https://oruam.cloud/writing/ Security and infrastructure articles by Julio Cesar Mauro. en https://oruam.cloud/writing/binance/ https://oruam.cloud/writing/binance/ Mon, 02 Nov 2026 21:57:16 -0300 A compromised DevOps laptop was Binance's first explanation for the largest crypto theft in history. It didn't hold. What the $6.3 billion heist's EIP-7702 sweeper mechanism, the Bybit parallel, and the FBI's TraderTraitor attribution actually show. https://oruam.cloud/writing/broccoli2shell/ https://oruam.cloud/writing/broccoli2shell/ Mon, 02 Nov 2026 17:39:06 -0300 CVE-2026-111497, a 9.2-CVSS out-of-bounds write in Google's Brotli decoder, shipped under three different names across Node.js, .NET and Python — and what that naming confusion says about auditing transitive dependencies. https://oruam.cloud/writing/smart-sampa/ https://oruam.cloud/writing/smart-sampa/ Wed, 28 Oct 2026 19:20:41 -0300 An investigation into São Paulo's R$588 million facial-recognition camera program found exposed credentials, infostealer leaks dating to 2024, warnings ignored since 2022, and an AI vendor swapped into the contract by amendment months before the leak came to light. https://oruam.cloud/writing/bootrom/ https://oruam.cloud/writing/bootrom/ Sat, 24 Oct 2026 13:00:00 -0300 What actually leaked when PS5 BootROM key material surfaced online at the end of 2025 — why a key burned into silicon can't be patched like a kernel bug, and why most of the panic around it got ahead of the evidence. https://oruam.cloud/writing/relapse/ https://oruam.cloud/writing/relapse/ Fri, 23 Oct 2026 18:48:20 -0300 How the Relapse jailbreak chains a JavaScriptCore memory corruption bug with a kernel use-after-free race in aiomultiwait — and why every major public PS5 kernel exploit since 2022 traces back to FreeBSD, not Sony's own code. https://oruam.cloud/writing/php2shell/ https://oruam.cloud/writing/php2shell/ Fri, 23 Oct 2026 18:02:46 -0300 How two critical pre-auth RCE bugs in PHP's engine itself (CVE-2026-109618 / CVE-2026-109619) turned into days of scrambled advisories, conflicting mitigations and honeypot-confirmed scanning across the internet. https://oruam.cloud/writing/container/ https://oruam.cloud/writing/container/ Mon, 13 Jul 2026 18:09:11 -0300 How a non-root container with limited file read access becomes the pivot point for cross-account IAM escalation via the metadata endpoint and image layer history. https://oruam.cloud/writing/wildcard/ https://oruam.cloud/writing/wildcard/ Mon, 13 Jul 2026 18:09:11 -0300 How StringLike with a glob pattern in an IAM trust policy condition turns a controlled role assumption into an open path — and why StringEquals matters. https://oruam.cloud/writing/header/ https://oruam.cloud/writing/header/ Mon, 13 Jul 2026 18:09:11 -0300 Why X-Forwarded-For should never be used for access control at the edge — and how one misconfigured Nginx directive led to full internal network access. https://oruam.cloud/writing/systemd/ https://oruam.cloud/writing/systemd/ Mon, 13 Jul 2026 18:09:11 -0300 How services running as root that source files from user-influenced paths enable privilege escalation without a CVE — just a timer and a writable directory. https://oruam.cloud/writing/rbac/ https://oruam.cloud/writing/rbac/ Mon, 13 Jul 2026 18:09:11 -0300 How create Jobs combined with a permissive service account enables namespace lateral movement — and why Kubernetes RBAC must be reviewed as a permission graph, not individual rules. https://oruam.cloud/writing/meshcore/ https://oruam.cloud/writing/meshcore/ Mon, 13 Jul 2026 18:09:11 -0300 How LoRa radios and mesh networking enable community-driven communication over dozens of kilometers — without internet, cellular, or any centralized provider. https://oruam.cloud/writing/misantropia/ https://oruam.cloud/writing/misantropia/ Mon, 13 Jul 2026 18:09:11 -0300 How a teenager with five-year-old leaked credentials shut down Brazil's national emergency alert system — and what the exposed debug mode, SQL injection, and missing MFA say about critical public infrastructure security. https://oruam.cloud/writing/appearances/ https://oruam.cloud/writing/appearances/ Mon, 13 Jul 2026 18:09:11 -0300 How appearance-based cognitive biases become the social engineer's preferred attack vector — and why trusting the "packaging" over evidence hands the attacker a map of your weakest point.