How Stuxnet Crossed an Air Gap Nobody Thought Could Be Crossed
Natanz was air-gapped, and Stuxnet crossed it anyway, on USB drives, stolen certificates, and four unknown flaws. Part three of a series on attacks that beat isolation.
Category: Cybersecurity (Page 3)
Critical ThinkingStuxnet: The Weapon That Rewrote What a Cyberattack Could Be
Stuxnet was the first attack that reached out of a screen and broke real machines, destroying a thousand centrifuges at an air-gapped nuclear plant. Part two of a series on attacks that beat isolation.
Critical ThinkingThe Morris Worm: The Night the Internet Learned to Distrust Itself
In one night in 1988, a self-copying program jammed a tenth of the internet and ended the assumption that the network could be trusted. The first article in a series on attacks that beat isolation.
CybersecurityWordPress Security Is a Posture, Not a Plugin
Every article in this series was secretly about security. The capstone: why the green checkmark is a component and not a defense, what a working posture looks like in practice, and the five questions no product can answer.
CybersecurityThe Supply Chain Is the Attack Surface
The attack that reached my site did not come at it. It came through it, riding a trusted update channel. Why supply chain attacks scale, why they extend to hardware, and how to manage a chain you cannot eliminate.
CybersecurityThe Morning I Found a Plugin I Never Installed
A plugin folder appeared on my site that I never installed. It was caught before it did damage, and the investigation changed how I run every part of my WordPress stack.
CybersecurityGhostwriting a Cloud Security Book in the Zero Trust Era
Cloud security in 2026 runs on Zero Trust. A book that still teaches castle-and-moat thinking is teaching a model the field abandoned.
CybersecurityThe People Getting Attacked Are the Ones Nobody Writes For
There is a great deal of security writing and almost none of it is addressed to the people losing money.
CybersecurityThe Day Every Safety Net Failed: Anatomy of a Cascading Disaster
My consultant called while I was driving to a Renaissance fair: the power had failed, the generator had not come on, one UPS was missing, a coin-sized battery had died, the DR link had been down for two days, and…
CybersecurityMy Own Site Got Hit: Anatomy of a WordPress Supply-Chain Attack
The email said malware had been quarantined on my site and I had three days to fix it. Deleting the file took a minute. The forensics took two days, and the trail ended somewhere worse than a break-in: the plugin…
CybersecurityThe Ransomware Years: When Laptops Became Bricks
Somebody opened a link, and their machine was a brick. Literally unrecoverable. Across a fleet of 1,500 desktops and laptops we lost machines to ransomware over and over, and never lost the network, because the network was designed by people…
CybersecurityEight Years of PCI Audits: The Most Thankless Heroics in IT
Pass the audit and nothing happens. Fail it and the company loses the ability to take credit cards. For eight straight years I carried a major retailer through PCI audits that nobody outside IT ever noticed, and that invisibility is…