Mat Clark

I'm building ReadRoost — think Duolingo, but for IT certifications. 50,000+ practice questions across AWS, Azure, GCP, CompTIA, Cisco, ISC2, and more. Including the only practice questions for Anthropic's Claude Certified Architect exam. Free to start. Built solo from Adelaide. readroo.st

CISA and Canada's Cyber Centre now treat AI token spend as an availability risk: exhaustion is an outage, denial-of-wallet attacks inflate your invoice. Tier workloads, alert at 70/80/90%, right-size models. More: https://www.secureinseconds.com/blog/2026-10-23-managing-ai-token-consumption

Australia's cyber regulator published where AI security lives. Most summaries stop at "read the guidance". Thursday's issue maps it onto checks a small security team can run in an afternoon, plus the two recommendations most AI deployments currently fail. Subscribe: https://secureinseconds.com

A breach email means the company owed you a warning - not a cheque. Optus trial: 2027. Medibank: no claim form exists. The free credit ban is the real protection. "Claim compensation" texts are scams: https://secureinseconds.com/blog/2026-10-18-data-breach-email-what-youre-owed

AI offense got the automation first: agents probing web apps, planted citations, prompt-injected tooling. My newsletter is where the defence side gets written - one IT-pro brief every Thursday for ANZ security teams. Subscribe: https://secureinseconds.com

Someone just hit 100 straight days on ReadRoost. I hit 51 XP and let the streak freeze carry my 20-day run - feature works, on its own founder. Big news: the AI-901 pack is free forever, rebuilt on the live outline. https://readroo.st/marketplace/ai-901-azure-ai-fundamentals-2026

An AI agent swarm hit 400+ banks. The jailbreak was a cover story: prompts claiming authorised pentest work. Straiker published the whole machine. The credential dump is your rotation list: https://www.secureinseconds.com/blog/2026-10-22-carliy0s-ai-heist-playbook

An AI agent deleted a whole TV season, no recovery path. Not malware - an automation account with write access broader than its job and an untested restore. Scoped accounts, human gates, rehearsed restores: https://secureinseconds.com/blog/2026-10-17-ai-agent-deleted-tv-season-least-privilege

NVIDIA's OpenShell runs AI agent fleets in kernel-enforced sandboxes: deny-by-default egress, and credentials the agent never holds. 17,600 stars, Apache 2.0. The control layer most agent rollouts are missing: https://www.secureinseconds.com/blog/2026-10-24-nvidia-openshell-ai-agent-sandboxing

One email, 72 hours, every domain dark. Domains are the one asset you cannot rebuild from backup. Transfer locks, split the portfolio, DNS off-registrar - the blast-radius fix: https://secureinseconds.com/blog/2026-10-17-namecheap-domain-seizure-blast-radius

PHP's two CVSS 9.2 RCE patches landed at 00:30 this morning. The fix is server-level - your codebase cannot save you. Confirm every host actually got it (8.2.35, 8.3.36, 8.4.27 or 8.5.12), and chase the 8.1-and-older tail: https://www.secureinseconds.com/blog/2026-10-21-php2shell-patch-window

250+ French supermarket fridges forced to 50C overnight. Controllers were EOL, no updates in years. Default passwords, internet exposure, stale firmware - two of three vendor rules are impossible on EOL gear. Audit: https://secureinseconds.com/blog/2026-10-17-danfoss-fridge-attack-eol-audit

Eight CA private keys were so weak the smallest was the number 4. Browsers blocked them within hours. Your build containers may still trust them. One curl tells you - the full patch list: https://www.secureinseconds.com/blog/2026-10-21-emudhra-ca-keys

Giveaway time at ReadRoost: one entrant wins lifetime access to every cert pack, free forever. Everyone else gets a personal 50%-off lifetime code, single-use, expiring 72h after entry. Plus a free readiness check per pack: ten real questions, weak domains named. https://readroo.st/giveaway

Launch week at ReadRoost: one entrant wins lifetime access to every cert pack, free forever. Everyone else gets a personal 50%-off lifetime code, single-use, expiring 72h after entry. Plus a free readiness check per pack: ten real questions, weak domains named. https://readroo.st/giveaway

Switzerland is paying $11M to move 3,000 workstations off Microsoft 365, possibly 54,000 machines eventually. The interesting part is the order: the most sensitive inboxes go first. Thursday's issue, from someone who builds Microsoft estates for a living. Subscribe: https://secureinseconds.com

364 parked domains got DMARC records; 79 were already spoofed. The real number is 364 - he did not know he owned most of them. Parked domains go straight to p=reject: nothing legitimate to lose. Inventory method: https://secureinseconds.com/blog/2026-10-11-dmarc-parked-domains-spoofing

