65 results for “TLS”

What you seeeverything

All types65 Write-ups23 Articles14 Papers11 Repos9 Advisories6 Courses1 Threads1

status.bunny.netadvisory🛡️ Security

Bunny CDN Security Incident

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

Bunny CDNTLS

bunny.netb-cdn.netbunny.run

Threat Intel, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026

securityweek.comarticle🛡️ Security

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three TLS flaws in the GoAhead embedded web server from EmbedThis, used on hundreds of millions of IoT, OT and network devices. CVE-2026-115881 (CVSS 9.1) leaves revoked client certificates accepted under mTLS with OpenSSL; CVE-2026-115884 (7.4) bypasses chain-length limits with LibreSSL; a third Mbed TLS bug (5.9, no CVE) weakens TLS 1.2 DHE. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and FoxIO released PoC code and fingerprints.

GoAheadOpenSSLMbed TLS+2

CVE-2026-115881CVE-2026-115884FoxIO+4

Hardware & RF, AppSec· Published and added 28 Oct 2026

aws.amazon.comarticle🛡️ Security

Introducing Route 53 Resolved IP Validation for AWS Network Firewall

Route 53 Resolved IP Validation for AWS Network Firewall, launched 21 October 2026 at no extra charge, has Route 53 Resolver share the IP addresses it returns per domain with Network Firewall, which checks each new outbound connection against them. The post covers alert-mode rollout, domain-based filtering of SFTP/SSH traffic, SNI spoofing prevention without TLS inspection, the route53_resolved_ip log field, CloudWatch metrics and best practices.

AWS Network FirewallAmazon Route 53 ResolverRoute 53 Resolver DNS Firewall+3

SNI spoofingRoute 53 Resolved IP ValidationDNS tunneling

Cloud & Infra, Blue Team & Detection· Added 28 Oct 2026, published 27 Oct 2026

ethresear.charticle🛡️ Security

Inventory of PQ P2P Migrations in the Consensus Layer

Inventory of post-quantum migration work for Ethereum consensus-layer networking, by adust09 of Nyx Foundation. It maps three targets: Discovery v5/ENR signatures and key exchange, TLS 1.3 key agreement in QUIC, and libp2p TLS identity binding and CertificateVerify. It covers the 300-byte ENR and 1,280-byte packet limits, why hybrid KEMs do not authenticate peers, and downgrade and DoS concerns. It selects no algorithm or schedule.

Ethereumlibp2pQUIC+3

ML-KEMECDSAFIPS 203+8

other· Published and added 27 Oct 2026

hackers-arise.comarticle🛡️ Security

Adaptix C2 Architecture: Configuring Command & Control Listeners

AdaptixC2 listener configuration guide, second in a Hackers-Arise series. It walks through the fields for BeaconDNS, Beacon HTTP, Beacon SMB, Beacon TCP and Gopher TCP listeners, including DNS burst mode, HTTP URIs, User-Agents and redirector callback addresses, SMB named pipes, TCP prepend data, and mTLS. It also explains external versus internal listeners for lateral movement.

AdaptixC2Windows

Hackers Ariseredirectormutual TLS+1

Offensive Security, Learning· Published and added 26 Oct 2026

eprint.iacr.orgpaper🛡️ Security

LINE-Break: Cryptanalysis and Reverse Engineering of Letter Sealing

LINE-Break is a security analysis of Letter Sealing v2, the custom end-to-end encryption protocol in the LINE messenger. A TLS man-in-the-middle attacker or malicious server can replay, reorder and block messages undetected, and colluding users can forge message authorship in one-to-one and group chats. Stickers and URL previews leak plaintext. The attacks were verified on the real iOS app and an independent implementation.

LINEiOS

Letter SealingLetter Sealing v2Diego F. Aranha+1

Mobile Security, Offensive Security· Published and added 26 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

EMudhra Intermediate CA Certificates Compromised

Unit 42 advisory on the compromise of eight intermediate CA private keys belonging to Indian CA eMudhra Limited. The keys were generated with insufficient randomness, so attackers could derive them from the public certificates and sign rogue TLS certificates for MitM attacks. eMudhra has revoked the certificates and browser and OS vendors have untrusted them. Interim guidance covers PKI and trust store audits, reissuance, strict CRL/OCSP checking, log hunting, CT monitoring and CAA records.

