Hands-on technology executive and security architect. Built GovCon Enclave from concept to the platform behind Rimstorm's 2026 acquisition.https://stevenfoerster.com/https://stevenfoerster.com/notes/cve-2026-69321/https://stevenfoerster.com/notes/cve-2026-69321/Microsoft acknowledged my report of CVE-2026-69321, a Windows Power Dependency Coordinator tampering vulnerability published September 8, 2026.Tue, 08 Sep 2026 00:00:00 GMThttps://stevenfoerster.com/notes/joseph-ii-cmmc-reform/https://stevenfoerster.com/notes/joseph-ii-cmmc-reform/Joseph II learned that good reforms stall when their machinery outruns their constituency. CMMC now faces the same test.Wed, 19 Aug 2026 00:00:00 GMThttps://stevenfoerster.com/notes/base-rate-analyst-feedback-loops/https://stevenfoerster.com/notes/base-rate-analyst-feedback-loops/Good analysts run on calibrated priors. Those priors only stay calibrated when the triage queue talks back to them.Wed, 05 Aug 2026 00:00:00 GMThttps://stevenfoerster.com/notes/copy-fail-and-dirty-frag-page-ownership-invariant/https://stevenfoerster.com/notes/copy-fail-and-dirty-frag-page-ownership-invariant/Copy Fail and Dirty Frag, three Linux CVEs in ten days, share one root cause: in-place crypto fast paths that write over paged fragments they do not own.Fri, 17 Jul 2026 00:00:00 GMThttps://stevenfoerster.com/notes/compliance-is-kind-threats-are-wicked/https://stevenfoerster.com/notes/compliance-is-kind-threats-are-wicked/CMMC L2 is a kind sub-environment bolted onto a wicked one. The job is bridging the two without letting kind absorb wicked. The failure mode is theater.Sat, 13 Jun 2026 00:00:00 GMThttps://stevenfoerster.com/notes/red-team-findings-engineering-fixes/https://stevenfoerster.com/notes/red-team-findings-engineering-fixes/Red teams find vulnerabilities. Engineering teams ship features. The gap between finding and fixing is where security programs quietly fail.Mon, 18 May 2026 00:00:00 GMThttps://stevenfoerster.com/notes/why-most-security-platforms-collapse-under-operational-complexity/https://stevenfoerster.com/notes/why-most-security-platforms-collapse-under-operational-complexity/The threat model is only the beginning. A security platform also has to survive telemetry growth, retention demands, index debt, and customer variance.Mon, 11 May 2026 00:00:00 GMThttps://stevenfoerster.com/notes/defaults-are-the-only-security-control-that-scales/https://stevenfoerster.com/notes/defaults-are-the-only-security-control-that-scales/Every checkbox on the paved road taxes traffic off it. The real product of a platform team is the default every team inherits by doing nothing.Mon, 27 Apr 2026 00:00:00 GMThttps://stevenfoerster.com/notes/unit-economics-of-deception/https://stevenfoerster.com/notes/unit-economics-of-deception/Deception is a rare defense where each detection burns attacker resources at near-zero defender cost. A week of data from my site, and why few programs use it.Mon, 20 Apr 2026 00:00:00 GMThttps://stevenfoerster.com/notes/why-prompt-injection-is-unsolvable/https://stevenfoerster.com/notes/why-prompt-injection-is-unsolvable/Prompt injection is structural in any system that mixes instructions and untrusted data in one context, not a patchable prompting bug.Thu, 09 Apr 2026 00:00:00 GMThttps://stevenfoerster.com/notes/fhe-llm-inference-the-hardest-problem-in-private-ai/https://stevenfoerster.com/notes/fhe-llm-inference-the-hardest-problem-in-private-ai/Running LLMs on fully encrypted data is theoretically sound and practically brutal. Here is where the research stands and what actually works today.Mon, 06 Apr 2026 00:00:00 GMThttps://stevenfoerster.com/notes/litellm-supply-chain-attack-and-the-case-for-butler/https://stevenfoerster.com/notes/litellm-supply-chain-attack-and-the-case-for-butler/The LiteLLM compromise is a useful threat-model test for Butler, a smaller proxy I maintain for local Ollama deployments.Thu, 26 Mar 2026 00:00:00 GMThttps://stevenfoerster.com/notes/why-memory-safety-is-a-language-property/https://stevenfoerster.com/notes/why-memory-safety-is-a-language-property/Why Rust and Go are memory safe and type safe while C is not, and why you cannot