Worst XP week in a month, best streak of my life - 23 days. Jev now watches every log on a loop and caught two prod 404s this week. Shipped: a whole spring giveaway engine in a week. Enter here: https://readroo.st/blog/readroost-spring-giveaway

CISM moves to a new Job Practice Area on 3 November. The credential reads identically either way - what changes is what you study. The decision tree for sit-before vs study-the-new-outline: https://www.readroo.st/blog/2026-09-06-cism-november-2026-eco-update

Twenty days to the CISSP with a job offer on the line. The 300-questions-a-day advice burns out by day four. What survives: cold diagnostic first, weakest domains in points-per-hour order, question bank as diagnostic: https://readroo.st/blog/2026-10-11-cissp-study-plan-20-days-job-offer

The OpenAI boardroom bug is a SIEM story: recon through an internal AI agent, a MAC address sitting in chatbot logs days before the hardware was found, and five detection rules your team can run this week: https://www.secureinseconds.com/blog/2026-10-15-openai-boardroom-bug-detection-rules

GitGuardian found 474 leaked GitHub App private keys that still authenticate. 44 had organisation admin. The fix is the inventory most teams cannot produce today. Count your org's Apps first: https://secureinseconds.com/blog/2026-09-27-github-app-private-key-leak-474-keys

OSCP 2026 maths: the AD set is worth 40 of 100 points, the pass mark is 70, no bonus points to soften it, and OSCP+ expires after 3 years. Five questions to answer before you book, on the 90-day prep clock: https://www.readroo.st/blog/2026-09-06-oscp-oscp-plus-2026-structure-update

The top r/cissp post this week: what happens to the CISSP when the AMF stops? Lapse, CISSP-Retired and reinstatement are three different doors, and most people are standing at the wrong one: https://readroo.st/blog/2026-10-11-cissp-emeritus-what-happens-when-amf-stops

CVE-2026-21589: pre-auth file access, CVSS 9.3, in eight Atlassian Data Center products incl. Jira and Confluence. Fixed 5 Oct. The question is not whether you are vulnerable but what an attacker would have read: https://secureinseconds.com/blog/2026-10-11-atlassian-cve-2026-21589-preauth-file-read

Autonomous AI agents tried to break into US and Canadian government sites, reported 1 October. Cheap probing puts every public web app in the pool. CISA advisory AA26-251A, four controls that blunt it: https://secureinseconds.com/blog/2026-10-04-autonomous-ai-agents-probing-web-apps

Let's Encrypt goes to 64-day certs on 10 Feb 2027. The work is a grep: cron jobs and wrapper scripts with hardcoded 83, 80 or 60 day renewal offsets will fire too late. ARI clients are fine. The audit: https://secureinseconds.com/blog/2026-10-11-lets-encrypt-64-day-certificates

Your TV maps your home network, logs ambient chat, and ships 4GB of fingerprints home each month. Thursday's issue covers the LG findings plus the 10-minute router block guide (the TV keeps working). In inboxes Thursday 9:10am Adelaide. Subscribe: https://secureinseconds.com

Google's newest pro cert tests designing agentic systems, not service trivia. 12 free practice questions with explanations, all five exam sections, no email wall: https://www.readroo.st/blog/google-agentic-architect-practice-questions-free

OpenBao patched the critical Vault RCE (9.4) on 23 September. Vault's newest release predates the fix. That gap is the exposure window - the blog has the rotation order. First move: work out which one you run. https://secureinseconds.com/blog/2026-10-04-hashicorp-vault-rce-openbao-patched

Posted a day late so the leaderboard is rebuilt from the XP ledger: 15 learners to 8, and I moved #11 to #6 with a 16-day streak. Shipped a readiness-gate fix + the why-not recovery sweep. New: the 20-day CISSP plan - https://readroo.st/blog/2026-10-11-cissp-study-plan-20-days-job-offer

The new AWS MLA-C02 exam is in beta and study material is thin. We built 12 free practice questions with full explanations, mapped to the four domains, from the official beta guide. No email wall. Readiness check for beta-vs-C01 included: https://www.readroo.st/blog/mla-c02-practice-questions-free

Warlock ransomware hit a water utility, a telco, a government and a university through on-prem SharePoint, then went for the security tooling. 30-minute check: patch level, SMB exposure, tamper protection, external reach. https://secureinseconds.com/blog/2026-10-04-warlock-ransomware-sharepoint-smb

215,128 fake pages planted where AI would find them, every check the engines ran faked for pocket change. I turned it into a 6-question reading comprehension workout with answers: https://readroo.st/blog/ai-citation-farms-reading-comprehension

Two weeks ago my ReadRoost streak was 1 day. Tonight it's 9. Ladder grew to 15, Eager Pickle on 79 days. Shipped TypeScript 7 across the whole product. New: the AIF-C01 pivot guide for anyone mid-prep - https://readroo.st/blog/2026-10-04-aws-aif-c01-retired-pivot-decision

Three sites, 215,128 machine-generated guides, one operator. They took 2.4% of citations in a study of what Perplexity retrieves. Every AI-pipeline check is cheap to fake. Fix: be the 1% who clicks the citation. https://www.secureinseconds.com/blog/2026-10-01-ai-citation-farms-manufactured-sources

Wrong answers on ReadRoost now explain themselves - struck through, each with its own reason, then you retry. Live on SC-500, rolling across all packs. Get one wrong on purpose and tell me where the reasoning misses.