Prisma BrowserJavaDocker+2

eMudhraUnit 42Palo Alto Networks Next-Gen Trust Security+1

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 22 Oct 2026

x.comthread🛡️ Security

Paul Dragoonis (@dr4goonis) on X

Social post summarising emergency patches for Node.js (4 high CVEs), PHP (2 critical) and nginx (3 critical). Node.js flaws include a Brotli decoder out-of-bounds write, a DNS truncation bug and two TLS hostname-verification bypasses. PHP has use-after-free and heap corruption bugs, and nginx has alias-rewrite and map-regex heap overflows plus an SSI-AIO use-after-free. It lists the fixed versions for each product.

Node.jsPHPnginx

CVE-2026-111497CVE-2026-105482CVE-2026-105483+8

AppSec· Added 23 Oct 2026, published 22 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Compromised eMudhra intermediate certificates

Cisco Talos describes eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys were trivially recoverable because a flaw in an April 30, 2025 key generation ceremony produced weak keys with only 3 to 8 bytes of entropy. The post lists certificate SHA-256 hashes and serials, browser and Microsoft blocks, and the Go fix (CVE-2026-111943, Go 1.27.3 and 1.26.10) that filters chains by SPKI hash. It covers impact on VPNs, CI/CD and embedded devices, and Snort SIDs 67363 to 67374.

GoChromeVPN+3

CVE-2026-111943eMudhraemSign Root TLS CA - G3+8

Threat Intel, Cloud & Infra· Published and added 21 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Verifiable Post-Quantum TLS Handshake: Recognizing Implementation Errors of Cryptographic Verification Steps

PQCD-TLS is a post-quantum TLS handshake that binds confirmation codes into chained key derivation, so a faulty signature or KEM verification step causes a key mismatch and handshake failure. The authors build confirmation-code frameworks for ML-DSA and Falcon signatures and for ML-KEM, HQC and DAWN, with unpredictability proofs. Across 48 configurations, handshake latency overhead stays below 1%.

TLSML-DSAML-KEM

goto failPQCD-TLSFalcon+3

AppSec· Added 24 Oct 2026, published 21 Oct 2026

blog.cloudflare.comwriteup🛡️ Security

8 eMudhra certificates are compromised. Here's what you need to know

Cloudflare's incident post on the compromise of private keys for eight eMudhra intermediate certificates, disclosed 19 October 2026. The weak keys let an attacker forge certificates for any domain. It describes Cloudflare's patching of trust stores, WARP and cloudflared, tells developers to update the underlying TLS verifier and not disable verification, and points to Dennis Jackson's test site and revocation systems such as CRLSets and upki.

CloudflareCloudflare TunnelWARP+2

eMudhraDennis Jacksonupki+1

Cloud & Infra, Blue Team & Detection· Added 29 Oct 2026, published 20 Oct 2026

blog.cloudflare.comarticle🛡️ Security

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

Cloudflare's guidance on protecting Citrix NetScaler Gateway after the actively exploited CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (DTLS). It recommends putting Zero Trust access policies in front of the login page, locking the origin down with Tunnel, dedicated egress IPs, authenticated origin pulls or Access JWT validation, and adding WAF inspection. It ends with a four-step test list to confirm the boundary holds.

Citrix NetScalerCloudflareCloudflare Access+1

CVE-2026-88771CVE-2026-88772CISA+5

Cloud & Infra, Identity & Access· Added 29 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Post-Quantum Certificate-Based PSK Provisioning for WireGuard via Mutual TLS, DTLS, and QUIC: Design and Performance Study

The paper proposes a post-quantum architecture for WireGuard that leaves the core protocol unchanged. A mutually authenticated TLS 1.3 control channel runs over TCP, UDP (DTLS) or QUIC and uses ML-KEM key establishment, with X.509 certificates from a PKI signed with ML-DSA. A shared secret derived from the session's exported keying material is injected into WireGuard's native PSK interface. A Tamarin model of the TLS–WireGuard composition layer checks secrecy, binding and provisioning-order properties and identifies the conditions needed for secure deployment. The authors benchmark handshake latency and CPU time for classical, pure-PQ and hybrid key establishment across the three transports, and compare against the Rosenpass PQ WireGuard baseline.

