Jonathans Blog

Kali Linux 2026.2 shipped nine new tools, GNOME 50/KDE 6.6, and faster VM boot times.

Claude Code hooks run your own script before or after a tool call.

iSH gives you Alpine Linux on your iPhone, and apk is how you fill it with tools.

TypeScript 7.0 replaces the JavaScript-based compiler with a native Go port, with Microsoft quoting 8-12x faster full builds.

Handoff lets you start something on your iPhone and pick it up on your Mac.

p0f identifies operating systems passively, by matching the traffic it observes against its fingerprint database, and the same signals can reveal NAT.

Nmap OS detection works by sending a series of specially crafted TCP, UDP and ICMP probes and comparing the replies against a database of known operating systems.

OpenAI has open-sourced the Codex Security CLI and SDK under Apache-2.0.

How to point Zed's Agent Panel at Ollama or LM Studio, which settings matter, and how to avoid the context and tool-calling traps that make local models look worse than they are.

The final post in this series: Composio's connect-apps plugin gives Claude working access to Gmail, Slack, GitHub and other everyday services through a single uniform execution layer.

Unified memory decides which models fit and memory bandwidth decides how fast they run, so here is how the Mac mini and Mac Studio actually differ once you start loading local LLMs.

WordPress 6.9's Abilities API lets a site register discoverable, permission-checked capabilities that AI agents and MCP-style tools can call directly - what it is, how it differs from a REST route, and how to register your first ability.

GEF is Kali Linux 2026's GDB extension for exploit development and reverse engineering - register/stack/heap visualisation, pattern-matching commands, and how it compares to PEDA and pwndbg.

A step-by-step beginner's guide to using Jev as a guardrail that blocks destructive commands before an AI coding agent can run them.

Balbix turns exposure data into dollar-denominated risk quantification, aimed at security leaders who need to justify remediation spend in board-level terms.

Apple Watch Series 12 and Ultra 4 launched alongside the iPhone 18 Pro with a genuinely new health-sensing system and the Readiness feature - what changed, how the two models differ, and whether it's worth upgrading.

How tool calling works in practice: defining schemas, writing the agentic loop by hand, letting the SDK drive it, and avoiding the loops that never terminate.

Cymulate combines breach and attack simulation with exposure management, so teams can test whether a fix actually closes an attack path instead of just assuming it does.

A practical guide to running Suricata IDS on a home network: install, getting a copy of the traffic, ET Open rules, a real alert in eve.json, suppression that works, and what hardware you need.

XM Cyber pioneered attack path management - continuously simulating attacker movement across hybrid environments to find the choke points worth fixing first.

AdaptixC2 is Kali Linux 2026's new Golang-based, open-source command-and-control framework for authorised red-team engagements - what it does, how it's structured, and how it compares to Cobalt Strike, Sliver and Mythic.

Jev keeps showing up in AI agent guardrail code.

A guide to METATRON - the open-source AI penetration testing assistant that runs entirely locally via Ollama, keeping client data off cloud APIs while providing LLM-powered vulnerability analysis.

Claude Skills package a SKILL.md file plus scripts into a reusable, on-demand playbook for a recurring task - how they work, how they differ from subagents and CLAUDE.md, and how to write one that actually triggers reliably.

Claude Skills package a SKILL.md file plus scripts into a reusable, on-demand playbook for a recurring task - how they work, how they differ from subagents and CLAUDE.md, and how to write one that actually triggers reliably.

Vector RAG can't follow relationships across documents.

fzf turns any list into an interactive, type-to-narrow picker.

A guide to Microsoft Security Exposure Management, which turns existing Defender and Entra ID telemetry into attack surface maps and initiative-based exposure scoring.

Part ten: the Zero plugin gives Claude Code runtime access to thousands of tools, APIs and services, discovered and paid for on demand rather than pre-configured with individual API keys.

WP Probe is a new Kali Linux 2026 tool for fingerprinting WordPress plugins and themes and correlating them against known vulnerabilities - how it works and how it compares to WPScan.

A walkthrough of how to actually find and analyse malicious PHP dropped into a compromised WordPress install - grep, malware scanners, obfuscation patterns, and how to confirm what you've found.

Part nine: obra's private-journal-mcp gives Claude a multi-section private journal with semantic search - feelings, project notes, technical insights, and user context, stored locally.

A code-first walkthrough of making your first LLM API call in Python: the messages shape, system prompts, streaming with the official SDK, real error handling, and counting tokens before you send.

A practical comparison of the main tools for finding SQL injection - blackbox scanners like sqlmap, whitebox static analysers like RIPS, and where each one actually earns its place in a workflow.

How to stand up Wazuh SIEM with Docker, get agents reporting, read a real brute-force alert end to end, tune out the noise, and what it honestly costs you in RAM and disk.

Axiom turns a single pentesting toolkit into a fleet of disposable cloud instances you can spin up and tear down in minutes - built for the kind of large-scope scanning a laptop just can't do fast enough.

A comprehensive guide to John the Ripper and Hashcat on Kali Linux - covering hash identification, wordlist attacks, mask attacks, rules, file password cracking, and extracting hashes from Meterpreter.

ripgrep is a faster, gitignore-aware replacement for grep.

Docker-OSX packages macOS as a Docker container image, letting you spin up disposable macOS instances for testing, CI, or app builds without dedicated Apple hardware - within Apple's licensing limits.

A complete practical guide to THC-Hydra on Kali Linux - covering wordlists, SSH, HTTP form authentication, rate limiting to avoid lockouts, and targeted wordlist generation with CeWL.

CSPM alone only ever saw configuration drift - CNAPP in 2026 bundles posture, workload protection, identity entitlements and Kubernetes checks into one platform.

Network Security Toolkit (NST) is a bootable Linux distro built specifically for network analysis and monitoring, with a web-based interface most pentesting distros don't bother with.

Part eight: reporecall indexes a codebase with tree-sitter and call-graph traversal, then injects relevant context before Claude starts thinking, instead of re-reading files from scratch every session.

Astro 5.0 ships zero client-side JavaScript by default and makes you opt in per component - a genuinely different starting point from meta-frameworks for content-heavy sites.

Siri AI, Call Context and the new Photos editing tools are now testable in the iOS 27 developer beta - here's what's changed since the WWDC26 recap and what to check in your app this week.

Immich is the self-hosted, AI-powered Google Photos replacement missing from this blog's Pi home-server stack - here's how to run it on a Raspberry Pi 5 and pair it with Tailscale.

SQL injection is still found by brute-forcing pages with tools like sqlmap - but static analysis can catch it in the source code before it ever ships.

Frigate paired with a Coral Edge TPU turns a Raspberry Pi 5 into a real self-hosted NVR with object detection, without pinning the CPU - the missing piece in this blog's Pi 5 home server stack.

Pentest-as-a-Service platforms are replacing static PDF reports with real-time, continuously-updated dashboards - here's what that actually adds and what to check before you switch.

Every PHP and Laravel guide on the blog in one place - the modern Laravel ecosystem (Octane, Horizon, Telescope, Reverb, and more), debugging setups, CI/CD, and production practices.