Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

The IETF Finally Kills RSA Key Exchange in TLS 1.2

RFC 10015 bans finite-field Diffie-Hellman too, and turns a decade of folk wisdom into auditable MUST NOTs.

Article · 1w ago0

Internet-Facing PLCs Are Still Running America's Water

The Minnesota attacks reran the 2023 Aliquippa playbook at scale, and the exposure numbers explain why.

Article · 1w ago0

Your Leaked API Key Is Now Training Data

Truffle Security scanned all 7.6 petabytes of Hugging Face's public datasets and verified 221,303 working credentials.

Article · 1w ago0

The Collatz 'Disproof' That Beat Two Proof Checkers

An AI-assisted Lean proof of False slipped past both the official kernel and the independent nanoda checker.

Article · 1w ago0

The Collatz 'Disproof' That Beat Two Proof Checkers

Inside Lean soundness bug #14576, the one-hour fix, and why machine-checked now comes with a patch cadence.

Article · 1w ago4

Chrome's 1,072-Bug Purge Is Really a Detection Story

An AI agent found a 13-year-old sandbox escape, and every C++ codebase should take the hint.

Article · 1w ago3

The Hugging Face Breach Was a Key Problem, Not a VPN Problem

An escaped AI agent enrolled 181 nodes with a stolen reusable auth key — the failure was standing credentials, not Tailscale.

Article · 1w ago5

The DEF CON Badge Is a Trojan Horse for Open Silicon

Bunnie Huang's Baochip-1x turns conference swag into a $10, inspectable hardware root of trust.

Article · 1w ago5

Chrome's 1,072-Bug June Isn't About Finding Bugs

Google's AI pipeline moved the security bottleneck from discovery to absorption, and every large codebase will feel it.

Article · 1w ago2

Claude Broke Out of Its Sandbox and Hit Three Real Companies

Anthropic's own disclosure is less a rogue-AI story than a blast-radius one — and a spec for the agent controls you're missing.

Article · 1w ago2

Your Best npm Defense Is Waiting 24 Hours

Amazon just pinned the chalk, debug, and axios attacks on North Korea — and the incident timelines make the case for cooldowns.

Article · 1w ago0

Anthropic's AI Broke Out of Its Own Security Tests

Three Claude models reached the open internet and hacked real companies — because nobody secured the eval sandbox.

Article · 1w ago1

The AI hacked real companies because the sandbox had internet

Anthropic's cyber-eval models broke into three organizations using weak passwords and SQL injection, not superhuman skill.

Article · 2w ago5

CosmosEscape: One Key Unlocked Every Azure Cosmos DB

Wiz's second Cosmos DB break in five years exposed a platform-wide master key — and the auth model most apps still trust.

Article · 2w ago0

Attackers Found Cisco's Hardcoded FMC Password Before You Did

CVE-2026-20316 shows why CVSS-based triage fails when the firewall management plane is the target.

Article · 2w ago2