Oh good, another multitenanted security control being bounded by namespace labelling in Kubernetes. What could go wrong? kubernetes.io/docs/concept..., h/t to @mccune.org.uk for pointing this out.

We've got a new blog out looking at Kubernetes versions in use in real-world clusters, and it's actually quite good news from a security perspective. securitylabs.datadoghq.com/articles/a-2...

You've got just over a week to contribute feedback for the new OWASP Kubernetes Top 10 docs.google.com/forms/d/e/1F... . Thanks to all the people who have taken the time to contribute already!

Just under a week left until kcduk.io, hosted this year in beautiful Edinburgh. If you haven’t got a ticket yet, there are still some available. I can guarantee some excellent company and talks. Weather may vary, but the city’s still pretty in the drizzle.

This is just great.

Please enjoy today, 25/9/2025, the last square date until 2116 (5^2/3^2/45^2).

My talk at @containerdays.bsky.social this week was on Kubernetes and post exploitation. I've had a couple of requests for a companion blog post, so here it is. The post looks at some things attackers might do in clusters they've compromised to retain access. raesene.github.io/blog/2025/09...

The next Cloud Native and Kubernetes Edinburgh meetup is next week (Weds)! We have a top line-up with @thebsdbox.co.uk doing a deep dive on k8s networking and Ballie Gifford talking about their k8s journey.

Unsurprisingly, I have opinions about Kubernetes, particularly when it comes to multitenancy and how easy it is to break out of common deployments. Today I wrote about them for @amberwolfsec.bsky.social blog.amberwolf.com/blog/2025/se...

Babe wake up new punk rock dinosaur just dropped. arstechnica.com/science/2025...

"Pat, why do you carry that ridiculous 600mm lens on long hikes?" Buddy, I can see mountains reflected in the eyes of a trailside pika.

Gutted to be missing this one!

Is your company hiring? Would I be useful to your team? I think I'm ready to open discussions for 2026. I still have commitments to finish over the next 6 months, but let's start talking. I'm in no rush and looking to find the right product / team / company. RTs appreciated

Give a talk at KCD Edinburgh! You don’t even have to be funny (but it helps). CFP here: kcduk.io

Some say the learning curve for Kubernetes is steep. Try the walk up Calton Hill!

Some musings on the use of the “exec” directive in a kubeconfig, and how they might be useful to a red teamer or other nasty internet person: blog.iainsmart.co.uk/posts/kubect...

If anyone at #KubeConEU hasn't ever tried a Tunocks caramel wafer, hit me up. I'm travelling prepared.

If you're into variant sudoku, the daily from Cracking the Cryptic's discord is an excellent puzzle today. sudokupad.app/9f1izfy5tg

Gutted to only be at two days of #KubeCon this year. Flying down tomorrow for a swift 36 hours in London catching up with some wonderful people. /honk remotely to everyone already there!

Does anyone who follows me happen to run a blog or similar which they spellcheck with cspell, and have a custom dictionary of container/Linux words? Apparently the git repo I just ran it on has several hundred typos, but most of those are just "suid" or "containerd" or similar.

After CVE-2024-9042 dropped yesterday, I had a play about to see if I could reproduce the vuln. Spoiler alert, yes I could. I've just published some notes over on the @amberwolfsec.bsky.social blog blog.amberwolf.com/blog/2025/ja...

Securi-Tay tickets confirmed! That's a conference planned for Feb, March, and April.

Happy Christmas everyone! Does anyone know if the meeces ever got their cheeses?

Slides for the @bsideslondon.bsky.social container security workshop presented with @smarticu5.bsky.social and @marionmccune.bsky.social are here blog.iainsmart.co.uk/talks/BSides...

Is "CAP_NET_BIND is a bit of root's power in the same way as Honor is a piece of Adonalsium" too niche to put in a presentation? Asking for a me.

Today, AmberWolf released two blog posts and our tool "NachoVPN" to target vulnerabilities in major VPNs, including CVE-2024-29014 (SonicWall NetExtender SYSTEM RCE) and CVE-2024-5921 (Palo Alto GlobalProtect RCE and Priv Esc), after our SANS HackFest presentation.🧵

SURPRISE The CFP for KubeCon EU is open for 3 MORE HOURS 😲 Closes at 11:59AM EST!!! GOOOOOO SUBMIT!!!! sessionize.com/kubecon-clou...

Does anyone know of a way to point Ansible at multiple WSL environments to configure them individually? At the moment I'm running with a local connection type in each instance, which is a bit awkward.

Didn't realise SIG-Honk had reached Factorio.

Kubernetes is now on BlueSky! Tune in here for news about the project, straight from the contributor community! This account is owned and managed by the Contributor Comms subproject of SIG ContribEx: github.com/kubernetes/c...

Me: This script is inefficient, I wonder if I should make it faster. Script: Completes in 0.082 seconds Me: Huh, never mind.

The factory must grow.

The video for my KCD UK talk is up now. For this one I looked at how #Kubernetes security has improved a lot of the last 10 years, some of the spots we still need to be careful in, and talked about the "Unpatchable 4" CVEs in Kubernetes. youtu.be/ZbW4t-RgZp4?...

Recording from my talk as DevSecCon London is up! youtu.be/nu4UY_vuCA8?.... The slides will be published as soon as I can bully mermaid.js into working in Puppeteer as part of my overcomplicated slide process.

We're going to DevSecCon at Synk London! CP folk are talking about breaking all things K8s (Mr @smarticu5.bsky.social ), James Callaghan on "I Wanna Know what Trust is 🎵", and Antonio Juanilla from JPMC on "How attack and defend a Kubernetes cluster" 💥 www.meetup.com/devseccon-lo...

@mccune.org.uk talking us through the history of Kubernetes security and The Unpatchable Four at @kcduk.bsky.social

Hello, World!