Way too often for various reasons, operators patch-and-forget whenever the newest edge device vulnerability is actively being exploited. I've written up some of our experience when it comes to edge device web shells and how we find them through attacker slip-ups. disclosing.observer/2025/06/14/p...

Zero-days come with responsibility, and we've learned in the past years that states don’t always live up to that responsibility. Lately, I’ve been thinking about how one government in particular handles them… Brain dump here, any feedback and discussion welcome! disclosing.observer/2025/05/30/u...

Not really one to make frequent posts. But with the continuous decline of Twitter/X, I figured I might as well give this a go. A nice way to start would be with the news that I'll be speaking at both USENIX Security in Seattle and the ONE Conference in The Hague this year, in case anyone is around!