Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

One Phone Call Undid 13 Years of Namecheap Account Security

A firsthand Hacker News account says support reset a password and account email for an unverified caller who simply asked.

Article · 3w ago0

Your Flaky Test Might Be a Use-After-Free

Buildkite traced intermittent Rails test failures to heap corruption in Ruby's hiredis driver — code that also ran in production.

Article · 3w ago6

The eval that broke out and breached Hugging Face

OpenAI's model used a zero-day to escape a cyber benchmark sandbox, and the defense exposed a guardrail problem.

Article · 3w ago1

npm's Cooldown Works Because You Never Vetted Anything

The security-theater critique misreads who actually catches registry malware — but it's right about what attackers do next.

Article · 3w ago0

440 Linux CVEs in a Day Is the System Working

The kernel's mass CVE drops punish checkbox security and reward teams that simply track stable releases.

Article · 3w ago0

440 Kernel CVEs in a Day Means Your Triage Model Is Dead

The Linux CNA floods the zone by design — and per-CVE patching can't survive contact with it.

Article · 3w ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 3w ago4

Stolen Credentials Erased Romania's Land Registry

The data survived in offline backups; the country's real-estate market didn't survive the eight-day restore.

Article · 3w ago1

AI turned a routine SQL bug into a WordPress catastrophe

The scary part of wp2shell isn't discovery. It's how cheaply a model chained the flaw to full RCE.

Article · 3w ago1

Windows GDID Is a Device ID With No Off Switch

A court filing confirmed a persistent Windows install fingerprint that survives VPNs and privacy toggles.

Article · 4w ago1

n8n Cross-Issuer Bug Turns JWT sub Into Account Takeover

Multi-issuer token exchange ignored iss, so matching subjects meant full account access.

Article · 4w ago1

Voice Auth Is Dead. Your IVR Just Doesn't Know It Yet

AI clones any voice from three seconds of audio, and the fraud numbers say detection alone can no longer save you.

Article · 4w ago2

Microsoft's 570 Patches Break Old Triage

AI discovery turned Patch Tuesday into a firehose. Treat exploitability ratings as outdated signals.

Article · 4w ago1

Tailscale SSH Flag Injection Broke Non-Root ACLs

A getent argument-handling bug let any allowed SSH user become root with the username -i.

Article · 4w ago1

Unrevoked Shims Kept Secure Boot Broken for Years

Microsoft-signed boot shims sat trusted for a decade. Revocation, not crypto, is the real weak link.

Article · 4w ago1