WireGuardVPN

ML-KEMML-DSARosenpass+5

other· Added 15 Oct 2026, published 14 Oct 2026

aws.amazon.comarticle🛡️ Security

Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

Explains how to turn a cryptographic algorithm policy (approve ML-DSA-65/87, exclude ML-DSA-44) into enforceable AWS controls using SCPs, IAM policies, permission boundaries and KMS key policies. The key lever is the kms:KeySpec condition key (kms:SigningAlgorithm can't distinguish variants, since all use ML_DSA_SHAKE_256), applied to CreateKey, ReplicateKey, Sign, Verify and GetPublicKey. It also covers surfaces without algorithm condition keys (AWS Private CA, ACM import, IAM server certificate upload, ELB TLS) via provisioning pipelines plus CloudTrail and AWS Config drift detection, and the default-allow risk of deny-lists.

AWSAWS KMSAWS IAM+3

ML-DSAFIPS 204NIST+2

Cloud & Infra, GRC· Published and added 12 Oct 2026

microsoft.comarticle🛡️ Security

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

WindowsSchannelTLS

ML-DSAML-DSA-87PQC TLS Pilot Program+8

Identity & Access, GRC· Published and added 8 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical Again

Presents Reverse-Bleichenbacher, a variant of the Bleichenbacher RSA PKCS#1 v1.5 padding-oracle attack that recovers the least significant bytes first and stops once the TLS PreMasterSecret is found. With improved trimmers and coverage-optimized search, median oracle queries against a 2048-bit key drop from 11,428 to 1,801, and 68.3% of runs finish within a 30s timeout under single-server conditions. The authors find 640 vulnerable domains in the Tranco Top 1M (many behind Alibaba Cloud load balancers) and demonstrate MITM malicious update injection leading to remote code execution.

TLSRSAPKCS#1 v1.5

Reverse-BleichenbacherBleichenbacher attackPreMasterSecret+3

Offensive Security· Added 11 Oct 2026, published 8 Oct 2026

hackers-arise.comarticle🛡️ Security

Bypass Web Application Firewall (WAF) with EvilWAF

Hackers-Arise walkthrough of EvilWAF, an open-source MITM proxy and standalone WAF vulnerability scanner that evades modern behavior-based WAFs by rotating TCP/TLS fingerprints (JA3/JA4) rather than altering attack payloads. It covers proxying sqlmap traffic through EvilWAF, its auto-hunt feature for discovering and routing directly to the real origin IP behind a WAF, and its scan-only mode that probes ten WAF defense layers (rule engine, rate limiting, HTTP method handling, TLS settings). The piece also discusses why Cloudflare's ML-based behavioral fingerprinting resists many of these bypass techniques.

EvilWAFsqlmapCloudflare+2

JA3JA4

Offensive Security, AppSec· Published and added 8 Oct 2026

decrypt.coarticle🛡️ Security

Europol Warns Crypto Wallets Are 'Primary Risk' for Quantum Attacks

Decrypt covers two Europol reports — "Quantum Computing and Cryptocurrencies" (European Cybercrime Centre) and "Harvest Now, Decrypt Later" (with University Carlos III of Madrid) — warning that exposed wallet public keys, not blockchain hash functions, are the primary quantum attack surface for crypto, and that TLS, SSH, and OpenPGP are susceptible to retrospective decryption once quantum computers mature. It details a "just-in-time" attack where a quantum computer derives a private key during the brief window between a transaction broadcasting its public key and confirmation, cites NIST's post-quantum deprecation schedule (phase out classical public-key crypto by 2035), and notes ~30% of BTC supply already has exposed public keys with pre-emptive migration as the only remedy.

