https://cyberkareem.com/writing/ Security research, engineering notes, certification reviews, and authorized-lab walkthroughs by Abdullah Kareem. en Mon, 13 Jul 2026 00:00:00 GMT https://cyberkareem.com/writing/cve-2026-55675-saltyorg-docs-privileged-workflow-chain/ https://cyberkareem.com/writing/cve-2026-55675-saltyorg-docs-privileged-workflow-chain/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study How untrusted pull-request code reached a secret-bearing CI job—and how separating build from deploy closed the trust-boundary failure. https://cyberkareem.com/writing/cve-2026-55890-grav-markdown-style-injection/ https://cyberkareem.com/writing/cve-2026-55890-grav-markdown-style-injection/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study A Grav case study in variant analysis: one Markdown media-attribute sink was blocked while a sibling style path remained writable. https://cyberkareem.com/writing/cve-2026-59185-identrail-installation-id-ownership/ https://cyberkareem.com/writing/cve-2026-59185-identrail-installation-id-ownership/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study How a client-supplied GitHub App installation ID crossed a tenant boundary, and why OAuth identity must bind the installation to the workspace. https://cyberkareem.com/writing/cve-2026-59889-jackson-jsonview-jsonunwrapped-bypass/ https://cyberkareem.com/writing/cve-2026-59889-jackson-jsonview-jsonunwrapped-bypass/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study Why Jackson’s unwrapped-property replay bypassed a write-side JsonView boundary, enabling authorization-sensitive fields to be populated. https://cyberkareem.com/writing/cve-2026-59979-yosemite-crew-tenant-authorization/ https://cyberkareem.com/writing/cve-2026-59979-yosemite-crew-tenant-authorization/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study How authentication-only routes and globally keyed service lookups enabled cross-tenant reads and state changes in Yosemite-Crew. https://cyberkareem.com/writing/cve-2026-61448-parse-server-content-type-stored-xss/ https://cyberkareem.com/writing/cve-2026-61448-parse-server-content-type-stored-xss/ Mon, 13 Jul 2026 00:00:00 GMT CVE case study A Parse Server upload-validation case study: malformed media types survived storage and let browsers reinterpret active content. https://cyberkareem.com/writing/building-a-pci-dss-segmentation-test-runner/ https://cyberkareem.com/writing/building-a-pci-dss-segmentation-test-runner/ Sun, 12 Jul 2026 00:00:00 GMT Security engineering A practical look at automating bounded reachability tests from authorized source segments toward explicit CDE targets while keeping methodology, coverage, and compliance decisions human. https://cyberkareem.com/writing/building-a-nist-compliant-boot-and-nuke-usb-tool-secure-automated-purge/ https://cyberkareem.com/writing/building-a-nist-compliant-boot-and-nuke-usb-tool-secure-automated-purge/ Fri, 30 May 2025 17:21:25 GMT Security engineering An archived engineering account of a bootable disk-sanitization prototype that requires device-specific validation and review against NIST SP 800-88 Rev.2 before operational use. https://cyberkareem.com/writing/stoicism-in-everyday-life-how-ancient-wisdom-and-a-few-modern-insights-transformed-my-anxious/ https://cyberkareem.com/writing/stoicism-in-everyday-life-how-ancient-wisdom-and-a-few-modern-insights-transformed-my-anxious/ Sat, 24 May 2025 13:06:35 GMT Field notes This reflection shares my personal journey with Stoicism and mental resilience, highlighting lessons learned that have positively impacted both my personal and professional life. https://cyberkareem.com/writing/introducing-the-bitlocker-cryptographic-erase-utility-secure-data-destruction-made-simple/ https://cyberkareem.com/writing/introducing-the-bitlocker-cryptographic-erase-utility-secure-data-destruction-made-simple/ Mon, 19 May 2025 21:50:37 GMT Security engineering A reviewed account of a BitLocker-based cryptographic-erase prototype, its operating assumptions, and the validation required before real-world use. https://cyberkareem.com/writing/microsoft-teams-classic-vs-new-features-and-security-unveiled/ https://cyberkareem.com/writing/microsoft-teams-classic-vs-new-features-and-security-unveiled/ Sun, 28 Jan 2024 12:27:56 GMT Security engineering A point-in-time comparison of Microsoft Teams Classic and New Teams, preserved as historical product and security context rather than current guidance. https://cyberkareem.com/writing/offensive-security-wireless-professional-oswp-certification-review/ https://cyberkareem.com/writing/offensive-security-wireless-professional-oswp-certification-review/ Tue, 25 Oct 2022 18:59:55 GMT Certification review A retrospective OSWP review covering the PEN-210 learning path, practical wireless lab work, exam preparation, and lessons for future candidates. https://cyberkareem.com/writing/90-days-of-my-experience-with-personal-journaling/ https://cyberkareem.com/writing/90-days-of-my-experience-with-personal-journaling/ Fri, 23 Sep 2022 17:43:40 GMT Field notes A personal reflection on ninety days of journaling, the routines that made it sustainable, and the lessons carried into professional practice. https://cyberkareem.com/writing/ecppt-elearnsecurity-certified-professional-penetration-tester-review/ https://cyberkareem.com/writing/ecppt-elearnsecurity-certified-professional-penetration-tester-review/ Mon, 01 Aug 2022 10:27:01 GMT Certification review A retrospective eCPPTv2 review covering preparation, the practical assessment experience, reporting, and lessons from earning the certification in 2022. https://cyberkareem.com/writing/installing-the-metasploit-framework-on-ubuntu/ https://cyberkareem.com/writing/installing-the-metasploit-framework-on-ubuntu/ Fri, 04 Mar 2022 16:28:55 GMT Security engineering A preserved 2022 installation note for Metasploit Framework on Ubuntu. Commands and repository setup may have changed and require current upstream verification.