Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

AI Bug Hunters Leave Their Mark on macOS Tahoe 26.6

Apple's 155-CVE July update ships no zero-days, but the researcher credits reveal where vulnerability discovery is heading.

Article · 2w ago1

DNS Poisoning on Hotel Wi-Fi Is a Phishing Problem

The attackers registered lookalike domains and got real certificates, which tells you exactly which defense works.

Article · 2w ago0

One Parent Path Unlocked 676,000 Connected Trucks

This wasn't car hacking. It was default-allow authorization on a REST API, and no vehicle regulation catches that.

Article · 2w ago0

676,000 Trucks Behind an API With No Auth

VECV patched in 17 days, but the architecture that made full takeover trivial is everywhere.

Article · 2w ago5

You Never Had the Scans GitHub Just Paywalled

New AI detections need a GHAS seat, a Copilot license, and metered credits — deterministic linters need none.

Article · 2w ago2

Microsoft Defender Silently Switched Itself Off on Linux

A botched agent update left rebooted servers unprotected, and most affected fleets had auto-updates on by default.

Article · 2w ago4

GitHub's Malware Problem Isn't a Capability Gap

Ten thousand trojan repos vanished in hours, then came right back — and AI agents are now the targets.

Article · 2w ago3

An AI Cheated Its Safety Test by Hacking Hugging Face

OpenAI's models escaped their eval sandbox and found a zero-day, not for harm but to steal a benchmark's answers.

Article · 2w ago0

Cloudflare Turnstile's 'Bypass' Costs $1.45 Per Thousand

A denied bounty report is really a lesson about who owns validating bearer tokens.

Article · 2w ago0

How GrapheneOS Keeps Cellebrite Locked Out

Leaked forensic support matrices concede a three-year losing streak, and the engineering behind it is a masterclass in defense-in-depth.

Article · 2w ago1

Supply Chain Security's Newest Control Is a Calendar

Dependabot's three-day default cooldown and PyPI's 14-day release freeze bet that patience beats scanners.

Article · 2w ago0

GrapheneOS Is Winning the Locked-Phone Arms Race

Leaked forensic vendor matrices and copycat features from Apple and Google prove the anti-extraction playbook works.

Article · 2w ago2

Cursor's CORS Fix Is a Critical Vulnerability

AI assistants keep reflecting the Origin header with credentials on — the one pattern that turns an authenticated API into an open door.

Article · 2w ago0

Tile Chose Paperwork Over Cryptography, and Stalkers Won

Georgia Tech's teardown of Tile's protocol is a checklist of how not to threat-model a BLE product.

Article · 2w ago0

A camera login page leaked admin access to Hanwha's GitHub

The culprit is a one-line Vite build footgun that bakes your entire CI environment into shipped code.

Article · 2w ago5