BitcoinTLSSSH+2

EuropolEuropean Cybercrime CentreUniversity Carlos III of Madrid+7

Blockchain, GRC· Published and added 7 Oct 2026

decrypt.coarticle🧠 AI

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

A developer using the handle "hashfunction" published a 460GB Hugging Face dataset of metadata (captions, hashtags, sound IDs, engagement counts, AI-generation flags) for roughly 5.6 billion public TikTok videos spanning July 2014 to October 2026, released under CC BY-NC 4.0. The data was reportedly pulled from TikTok's private mobile API using spoofed device identities and TLS handshakes rather than TikTok's official, application-gated Research Tools, in apparent violation of TikTok's terms of service; commercial access, creator profiles, daily updates, and the $1,699 scraper source code are sold via datasocial.ai. The piece situates this alongside other scraped TikTok-metadata dumps on Hugging Face and ongoing litigation (Reddit v. Perplexity/SerpApi) over large-scale AI training-data scraping.

Hugging Face

TikTokhashfunctiondatasocial.ai+4

training, ai-policy· Published and added 6 Oct 2026

decrypt.coarticle🛡️ Security

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

Decrypt reports that a developer going by "hashfunction," operating under the datasocial account, published a 460GB Parquet dataset of metadata for ~5.6 billion public TikTok videos (captions, hashtags, sound IDs, engagement counts, AI-generated flags) on Hugging Face under CC BY-NC 4.0. The data was obtained by hitting TikTok's private mobile API using generated Android device identities, reverse-engineered request signatures, and a spoofed TLS handshake, bypassing the ToS clause that bars automated scraping; datasocial.ai sells the scraper's source code for $1,699 and offers commercial access, creator profiles, and daily updates. The piece situates this against TikTok's gated official Research Tools and the ongoing Reddit v. Perplexity/SerpApi scraping lawsuit.

TikTokHugging FaceAndroid+1

hashfunctiondatasocial.aiReddit+4

Offensive Security· Published and added 6 Oct 2026

theravenfile.comwriteup🛡️ Security

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

Citrix NetScalerPHPPython+2

CVE-2026-88771CVE-2026-88772CVE-2026-88773+10

Threat Intel, Malware & RE· Published and added 6 Oct 2026

eprint.iacr.orgpaper🛡️ Security

PoP! Goes the VOLE: Shorter Proofs of Possession for KEM Certificates

This IACR ePrint paper proposes and benchmarks a non-interactive Proof of Possession (PoP) for the code-based post-quantum KEM HQC, built using the VOLE-in-the-Head (VOLEitH) zero-knowledge paradigm, to solve the practical problem of issuing KEM-based certificates needed by protocols like KEMTLS. The authors integrate their HQC PoP into the ACME certificate-issuance protocol and compare it against existing PoP schemes for Kyber and FrodoKEM, showing Kyber issues certificates faster but at the cost of protocol or NIST-standard compatibility, while their HQC-based PoP keeps compatibility and achieves smaller proof sizes, which matters under unstable-network conditions due to larger KEM-based CSRs.

ACMEHQCKyber+2

Identity & Access· Added 8 Oct 2026, published 6 Oct 2026

opensourcemalware.comwriteup🛡️ Security

Malicious Crypto Shell Packages Target RubyGems

OpenSourceMalware's analysis of over 40 typosquatted RubyGems packages (e.g. rubygems-btc-shell) published by a user calling themselves "Ghost Dev," targeting crypto/web3 developers. The packages ship a delayed-execution payload hidden in extconf.rb that evades sandboxes before either opening a reverse shell to 45.138.12.177:8090 or deploying a full theft kit (inject_proxy.py, _grab.py, a browser extension, and a rogue root CA) that MITMs TLS traffic to 28+ crypto exchanges, swaps withdrawal addresses, hijacks the clipboard, and harvests wallet files, seed phrases, and private keys. The writeup includes full IOCs, SHA-256 hashes, attacker wallet addresses, and C2 endpoints.

