Real breaches, and what to run on your own boxes
I write as sudodrift. I've spent more than ten years in IT, mostly as a Linux sysadmin and in security. When something big gets breached, I read the incident reports, work out what actually happened, and write down the checks and fixes you can use today.
Latest posts
-
Your host got breached. Now check your own servers.
Japan just had a bad two weeks: JAL via Amadeus, Sony's So-net, GMO's Desktop Cloud with malware on customer VMs. The useful lesson is not "Japan has a problem." It is what you do when the people who run your box get broken into.
-
A vendor app made itself Global Admin in five minutes. Here's how to check your tenant.
The ConnectWise Cloud Backup credential theft, the AI agent Microsoft says was steering it, and a read-only check you can run on any Microsoft 365 tenant today.
-
CISA Says Assume Your Cold Storage Is a Target. Here's How to Check Today.
A same-day US advisory after supermarket freezers, military commissaries and blood banks were hit. Confirmed facts, open questions, and the eight checks operators should run.
-
Barclays Named AI in 5,000 Job Cuts. Here's What the Bank Actually Said.
The bank's own call script tells two stories at once. Today's US layoff numbers help explain why that matters.
-
That Google alert is real. The phone number inside it isn't.
Scammers are typing fake invoices and fake support case numbers into a Google settings field, and Google's own security email delivers the text for them. Here's how to read one of these without getting pulled into a call.
Tools
Free, open source tools I maintain. None of them change the systems they check.
-
sudodrift
A small Go tool that takes a snapshot of who can log in to a Linux server and who can become root, then tells you in plain English what changed. It can also check your sudoers files for lines that sudo-rs, the new default sudo on Ubuntu, rejects. One static binary, no network access.
-
breach-checks
Short shell scripts that check your own machines for one real incident each, like the LiteLLM 1.107.0 release or the swapped OVHcloud CLI. Each one goes with an article here.
-
agent-preflight
Run it before you start a coding agent in a folder. It lists the instruction files, MCP servers and hooks the agent would load, and flags the ones worth a look.
-
releasedrift
Finds every GitHub release download in your Dockerfiles, scripts and workflows, checks that each one is pinned to a SHA-256, and tells you when a release file was swapped after you last looked.
-
keydrift
Finds the API keys on your machine without showing their values, tells you which ones an incident like the LiteLLM or OVHcloud CLI compromise exposed, and lists what to rotate first.
-
keyburn
Reads your OpenAI and Anthropic usage per key from cron and alerts you when a key looks stolen: a sudden spike, a dormant key in use, or spend over your limit.