https://www.msbiro.net/tags/threat-modeling/ Recent content in Threat-Modeling on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Sun, 09 Aug 2026 09:00:00 +0000 https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ Sun, 09 Aug 2026 09:00:00 +0000 https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ CVE-2026-64564 (SCTPhantom) is a critical Linux kernel use-after-free in SCTP ASCONF with a high CVSS score and a demonstrated container escape. A DevSecOps threat-modeling walkthrough of when to care, who is actually at risk, and how to prioritize patching without panic, accounting for attacker-creatable SCTP associations. https://www.msbiro.net/posts/owasp-genai-llm-top-10-2026/ Wed, 05 Aug 2026 07:00:00 +0000 https://www.msbiro.net/posts/owasp-genai-llm-top-10-2026/ OWASP released the GenAI LLM Top 10 2026, the first edition grounded in 7,714 real AI security incidents. Prompt Injection stays at number one. Excessive Agency climbs. Misinformation is the widest gap between what practitioners fear and what the evidence shows. https://www.msbiro.net/posts/notepad-plusplus-sdlc-compromise-2026/ Tue, 03 Feb 2026 22:00:00 +0000 https://www.msbiro.net/posts/notepad-plusplus-sdlc-compromise-2026/ Deep dive into the Notepad++ supply chain attack: how state-sponsored hackers compromised the hosting provider, hijacked updates, and what we can learn about SDLC security.