simply fix this with a better C compiler.Tue, 24 Mar 2026 00:00:00 GMThttps://stevenfoerster.com/notes/open-source-vulnerability-visibility/https://stevenfoerster.com/notes/open-source-vulnerability-visibility/The xz incident shows why inspectability, release provenance, and independent verification matter, not that open source is inherently safer.Fri, 20 Mar 2026 00:00:00 GMThttps://stevenfoerster.com/notes/solarwinds-teardown/https://stevenfoerster.com/notes/solarwinds-teardown/How attackers compromised a closed-source build pipeline, shipped a backdoor to 18,000 organizations via a routine update, and hid for nine months.Fri, 20 Mar 2026 00:00:00 GMThttps://stevenfoerster.com/notes/rust-ebpf-linux-observability/https://stevenfoerster.com/notes/rust-ebpf-linux-observability/eBPF has meant writing C and fighting the verifier. Rust and the aya framework change that: type safety, no libbpf, one cargo build for kernel and userspace.Tue, 17 Mar 2026 00:00:00 GMThttps://stevenfoerster.com/notes/shellshock-teardown/https://stevenfoerster.com/notes/shellshock-teardown/How a 25-year-old Bash parsing bug allowed remote code execution through environment variables, and why it took multiple patches to fix.Fri, 13 Feb 2026 00:00:00 GMThttps://stevenfoerster.com/notes/xz-backdoor-teardown/https://stevenfoerster.com/notes/xz-backdoor-teardown/A sourced teardown of the xz 5.6.0 and 5.6.1 backdoor, from release-tarball tampering to liblzma loading inside selected OpenSSH builds.Fri, 06 Feb 2026 00:00:00 GMThttps://stevenfoerster.com/notes/leading-small-teams-that-punch-above-their-weight/https://stevenfoerster.com/notes/leading-small-teams-that-punch-above-their-weight/What leading eight missionaries through cyclone season taught me about building small engineering teams that outperform their headcount.Mon, 02 Feb 2026 00:00:00 GMThttps://stevenfoerster.com/notes/log4shell-teardown/https://stevenfoerster.com/notes/log4shell-teardown/How a message interpolation feature in Log4j turned every Java app into an unauthenticated RCE target, and what the response revealed about supply chains.Fri, 23 Jan 2026 00:00:00 GMThttps://stevenfoerster.com/notes/hidden-cost-of-exceptions/https://stevenfoerster.com/notes/hidden-cost-of-exceptions/Exceptions feel harmless in the moment. Over time they become the slow leak that drains security programs.Fri, 03 Oct 2025 00:00:00 GMThttps://stevenfoerster.com/notes/productizing-infrastructure/https://stevenfoerster.com/notes/productizing-infrastructure/What cutting enclave deployment from two weeks to two hours taught me about one codebase, fleet operations, and saying no to forks.Fri, 19 Sep 2025 00:00:00 GMThttps://stevenfoerster.com/notes/security-architecture-vs-operations/https://stevenfoerster.com/notes/security-architecture-vs-operations/Security architecture defines the promises; security operations keeps them. When those two drift, the organization pays the bill.Fri, 05 Sep 2025 00:00:00 GMThttps://stevenfoerster.com/notes/shellcode-under-constraints/https://stevenfoerster.com/notes/shellcode-under-constraints/Techniques for crafting exploit payloads when buffer space is limited, bad characters are abundant, and mitigations restrict your options.Fri, 29 Aug 2025 00:00:00 GMThttps://stevenfoerster.com/notes/private-ai-in-your-soc-how-to-run-llms-locally/https://stevenfoerster.com/notes/private-ai-in-your-soc-how-to-run-llms-locally/Operating LLMs locally can help analysts summarize and triage sensitive telemetry without shipping data to third-party services.Mon, 11 Aug 2025 00:00:00 GMThttps://stevenfoerster.com/notes/wireguard-multi-tenancy-with-iptables/https://stevenfoerster.com/notes/wireguard-multi-tenancy-with-iptables/How Mistborn gave every WireGuard client its own server instance, generated firewall rules per device, and kept Docker from punching holes in the host.Mon, 10 Mar 2025 00:00:00 GMThttps://stevenfoerster.com/notes/zero-trust-without-automation/https://stevenfoerster.com/notes/zero-trust-without-automation/Zero Trust needs sound identity, policy, and enforcement. Automation keeps those controls current as systems and people change.Mon, 01 Jan 2024 00:00:00 GMT