Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

The 16-Year Race Hiding in SQLite's WAL

Tailscale's corruption post-mortem and a 15-minute simulated repro expose the bug class coverage metrics can't see.

Article · 18h ago0

Defender Is Now Windows' Most Reliable Path to SYSTEM

A second Defender patch bypass in two months says the bug class, not the bug, is the real problem.

Article · 1d ago0

Fake ClaudeBots Are Scanning for Your AI Credentials

A spoofing campaign probing for Claude settings and .env files shows user-agent strings were never identity.

Article · 1d ago0

Fake ClaudeBot Is the New Fake Googlebot

Mass vulnerability scans are hiding behind AI crawler user-agents, hunting the credential files AI coding tools leave behind.

Article · 1d ago0

The 16-Year-Old SQLite Bug That Ate Tailscale's Data

The WAL-reset race survived the industry's most-tested codebase, because "rare" turned out to depend entirely on your workload.

Article · 1d ago1

AI Bug Hunters Just Broke OpenSSH's Release Calendar

Version 10.5 lands five weeks after 10.4, and the project says on-demand security releases are the new normal.

Article · 1d ago1

Patch afd.sys First, Argue About the Other 397 Later

Lazarus burned another zero-day in Windows' socket driver to load its FudModule rootkit — again.

Article · 2d ago0

OpenSSH 10.5 Rewrites Its Release Clock for the AI Era

Three real fixes ship early because AI-assisted bug hunters keep rediscovering the same holes.

Article · 2d ago0

The Labs' Hidden Reasoning Was Never Actually Hidden

A weak sibling model will decrypt a frontier model's chain-of-thought for you, no jailbreak required.

Article · 2d ago4

Ransomware Comes for On-Prem SharePoint, Again

CISA's ransomware flag on a patched SharePoint RCE replays the ToolShell playbook against servers that just lost Microsoft support.

Article · 2d ago0

One Slow Instruction Breaks SMM's Core Guarantee

A second-long memory load desynchronizes CPU cores, reviving a dormant class of firmware TOCTOU bugs.

Article · 2d ago0

One Missing Firestore Rule Exposed 181,874 Meetings

The tl;dv leak is a Firebase story first, and a warning about how much access AI notetakers concentrate.

Article · 3d ago2

The AI Didn't Go Rogue. The Test Bench Did.

Three frontier labs watched models reach the live internet during evals — the weak link is test infrastructure, not the AI.

Article · 3d ago0

Claude Code's Permission Prompt Isn't a Security Boundary

Version 2.1.223 patches four more permission bypasses, but the fixes keep hitting the same fault line: a text matcher trying to parse the shell.

Article · 4d ago0

Ransomware Gangs Have Discovered Middle Management

New Zscaler data shows attackers optimizing for approval authority and business access, not admin rights or executive titles.

Article · 4d ago0