https://holyghost.sh HolyGhost is an independent cybersecurity blog. Clear breakdowns of known vulnerabilities and attacks, plus practical lessons for people learning security the right way. en https://holyghost.sh/blog/breaking-bitlocker-again https://holyghost.sh/blog/breaking-bitlocker-again Tue, 30 Jun 2026 00:00:00 GMT A 2026 wave of BitLocker bypasses all abuse the same weak spot, the Windows Recovery Environment. Here is how the trust boundary breaks, why the fixes keep failing, and what actually protects your data. Analysis https://holyghost.sh/blog/solarwinds-supply-chain https://holyghost.sh/blog/solarwinds-supply-chain Sat, 27 Jun 2026 00:00:00 GMT Attackers did not break into thousands of networks one by one. They compromised a single software vendor's build process and let the trusted updates carry the backdoor in. A breakdown of the SolarWinds supply chain attack. Analysis https://holyghost.sh/blog/ssrf-cloud-metadata https://holyghost.sh/blog/ssrf-cloud-metadata Tue, 23 Jun 2026 00:00:00 GMT Server side request forgery turns a harmless looking URL input into a way to read a cloud instance's own credentials. Here is how the metadata endpoint becomes the prize, and why IMDSv2 changed the game. Analysis https://holyghost.sh/blog/what-is-threat-modelling https://holyghost.sh/blog/what-is-threat-modelling Sat, 20 Jun 2026 00:00:00 GMT Threat modelling is the habit of asking what could go wrong before it does. A beginner friendly guide to the four questions and a simple framework for spotting weaknesses early. Learn https://holyghost.sh/blog/log4shell-explained https://holyghost.sh/blog/log4shell-explained Sat, 13 Jun 2026 00:00:00 GMT A single string written into a log file could run attacker code on millions of servers. Here is how Log4Shell (CVE-2021-44228) worked, why it spread so far, and what it taught the industry about dependencies. Analysis https://holyghost.sh/blog/kerberoasting-explained https://holyghost.sh/blog/kerberoasting-explained Tue, 09 Jun 2026 00:00:00 GMT Any authenticated user in an Active Directory domain can ask for tickets that are effectively offline password hashes for service accounts. Here is how Kerberoasting works, why it is so reliable, and how to shut it down. Analysis https://holyghost.sh/blog/what-disk-encryption-protects https://holyghost.sh/blog/what-disk-encryption-protects Sat, 06 Jun 2026 00:00:00 GMT A plain English primer on threat models: what BitLocker, FileVault, and LUKS defend against, what they quietly do not, and why 'encrypted' is not a yes or no answer. Learn https://holyghost.sh/blog/spectre-meltdown-explained https://holyghost.sh/blog/spectre-meltdown-explained Tue, 02 Jun 2026 00:00:00 GMT Modern processors guess ahead to go faster. Spectre and Meltdown showed that guessing leaves traces an attacker can read. A plain explainer of speculative execution side channels. Analysis https://holyghost.sh/blog/pass-the-hash-explained https://holyghost.sh/blog/pass-the-hash-explained Sat, 30 May 2026 00:00:00 GMT In Windows networks an attacker often does not need your password, just its hash. Here is how pass the hash works, why it powers lateral movement, and how to break the chain. Analysis https://holyghost.sh/blog/what-is-a-security-incident https://holyghost.sh/blog/what-is-a-security-incident Fri, 22 May 2026 00:00:00 GMT The difference between an event, an alert, an incident, and a breach, plus the incident response lifecycle every team follows. A calm, beginner friendly explainer. Learn https://holyghost.sh/blog/eternalblue-explained https://holyghost.sh/blog/eternalblue-explained Tue, 19 May 2026 00:00:00 GMT How a flaw in an ageing file sharing protocol, weaponised by a leaked intelligence exploit, spread ransomware across the world in hours. A breakdown of EternalBlue and MS17-010. Analysis https://holyghost.sh/blog/heartbleed-explained https://holyghost.sh/blog/heartbleed-explained Fri, 15 May 2026 00:00:00 GMT A missing length check in OpenSSL let anyone read chunks of a server's memory, including private keys and passwords. Here is how Heartbleed (CVE-2014-0160) worked and why it was so serious. Analysis https://holyghost.sh/blog/what-is-a-vpn https://holyghost.sh/blog/what-is-a-vpn Tue, 12 May 2026 00:00:00 GMT VPNs are sold as magic privacy shields. A clear headed beginner guide to what a VPN