RubyGemsPythonBitcoin+2

Ghost Devreqthrottle_3474rubygems-btc-shell+2

Supply Chain, Malware & RE, Blockchain· Published and added 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Role-Specific Signature Placement in TLS 1.3: Cost Propagation and PQC Migration

An IACR eprint paper evaluating all 13-cubed ways to assign 13 post-quantum/traditional signature parameter sets across the Root, Intermediate and Leaf roles of a TLS 1.3 certificate chain, holding the algorithm set fixed and varying only placement. Across 286 three-algorithm groups, median max/min ratios reach 2.085x for TLS handshake latency, 4.310x for certificate body size and 4.551x for path-validation cost purely from role order, with Leaf placement mattering far more than Root/Intermediate swaps. It also shows that looking only at Certificate-message size can misrank candidates such as ML-DSA-65 versus SLH-DSA-SHAKE-192s once the Leaf signature in CertificateVerify and full authentication-path cost are included, arguing PQC certificate-chain design must account for role-specific cost under real network/load conditions.

TLS 1.3X.509ML-DSA

ML-DSA-65SLH-DSA-SHAKE-192s

AppSec· Added 8 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Deploying Native-Rust KpqC: Pluggable Post-Quantum KEMs and Signatures across TLS, Space Links, and the OQS Ecosystem

This IACR ePrint paper presents a native-Rust, memory-safe implementation of the Korean KpqC competition's standardized post-quantum schemes — KEMs NTRU+ and SMAUG-T, and signatures HAETAE and AIMer — replacing the reference memory-unsafe C code. The authors expose all seven KEM parameter sets and four signature modes through a single pluggable provider demonstrated across three real deployment front-ends: a rustls TLS 1.3 key-exchange group, an OQS/liboqs-compatible C ABI, and an analytical CCSDS/SDLS satellite constrained-link model, showing SMAUG-T variants are smaller/faster than ML-KEM-768 on constrained space links and a memory-optimized NTRU+ build cuts peak stack by up to 25% at negligible latency cost.

RustCOpen Quantum Safe

KpqCNTRU+SMAUG-T+5

other· Added 8 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Measuring Parallel Execution of Classical–PQC Component Pairs in Hybrid TLS 1.3

An IACR ePrint paper benchmarks whether running the classical and post-quantum components of hybrid TLS 1.3 key exchange (ECDHE–ML-KEM) and Composite ML-DSA signatures in parallel on separate pthread worker threads reduces handshake latency versus sequential execution. Across three RFC 10024 ECDHE–ML-KEM groups with server and mutual authentication, parallelism sped up all six tested conditions on a standard ARM and x86 system (1.04×–1.28×), with the largest gains in signature stages where component times are balanced, but slowed every condition on a low-power x86 system (0.80×–0.92×) because thread wake/wait overhead outweighed savings. The authors conclude that component independence alone doesn't guarantee a speedup and that parallelization decisions must be validated per target environment.

TLS 1.3pthread

ML-KEMML-DSAECDHE+1

other· Added 8 Oct 2026, published 5 Oct 2026

github.comwriteup🛡️ Security

Xray-core concealed a certificate verification bypass vulnerability

A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.

Xray-core

pinnedPeerCertificateChainSha256pinnedPeerCertSha256allowInsecure+1

AppSec· Added 5 Oct 2026, published 4 Oct 2026

hackers-arise.comwriteup🛡️ Security

Pentesting: Managing Compromised Machines with Platypus

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

DockerLinuxWindows+4

Red Team Operator

Offensive Security· Added 7 Oct 2026, published 2 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

Citrix NetScalerPHPApache+2

CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 30 Sep 2026

x.comcourse🛡️ Security

The DevSec Blueprint (DSB) (@devsecblueprint) on X

The DevSec Blueprint released Kubernetes Security Engineering, a free nine lesson course covering cluster security boundaries, least privilege RBAC and service accounts, Pod Security Standards, NetworkPolicies and mTLS, admission control, secrets and workload identity replacing static cloud credentials with short lived access, and runtime defense via audit logs. It includes a hands on Cluster Hardening Mission to secure a workload and gather evidence the controls work. The course is free; referenced walkthroughs require signing up as a DSB Builder.

Kubernetes

Learning, Cloud & Infra· Published and added 30 Sep 2026

Showing 30 of 65