<feed xmlns="http://www.w3.org/2005/Atom"> <id>https://matthildom.dev/</id><title>Security Labs &amp; Writeups</title><subtitle>Security Labs, Vulnerability Management, and Malware Analysis writups by Matt Hildom</subtitle> <updated>2026-10-20T14:50:22-04:00</updated> <author> <name>Matt Hildom</name> <uri>https://matthildom.dev/</uri> </author><link rel="self" type="application/atom+xml" href="https://matthildom.dev/feed.xml"/><link rel="alternate" type="text/html" hreflang="en" href="https://matthildom.dev/"/> <generator uri="https://jekyllrb.com/" version="4.4.1">Jekyll</generator> <rights> © 2026 Matt Hildom </rights> <icon>/assets/img/favicons/favicon.ico</icon> <logo>/assets/img/favicons/favicon-96x96.png</logo> <entry><title>Emergency Rebuild: Moving a HIPAA Research Platform Off RHEL 7 in Under Three Weeks</title><link href="https://matthildom.dev/posts/emergency-rhel9-rebuild/" rel="alternate" type="text/html" title="Emergency Rebuild: Moving a HIPAA Research Platform Off RHEL 7 in Under Three Weeks" /><published>2026-10-20T14:00:00-04:00</published> <updated>2026-10-20T14:43:16-04:00</updated> <id>https://matthildom.dev/posts/emergency-rhel9-rebuild/</id> <content type="text/html" src="https://matthildom.dev/posts/emergency-rhel9-rebuild/" /> <author> <name>Matt Hildom</name> </author> <category term="Case Studies" /> <category term="Vulnerability Response" /> <summary>Details about the organization, hostnames, network layout, and vendor-specific configuration have been left out or generalized on purpose. TL;DR A research data platform we ran on a single RHEL 7 server was months out on our migration list. Then the vendor warned us that a threat actor was actively exploiting legacy, internet-exposed instances of it. We locked it down with compensating contr...</summary> </entry> </feed>
