Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

Ransomware's New Favorite Target Is Middle Management

Victim data and FBI advisories converge on a blind spot: broad access, thin scrutiny, mid-level accounts.

Article · 4d ago0

CSS alone can steal passwords from your webmail

PortSwigger's Gareth Heyes turned a decade of CSS injection tricks into working account takeovers on Outlook, Gmail and more.

Article · 4d ago0

The AI Didn't Go Rogue. The Test Bed Did.

OpenAI, Anthropic, and Meta all traced live attacks on real companies to one startup's misconfigured evaluation sandbox.

Article · 4d ago4

Your Oracle Database Can Run Malware, and Someone Did

A routine SQL injection became SYSTEM-level RCE because the app account could compile Java, no CVE required.

Article · 4d ago2

The AI Sandbox Escapes Are Mostly Just Open Doors

Only one of four frontier-lab incidents was a real escape. The rest expose how broken agent isolation actually is.

Article · 5d ago0

npm's Frictionless Publish Era Is Over

GitHub's new npm and Actions defaults trade release speed for survivability — and the signing debate misses why.

Article · 5d ago0

The x86 CPU Backdoor That Was Hiding in the Datasheet

VIA's C3 chips let userland code jump straight to ring 0 — and the mechanism was documented years before anyone called it a backdoor.

Article · 5d ago2

Synced Passkeys Have a Malware Problem

Unit 42's Pass-ta-key attacks steal Google passkeys from a compromised endpoint without breaking any crypto.

Article · 5d ago2

AI Crawlers Broke the Web's Oldest Bargain

One site's server logs show the crawl-for-referrals deal is dead, and per-site firewalls can't fix it.

Article · 6d ago1

Metabase's 0-Day Burned Framework. Self-Hosters Are Next

An unauthenticated SQL injection in a password-reset endpoint turned a BI dashboard into an exfiltration pipeline.

Article · 6d ago1

Framework's Metabase Breach Wasn't a Patching Failure

A CVSS 10.0 zero-day hit Metabase Cloud, and every column piped into analytics became breach-notification surface.

Article · 6d ago1

Zapscape Is KVM's Third Guest-Escape Bug This Year

The shadow MMU's reclaim path is the newest place a nested guest can corrupt the host kernel and take root.

Article · 1w ago0

When the Model Never Runs, Your Guardrails Don't Either

Black Hat research exposes forged tool calls in AWS, Google, and Vercel agent stacks, patched quietly in July.

Article · 1w ago0

Attackers Are Compiling Their Shells Inside Oracle Itself

The technique dates to 2006; the privilege grant that enables it is still sitting in most application schemas.

Article · 1w ago2

AI Broke a Post-Quantum Candidate, Not Your Encryption

Anthropic's HAWK and AES results point in opposite directions, and the gap maps where machine cryptanalysis goes next.

Article · 1w ago0