  A proposed agentic vulnerability-research architecture: map trust boundaries, constrain execution, and require reproducible evidence while keeping local fixture results distinct from discovery performance.

• 
  Deeper into the OpenAI HACKING & HACKED!!Day 11 of 100 · AI cybersecurity

  A reading of the Hugging Face investigations: reward design, response gaps, and what the available reports can and cannot establish.

• 
  Agent Swarms Are Here, and I Don't Think We're ReadyDay 10 of 100 · AI cybersecurity

  The Hugging Face incident started as a security evaluation, but what stayed with me was the agents finding one another and working together.

• 
  The Evolution of Penetration TestingDay 9 of 100 · AI cybersecurity

  I used to spend most of my time testing web applications. My first look at AI pentesting products suggests the market is moving from point-in-time reports toward continuous, context-rich security testing.

• 
  MCP Attacks on Xata and GitHub MCP: Read-Only Bypass and Issue InjectionDay 8 / 100 · AI cybersecurity

  Two MCP lab walkthroughs: a read-only SQL bypass, a GitHub issue injection, and the model refusals and fixture changes that limited what the results established.

• 
  The MCP confused deputy problemDay 6 / 100 · AI cybersecurity

  A hands-on MCP lab showed how a valid tenant key can still retrieve another tenant's project when the server never checks resource ownership.

• 
  MCP security labs: path bypasses and poisoned tool responsesDay 7 / 100 · AI cybersecurity

  Two MCP labs showed different failures at the same boundary: a filesystem server trusted a string prefix, while a facts server poisoned the agent's next tool call.

• 
  MCP security: when prompt injection gets a toolDay 5 / 100 · AI cybersecurity

  MCP makes it easier for AI systems to use external tools. It also connects model behaviour to permissions, private data, and real actions.

• 
  Poisoning an AI assistant's memoryDay 4 / 100 · AI cybersecurity

  Lakera's MindfulChat challenge made persistent memory feel like a real application attack surface, not just a model prompt.

• 
  An interactive playground for LLM security testingDay 3 / 100 · AI cybersecurity

  I worked through an interactive OWASP LLM Top 10 playground and found a useful starting map, a few strong concepts, and several labs that needed more explanation.

• 
  Web LLM attacks, deeper into indirect prompt injectionDay 2 / 100 · AI cybersecurity

  Indirect prompt injection and insecure output handling showed me that an LLM can turn ordinary application content into an attack path.

• 
  Web LLM attacksDay 1 / 100 · AI cybersecurity

  Mapping an LLM's tools first turned two PortSwigger labs into the same repeatable web-testing method.

• 
  Building and breaking mobile applications2024

  I spent a year at EY breaking mobile apps, then built one at MacroScope and had to defend against everything I used to find. The one lesson that carried across both sides.

• 
  Senior in 18 months, and a red team built from nothing2022

  How I got onto a red team that did not exist yet, and the printer that got us onto a network that thought it was locked down.

• 
  My first offensive security job2021

  I applied for one job, had one interview, and got it. What the first year of pen testing actually looked like.