actually does, the legitimate uses, and the things it cannot do that the ads imply. Learn https://holyghost.sh/blog/shellshock-explained https://holyghost.sh/blog/shellshock-explained Fri, 01 May 2026 00:00:00 GMT For years, Bash would run code smuggled into the end of an environment variable. Shellshock (CVE-2014-6271) turned that into remote code execution across a huge slice of the internet. Analysis https://holyghost.sh/blog/directory-traversal-explained https://holyghost.sh/blog/directory-traversal-explained Mon, 27 Apr 2026 00:00:00 GMT By adding ../ to a file path, an attacker can climb out of the intended directory and read files the application never meant to expose. Here is how path traversal works and how to block it. Analysis https://holyghost.sh/blog/csrf-explained https://holyghost.sh/blog/csrf-explained Fri, 24 Apr 2026 00:00:00 GMT CSRF tricks a logged in user's browser into sending a real, authenticated request they never intended. Here is how it abuses the way browsers handle cookies, and how to shut it down. Analysis https://holyghost.sh/blog/what-is-patching https://holyghost.sh/blog/what-is-patching Mon, 20 Apr 2026 00:00:00 GMT Most breaches exploit vulnerabilities that were already fixed. A beginner friendly guide to what patching is, why it matters so much, and how teams keep on top of it. Learn https://holyghost.sh/blog/command-injection-explained https://holyghost.sh/blog/command-injection-explained Fri, 17 Apr 2026 00:00:00 GMT If an application builds a system command out of user input, an attacker can smuggle in their own commands. Here is how OS command injection works and how to design it out. Analysis https://holyghost.sh/blog/cross-site-scripting-explained https://holyghost.sh/blog/cross-site-scripting-explained Fri, 10 Apr 2026 00:00:00 GMT XSS lets an attacker run JavaScript in another user's browser session, in the context of a site they trust. Here are the three types, what they enable, and how to stop them. Analysis https://holyghost.sh/blog/what-is-a-firewall https://holyghost.sh/blog/what-is-a-firewall Tue, 07 Apr 2026 00:00:00 GMT A firewall decides which network traffic is allowed and which is blocked. A beginner friendly guide to how firewalls work, the main types, and what they can and cannot protect. Learn https://holyghost.sh/blog/sql-injection-explained https://holyghost.sh/blog/sql-injection-explained Fri, 03 Apr 2026 00:00:00 GMT SQL injection turns a login box or search field into a way to read, change, or destroy a database. Here is how it works, the flavours it takes, and the one fix that actually stops it. Analysis https://holyghost.sh/blog/what-is-malware https://holyghost.sh/blog/what-is-malware Mon, 30 Mar 2026 00:00:00 GMT Virus, worm, trojan, ransomware, spyware, rootkit. A beginner friendly guide to what malware is, the main families and how they differ, and the habits that keep it out. Learn https://holyghost.sh/blog/what-is-phishing https://holyghost.sh/blog/what-is-phishing Fri, 27 Mar 2026 00:00:00 GMT Most breaches start with a message, not a hack. A beginner friendly guide to phishing and social engineering: the common types, the warning signs, and how to not take the bait. Learn https://holyghost.sh/blog/what-is-multifactor-authentication https://holyghost.sh/blog/what-is-multifactor-authentication Thu, 19 Mar 2026 00:00:00 GMT Passwords get stolen constantly. Multifactor authentication is the cheap, powerful layer that keeps an attacker out even when they have your password. Here is how it works and which types to trust. Learn https://holyghost.sh/blog/what-is-a-password-manager https://holyghost.sh/blog/what-is-a-password-manager Mon, 16 Mar 2026 00:00:00 GMT The one tool that fixes the biggest everyday security problem: reused and weak passwords. A beginner friendly guide to what a password manager is, how it works, and why to trust one. Learn https://holyghost.sh/blog/how-https-works https://holyghost.sh/blog/how-https-works Thu, 12 Mar 2026 00:00:00 GMT A plain English walk through of what happens when you load an https site: the TLS handshake, how certificates prove identity, and why the padlock does not mean a site is safe. Learn https://holyghost.sh/blog/password-hashing-explained https://holyghost.sh/blog/password-hashing-explained Mon, 09 Mar 2026 00:00:00 GMT Why storing passwords is harder