Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Canio Campaniello
Secrets Management in Internal Developer Platforms: Why Your Golden Path Might Be a Golden Ticket
TL;DR — Key Takeaways Golden paths often need credentials for repositories, CI/CD and cloud resources, creating risk when one broadly scoped token is reused across many services. CVE-2025-55285 in Backstage showed how secrets passed through scaffolding workflows could leak into logs, expanding the secrets attack surface. Safer designs use per-service identities, external secrets managers, least privilege and tighter controls around logs and scaffolding pipelines.
A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token
AI coding agents don’t just suggest code anymore. Tools like OpenAI’s Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get the job done — which means every agent your team wires up is also a new privileged identity, holding real access, running with comparatively little of the scrutiny a human with that same access would get. In March, BeyondTrust’s Phantom Labs disclosed a critical command injection vulnerability in Codex.
SASE Won’t Stop Kerberos Delegation Abuse: The Identity-Layer Blind Spot in Modern Enterprise Networks
Enterprises have spent the last five years converging networking and security into SASE. Identity-aware access, inline inspection, microsegmentation — all designed to stop an attacker from moving freely once they land inside the perimeter. And yet breach reports keep showing the same pattern: initial access happens at the edge, but the damage happens deep inside Active Directory, where SASE controls have almost no visibility. The gap isn’t a product failure. It’s architectural.
Why Kubernetes RBAC Misconfigurations Are the Easiest Privilege Escalation You’ll Ever Find
Ask any penetration tester which part of a Kubernetes assessment reliably produces a finding, and RBAC comes up almost every time. Not because Kubernetes’ permission model is poorly designed — it’s genuinely thorough — but because it’s flexible enough that teams misconfigure it in the same handful of ways, over and over, across completely unrelated organizations.
Pentesting statt Scanning: Logikfehler & SQL Injection
Stand: 08.12.2025 Es ist für uns eine Selbstverständlichkeit, dass wir verantwortungsvoll mit Ihren personenbezogenen Daten umgehen. Sofern wir personenbezogene Daten von Ihnen erheben, verarbeiten wir diese unter Beachtung der geltenden Datenschutzvorschriften. Detaillierte Informationen finden Sie in unserer Datenschutzerklärung. Ich bin damit einverstanden, dass die Vogel IT-Medien GmbH, Max-Josef-Metzger-Straße 21, 86157 Augsburg, einschließlich aller mit ihr im Sinne der §§ 15 ff.
Black Hat, White Hat, Grey Hat: Understanding the People Behind Cybersecurity
Say “hacker” to most people and they picture the same thing — dark room, hoodie, something dramatic unfolding on a screen. That image has been everywhere for so long it’s become background noise. The reality is less cinematic and considerably more relevant to anyone actually working in security in 2026. The hat colors come from old Westerns — white for the good guy, black for the villain. Simple framing, but not useless. Same tools, same techniques, same understanding of how systems break.
Data Observability for AI and ML Pipelines: Why Data Health Monitoring Matters
Walk into most engineering teams and you’ll find dashboards for everything. Everything except what’s actually flowing through the system. Ask an engineer what they track in a live ML deployment. You’ll get the full tour — latency dashboards, error rate alerts, compute utilization graphs. Useful? Sure. But then ask whether they’re watching feature distributions, schema consistency, or data freshness. That’s where the conversation stalls.
The Cybersecurity Roadmap for 2026: Where to Start, Where to Go, and What Actually Matters
The cybersecurity industry has a hiring problem that isn’t getting better. ISC2’s latest Cybersecurity Workforce Study puts the global shortfall at 4.8 million unfilled positions — up 19 percent year over year, even as active hiring stalled. ISACA found that 55 percent of security teams are currently understaffed and 38 percent take three to six months to fill a role even at entry level. Meanwhile, IBM found that 87 percent of organizations reported an AI-driven cyberattack in the past year.
Privilege escalation su Linux: anatomia delle tecniche più sfruttate nei penetration test del 2026
La fase di privilege escalation rappresenta uno dei principali fattori di rischio nei test di sicurezza moderni, spesso più determinante dell’accesso iniziale. È silenziosa, spesso automatizzabile, e si fonda quasi sempre su configurazioni errate che esistono di default in sistemi che non hanno mai ricevuto un hardening esplicito.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Canio
Contact Canio, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack