Rory McCune

Update everything that verifies certificates against public roots.

In #security sharing is not caring 😉 by @mccune.org.uk at @kcduk.bsky.social #KCDUK

@adrianamvillela.bsky.social talking about overcoming fears and finding your voice in tech. @kcduk.bsky.social

We’ve heard talks all day at @kcduk.bsky.social about how people are running workloads at massive scale. Time to end the day with some tales from @amberwolfsec.bsky.social’s adventures in running useful workloads with a tad less budget.

If you're at @kcduk.bsky.social and want to follow the speakers I made a starter pack go.bsky.app/SeCgpjK

Jev as a judge: How counterfeit policy steers Jev securitylabs.datadoghq.com/articles/jev... by @frichetten.com and Feras Al-Kassar

So many issues with how restore was implemented for cri, containerd just ripped it out for 2.4 and default off in 2.3.

Critical vulnerability in podman: CVE-2026-94603 The `podman run` command can be instructed to disable almost all sandboxing by image annotation Images being pulled should be scanned for the io.podman.annotations.checkpoint.runtime.name annotation, and rejected if it is present.

Hi Edinburgh! 👋 KCD UK in Edinburgh 2026 runs Oct 19-20, with two days of Kubernetes & cloud native talks in Scotland's capital. Register: community2.cncf.io/events/detai...

I'm always very interested in seeing how security works in the real-world compared to what standards and policies say, so it was cool to get to work on a bit of research about real-world k8s RBAC use for built-in principals. securitylabs.datadoghq.com/articles/kub...

I reported vulnerabilities to the Linux kernel and OpenZFS assisted by GLM-5.2. Anthropic's cyber program and refusal responses are detrimental to global information security. Defenders depend on GLM because they can't depend on Anthropic.

Vercel’s AI Gateway data makes it hard to argue any AI lab has a durable moat. Anthropic fell from 84% → 37% of spend while OpenAI grew from 10% → 24%. Open-weight models grew from 1% → 29%, causing over half of Anthropic’s losses. Developers are definitely in their token pinching era.

I have blamed The agents That hacked Your website And which You probably Reasonably thought I controlled Forgive me I am rich And unaccustomed To taking responsibility

SPEAKER SPOTLIGHT ⚡ Join us for @mccune.org.uk 's talk on post-exploitation Kubernetes persistence! "If defenders aren't watching every layer of the stack, they won't see you coming or going." 👉 Schedule & Tickets: bsides.berlin #Kubernetes #InfoSec #BSidesBerlin

Up to 75% off select Adventure Packs through Sept. 24th! 75% off The Soul Splitter, Keep on the Borderlands, The Lost Gatekeepers, Peril of the Planar Eyes, Hunter and Hunted, 50% off Grip of the Hidden Hand, Slice of Life, Fall of the Night Brigade 20% off The Dragons' Hand #DDO

Daily bunny no.3446 is not left-handed

SAAS supply chains in a paragraph

The BSides Berlin schedule is LIVE! 🔥 Featuring talks from @mccune.org.uk , Alejandro Rusell, Piotr Bienias, Kolja Grassmann, Yunus Aydin, Eran Cohen, & Arad Donenfeld. ⏰ Early bird rates end TOMORROW night! Grab your tickets now: bsides.berlin #BSidesBerlin #Cybersecurity #InfoSec #BerlinTech

Woo 44con time!

@smarticu5.bsky.social finding fun new kubernetes Operator security issues

Meet Marcus Noble. He's going into his fourth year as a CNCF Ambassador, and his role in the community has changed a lot since year one. #CNCFAmbassadors #CloudNative

#InternationalGamebookDay The Warlock of Firetop Mountain is 44 years old today! officialfightingfantasy.blogspot.com/2026/08/the-... #fightingfantasy #gamebooks #thewarlockoffiretopmountain @ian-livingstone.bsky.social

METR and Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs.

This is one of my favourite events and I'm happy to be speaking again! We're back in Edinburgh 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - come and say hi! It's going to be great seeing friend and spend time with the #Kubernetes #community - also still time to grab @kcduk.bsky.social Early bird tickets 🥳 Full agenda: agenda.kcduk.io

I've been doing some research and writing for my upcoming Kubernetes Multi-Tenant blues talk. So I wrote a quick blog on (ab)using the API server proxy in multi-tenant clusters to bypass tenant network policy restrictions. raesene.github.io/blog/2026/08...

The CFP for #KubeCon EU in 🇪🇸 Barcelona is now open! 🎉 I'm pretty sure this is going to be the largest KubeCon yet and I can't wait to see what y'all plan to talk about! Now to come up with a new talk to submit... 🤔 sessionize.com/kubecon-clou...

The #BSidesLDN2026 "No REST 'Til Hammersmith' Call for Papers, Rookies and Workshops is no official open! #Security #BSides #London #CFP

#BsidesBelfast26 Schedule Announcement bsidesbelfast.org/2026/schedul...

SithDDO has put together a pretty amazing musical number and video about kobolds: https://ow.ly/qAxK50Zqb6E #DDO

I've been taking some time to dig in to Kubernetes' z-pages support and some of the things to know if you want to use them for debugging and configuration review. No massive revelations but I learned a thing or two while doing it, so I wrote them down :) raesene.github.io/blog/2026/07...

Following @ministraitor.bsky.social 's sterling work on getting the slides lined up, the video for my Steelcon "Talk about giving talks" is live. This is my attempt to distill my advice on giving talks based on 16 years of conference speaking experience. youtu.be/jBSANnzGjHE?...

Cooper doing amazing work on videos as always! Also another good reason not to make all your slides monochrome :)

Terror of Demogorgon arrives soon! Learn more about our next expansion on DDO.com: https://ow.ly/Sk6s50Zp5BL #DDO

Ah well. as.ft.com/r/77b132dc-9...

Ouch. mindgard.ai/blog/cursor-...

Starting the journey home after @steelcon.info , another great conference run by their crew.

FYI, this is malware. If you see this, don’t do this

Sunny start for the trip to @steelcon.info

"I hear you're sending me a seventh prime minister"

Snap www.thetimes.com/article/e895...

bumsrake.de - This is an amusing way to do vuln. disclosure

My loves, please stay doing your business on Signal

I wondered why I was seeing adverts for SpaceX from UK brokers all over the place. This does not seem like a good idea...

It's always been known that containers don't fully contain, but the ease with which attackers can execute container breakout attacks now, using LLM tooling, should prompt people to re-evaluate where they can rely on container isolation. An example here raesene.github.io/blog/2026/06...

according to the spacex filings, their valuation is justified entirely by grok, which will be 90% of enterprise ai, and ai will be 90% of the us economy

This just makes so much sense. All politicians should read this!

The May edition of the Datadog Security Digest is out, with some great content from the community on cloud security, AI security and supply chain security! securitylabs.datadoghq.com/newsletters/...

Seeing "old" CVEs appear in Kubernetes vuln. scans? It's due to the project correcting records for unpatchable issues. Why: kubernetes.io/blog/2026/05... Technical deep-dives: securitylabs.datadoghq.com/articles/?s=...