Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

Should AI Code Generators Get CVEs for Insecure Suggestions?

A security researcher's experiment with PyCharm's local AI autocompletion raises tough questions about responsibility and vulnerability disclosure.

Article · 2mos ago0

The Blunt Instrument of AI Safety: Why Researchers Are Fuming Over Anthropic's Fable Guardrails

Anthropic's public release of its Fable model reveals the messy reality of LLM guardrails, where asking for secure code is treated like writing malware.

Article · 2mos ago0

The Lexical Trap: Why Anthropic's Fable Guardrails Are Tripping Up Developers

Anthropic's public release of its cybersecurity-focused model Fable was meant to democratize secure coding. Instead, aggressive keyword-based guardrails are locking out basic tasks like code reviews.

Article · 2mos ago1

Chrome Strips the Last Manifest V2 Escape Hatches — Time to Audit Your Browser Tooling

Google is deleting the feature flags that kept uBlock Origin and other MV2 extensions alive in Chrome. Edge and Opera are lining up behind it — and anyone leaning on webRequest-style blocking in headless or test stacks should plan accordingly.

News · 2mos ago2

Eyes Open, Vulnerabilities Shipping: The AI Code Security Paradox

A Checkmarx survey of 2,350 developers and security leaders finds 70% believe AI-generated code is more vulnerable — and nearly a third ship it to production anyway. The tools exist. The process doesn't.

Article · 2mos ago0

Microsoft Pulls Dozens of GitHub Repos After Supply-Chain Malware Targets AI Coders' Credentials

Hackers slipped password-stealing code into Microsoft open-source projects tied to Azure and AI coding workflows. Here's the attack vector — and what to audit in your own pipeline.

News · 2mos ago5

Miasma Worm Hits Microsoft Packages Twice in Weeks — and Your SLSA Provenance Won't Save You

The Miasma credential stealer has now compromised the same Microsoft GitHub account twice, defeating cryptographic supply-chain guarantees and triggering silently when developers open packages in AI coding agents.

Article · 2mos ago1

Arbitrary Code Execution in objdump -g: How a Missing Bounds Check Becomes a Full Exploit

A heap out-of-bounds write in the FR30 relocation handler lets a crafted object file run attacker code when inspected with `objdump -g` — and the exploit defeats ASLR, PIE, and heap hardening in a single shot.

Article · 2mos ago0

uv Gets Built-In Vulnerability and Malware Scanning

Astral's uv package manager adds `uv audit` and optional install-time malware checks powered by OSV, closing supply-chain gaps that separate tooling can't easily address.

News · 2mos ago1

Massachusetts' Location-Data Ban Is a New Compliance Line for Mobile and Analytics Devs

The state's Consumer Data Privacy Act blanket-bans selling precise geolocation data — and because it covers visitors too, any app touching MA users is in scope.

News · 2mos ago5

Designing Payment Infrastructure That Starts With the Threat Model

A technical deep-dive into process isolation, HSM-backed key management, and the architectural choices that shrink your PCI DSS scope before you write a single control.

Article · 2mos ago0

Config Files That Run Code: The Supply Chain Blind Spot Nobody Is Auditing

The Miasma worm didn't need a malicious dependency. It used .claude/settings.json, .vscode/tasks.json, and package.json to detonate a credential stealer — before you read a single line of code.

Article · 2mos ago0

Trivy: One Scanner to Rule Your Containers, Repos, and Kubernetes Configs

Instead of stitching together five different security tools, Trivy handles CVEs, misconfigs, secrets, and SBOM generation across every target in your pipeline — from a single CLI.

Article · 2mos ago0

Config Files That Run Code: The Supply Chain Blindspot You're Probably Not Auditing

The Miasma worm hid a credential-stealing dropper inside ordinary config files for VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler. Here's exactly how each vector works — and what to review before you clone.

Article · 2mos ago0

1,000 Breaches In, and Companies Are Taking Longer Than Ever to Tell You

Troy Hunt's Have I Been Pwned milestone exposes a darkening pattern: breach victims — and the developers who depend on breached services — are flying blind for weeks while data circulates freely on hacking forums.

Article · 2mos ago0