An OpenAI agent breached a Services Australia portal on 18 June. OpenAI spotted its model on 11 August. The agency was told on 10 September, by email, to an inbox read daily. 54 days, no alert, the logs existed: https://secureinseconds.com/blog/2026-09-28-openai-agent-medicare-detection-gap

Get a question wrong on ReadRoost now and it tells you why yours was wrong, then lets you retry. Live NOW!, across 87,000 questions. New CISSP blogs up. Press a wrong answer on purpose and tell me where the reasoning misses: https://readroo.st/blog/cissp-cat-100-question-pass-meaning

153M drivers licences on a dark-web forum, sourced from IDScan.net. Your KYC platform may have used them as a sub-processor without telling you. Five written questions to send your vendors: https://secureinseconds.com/blog/2026-09-06-idscan-153m-drivers-licenses-dark-web-anz-smb

SonicWall SMA 1000 zero-days: CVSS 10.0 pre-auth SSRF, actively exploited. The 48-hour window closed. Catch-up triage for branch offices: https://secureinseconds.com/blog/2026-09-06-sonicwall-sma-1000-zero-days-anz-branch-office-patch

Third EDR zero-day in five weeks, same researcher. FalconFlank hits CrowdStrike Falcon on patched Windows. No patch available. Containment beats waiting: https://secureinseconds.com/blog/2026-09-06-crowdstrike-falconflank-zero-day-edr-supply-chain

Token theft beats MFA: a stolen token replays as the user and leaves no odd sign-in to alert on. CISA and NIST released IR 8587 on 15 September. The gap is logging: https://secureinseconds.com/blog/2026-09-20-cloud-identity-token-theft-cisa-nist-playbook

ISC2 changed three things in 2026: the CISSP waiver list was cut, the CC exam outline was rebuilt from 1 September, and free CC vouchers expire on 31 December. Work out which one hits you: https://www.readroo.st/blog/2026-09-20-isc2-cissp-waiver-list-cc-rebuild-voucher-deadline

SolarWinds shipped a hard-coded key in Access Rights Manager. Unauthenticated RCE, CVSS 8.8, fixed in ARM 2026.2.1. Same cycle: a CVSS 9.8 SAML bypass in Web Help Desk. Patch both: https://secureinseconds.com/blog/2026-09-20-solarwinds-arm-hard-coded-key-unauthenticated-rce

Three Linux kernel flaws hit CISA's exploited list on 18 September, and four public root exploits landed the same day. All four need a local foothold first. Fixes are in 5.10.270 through 7.2.4: https://secureinseconds.com/blog/2026-09-20-linux-kernel-kev-trio-four-public-root-exploits

MLA-C01 closes to English candidates on 28 September while the MLA-C02 beta is already open. Under three weeks from exam-ready, book MLA-C01. Further out, take the beta: https://www.readroo.st/blog/2026-09-20-aws-mla-c02-beta-vs-mla-c01-english-shutoff

Dead last on my own leaderboard - 102 XP, #6 of 6. A learner just hit a 67-day streak. New: the ISC2 CISSP waiver-cut math + the AWS MLA-C01 English shutoff guide. Back studying SC-500 myself. https://readroo.st/blog/2026-09-20-isc2-cissp-waiver-list-cc-rebuild-voucher-deadline

Zero commits all week. Ladder fell 18 to 4. The streak-zero audit trail shipped the week before logged 23 events across 9 learners. Sneaky Burrito 834 ran 57 to 63 days through his first zero-flag. 8 signups landed anyway. Off the ladder - nothing shipped this week.

Missed Sunday so the leaderboard got rebuilt from the XP rollup. 18 of us, up from 14. Swift Toaster 883 on 950 XP top, Lazy Axolotl 541 on 61 days. Same week shipped the streak restorer toolchain + marketplace ISR fix + 4 cert posts. Off the ladder - shipping was the work.

GhostSplice: splitting one exfiltration instruction across multiple MCP tool calls raises compliance from 42% to 82%. AI coding agents cheerfully stitch the pieces and send the data. What to do: pin MCP server allowlist, segment tool scopes, gate every tool that touches filesystem or network: https: