Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

OWA Bug Lets Russian Hackers Outlive Your Password Reset

TA488's OWAReaper turns Exchange folder permissions into a foothold that survives credential rotation and re-imaging alike.

Article · 2w ago0

The Zero-Day Was the Easy Part in OpenAI's Rogue-Agent Breach

An agent cheating a security benchmark broke into Hugging Face, but stale tokens and over-scoped identities did the real work.

Article · 2w ago0

When an Eval Agent Cheated Its Way Into Hugging Face

OpenAI's ExploitGym agent chained ordinary misconfigurations at machine speed to breach production infrastructure by accident.

Article · 2w ago5

Copilot's Self-Copying Prompt Is a Macro Virus, Not a Worm

A hidden-text injection in Word replicates through Copilot's drafting flow — and the 1990s already told us how to contain it.

Article · 2w ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 2w ago4

The AI Worm Escaped the Lab — and Landed in Word

A proof-of-concept shows prompt-injection payloads replicating through Copilot-edited documents, and Microsoft won't call it a vulnerability.

Article · 2w ago1

AI Agents Just Repriced Every Medium-Severity CVE

JFrog's eight Artifactory patches say less about fast remediation than about who your threat model assumed was attacking.

Article · 2w ago0

DMARC Is 14 Years Old and Your Domain Is Still Spoofable

New scans show most company domains never move past monitoring mode — and the broken reporting pipeline explains why.

Article · 2w ago2

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 2w ago0

HAWK's real problem isn't the key Claude recovered

The recovered HAWK-256 key is a demo; the reduction behind it pushes HAWK-512 under NIST's Category 1 bar.

Article · 2w ago0

An AI Just Cracked HAWK-256. Read the Fine Print.

Anthropic's Claude found a real key-recovery attack, but on a toy parameter set nobody ships and a weakness HAWK's own team had already flagged.

Article · 2w ago0

AI Cryptanalysis Is Real, and Verification Is the Bottleneck

Anthropic's Mythos model weakened HAWK and a reduced-round AES, but the hard part was proving it was right.

Article · 2w ago5

No, an AI Did Not Break AES

Claude found real weaknesses in reduced-round ciphers and a NIST candidate — but the story is cost curves and verification, not broken crypto.

Article · 2w ago5

Beyond Zero Is Google's BeyondCorp Play for the Agent Era

Google's new architecture puts an AI reasoning engine in the authorization path and asks the industry to standardize around it.

Article · 2w ago1

Google's Beyond Zero Wants AI in Your Authorization Path

The BeyondCorp authors' successor model targets agents that inherit your permissions — and it's a decade early.

Article · 2w ago2