Where Tech meets Philosophy. Breaking systems, building tools, and thinking about why we do it.https://glitchedcat.com/https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/I reproduced the aiohttp parser bug end to end: a rejected WebSocket upgrade leaves the request body in the parser tail, and through the standard Nginx WebSocket map it becomes CWE-444 smuggling that bypasses a deny-all edge ACL. PoC in Python and Rust, plus lab-validated detection.Tue, 04 Aug 2026 12:00:00 GMThttps://glitchedcat.com/posts/stealth-dcsync-autopsy/https://glitchedcat.com/posts/stealth-dcsync-autopsy/I tested five MS-DRSR flag and EXOP manipulations meant to perform a DCSync without triggering the DS-Replication-Get-Changes-All GUID in Event 4662. Every variant that returned usable credential material also logged the GUID, identically on Server 2016 and Server 2025. One variant contradicts the MS-DRSR specification and I could not resolve it.Sun, 02 Aug 2026 20:00:00 GMThttps://glitchedcat.com/posts/llm-canary-lab/https://glitchedcat.com/posts/llm-canary-lab/Why hiding instructions in a page to bias an AI's answer is a bad idea, and how I built a labeled, disclosed canary experiment to measure it instead.Sat, 25 Jul 2026 12:00:00 GMThttps://glitchedcat.com/posts/ghosthound/https://glitchedcat.com/posts/ghosthound/BloodHound OpenGraph extension for enumerating AD tombstones.Fri, 24 Jul 2026 18:00:00 GMThttps://glitchedcat.com/posts/rasp-net/https://glitchedcat.com/posts/rasp-net/Runtime Application Self-Protection for High-Scale .NET Services.Fri, 24 Jul 2026 18:00:00 GMThttps://glitchedcat.com/posts/skewrun/https://glitchedcat.com/posts/skewrun/An Active Directory time discovery toolkit for red teams.Fri, 24 Jul 2026 18:00:00 GMT