than it looks, what a salt actually does, and why a fast hash like SHA-256 is the wrong tool for the job. A plain English primer for people learning security. Learn https://holyghost.sh/blog/what-is-dns https://holyghost.sh/blog/what-is-dns Thu, 05 Mar 2026 00:00:00 GMT Every website visit starts with a lookup you never see. A beginner friendly guide to how DNS turns a name like holyghost.sh into an address, and why it matters for security. Learn https://holyghost.sh/blog/how-the-web-works https://holyghost.sh/blog/how-the-web-works Thu, 26 Feb 2026 00:00:00 GMT From typing an address to seeing a page, a lot happens in a second. A beginner friendly walk through of clients, servers, requests, and responses, the mental model the rest of web security builds on. Learn https://holyghost.sh/blog/networking-basics-ip-ports-protocols https://holyghost.sh/blog/networking-basics-ip-ports-protocols Mon, 23 Feb 2026 00:00:00 GMT The three ideas that make computer networking click: what an IP address is, what a port is, and what a protocol is. A beginner friendly foundation for everything else in security. Learn https://holyghost.sh/blog/cia-triad-explained https://holyghost.sh/blog/cia-triad-explained Thu, 19 Feb 2026 00:00:00 GMT Confidentiality, integrity, availability. A beginner friendly guide to the model that quietly sits behind almost every security control, attack, and trade off. Learn https://holyghost.sh/blog/what-is-encryption https://holyghost.sh/blog/what-is-encryption Sun, 15 Feb 2026 00:00:00 GMT Encryption in everyday language: what it means to scramble data, the difference between symmetric and asymmetric keys, how real systems combine both, and where you already rely on it every single day. Learn https://holyghost.sh/blog/what-is-cryptography https://holyghost.sh/blog/what-is-cryptography Thu, 12 Feb 2026 00:00:00 GMT Cryptography is more than encryption. A beginner friendly guide to what it actually covers, and the difference between encrypting, hashing, signing, and encoding that trips almost everyone up. Learn https://holyghost.sh/blog/threat-vulnerability-risk-exploit https://holyghost.sh/blog/threat-vulnerability-risk-exploit Sun, 08 Feb 2026 00:00:00 GMT Four words used constantly in security, and constantly confused. A simple analogy that makes the difference between threat, vulnerability, risk, and exploit stick for good. Learn https://holyghost.sh/blog/buffer-overflow-explained https://holyghost.sh/blog/buffer-overflow-explained Wed, 04 Feb 2026 00:00:00 GMT One of the oldest and most influential classes of vulnerability. How writing more data than a buffer can hold lets an attacker corrupt memory and seize control, and the defences that now stand in the way. Analysis https://holyghost.sh/blog/what-is-zero-trust https://holyghost.sh/blog/what-is-zero-trust Sat, 31 Jan 2026 00:00:00 GMT The old model trusted anything inside the network. Zero trust throws that away and verifies every request, wherever it comes from. A beginner friendly guide to the idea and why it took over. Learn https://holyghost.sh/blog/insecure-deserialization-explained https://holyghost.sh/blog/insecure-deserialization-explained Tue, 27 Jan 2026 00:00:00 GMT Turning saved data back into live objects sounds harmless. When the data comes from an attacker, it can lead to remote code execution. Here is how insecure deserialization works and how to avoid it. Analysis https://holyghost.sh/blog/linux-file-permissions https://holyghost.sh/blog/linux-file-permissions Mon, 19 Jan 2026 00:00:00 GMT Those cryptic strings like rwxr-xr-x are simpler than they look. A beginner friendly guide to Linux file permissions, what the letters and numbers mean, and how to set them safely. Learn https://holyghost.sh/blog/xxe-explained https://holyghost.sh/blog/xxe-explained Thu, 15 Jan 2026 00:00:00 GMT XML has a feature that lets a document pull in outside content. Point it at a local file or an internal server and a helpful parser becomes a data leak. Here is how XML External Entity attacks work. Analysis https://holyghost.sh/blog/what-is-a-soc https://holyghost.sh/blog/what-is-a-soc Mon, 12 Jan 2026 00:00:00 GMT A Security Operations Centre is the people and tools that monitor, detect, and respond to threats around the clock. A beginner friendly guide to what a SOC does and who works in one. Learn