Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

Patch the SharePoint and AD FS zero-days first

July’s record Patch Tuesday is huge, but only two CVEs are already live in attacks—and one product just lost support.

Article · 4w ago1

Cursor's Unpatched Git.exe RCE Still Hits Windows Devs

Six months after report, opening a poisoned Windows repo still runs attacker code with no prompt.

Article · 4w ago1

Hardware Passkeys Gate OpenAI’s Frontier Cyber Models

Identity assurance is joining model safety as a core control for high-privilege AI access.

Article · 4w ago1

Audit AI-Built MVPs Before First Paying Users

Cursor and v0 ship demos that work. They also ship the same access-control bugs attackers try first.

Article · 4w ago1

CrashStealer Proves Notarized Mac Malware Is Here

A Gatekeeper-cleared dropper and native C++ stealer raise the bar for defending developer Macs.

Article · 1mo ago0

Grok Build's Full-Repo Upload Broke Local-First Trust

Wire captures show the CLI shipped entire git bundles to GCS, and the privacy toggle never controlled it.

Article · 1mo ago5

Chromium 148 Made Math.tanh an OS Fingerprint

A quiet V8 switch to host std::tanh now leaks Linux, macOS, or Windows from a single double.

Article · 1mo ago0

Motorola MR2600 LAN RCE via Firmware Path

Two broken auth checks plus unsigned SEAMA images let any LAN host flash and own the gateway.

Article · 1mo ago0

SQL Injection Still Chains to RCE on Apple

A single unparameterized CFML query behind a JSON API turned a travel portal into remote code execution.

Article · 1mo ago2

Claude Code’s Silent Permission Click on Windows

A reported TUI focus bug can approve or reject tool prompts you never read. Audit now.

Article · 1mo ago0

How Fake Commit Activity Masked a Massive Go Malware Campaign

A sophisticated campaign weaponized Go pseudo-versions and automated commits to distribute Windows remote access trojans.

Article · 1mo ago5

Inside the Stealth Browser Arms Race Against Cloudflare

When bot detection returns a quiet 403 with an HTML body, LLM agents confidently hallucinate instead of failing.

Article · 1mo ago2

GhostLock: The 15-Year-Old Linux Kernel Bug That Defeated Lockdep

A deep dive into CVE-2026-43499, a stack use-after-free in the rtmutex subsystem affecting nearly every Linux distribution.

Article · 1mo ago0

The High Price of Vibe Coding

As AI-assisted development drives a massive surge in leaked secrets and architectural flaws, the industry faces a compounding security debt.

Article · 1mo ago0

The OIDC Double-Edge: Inside the Injective SDK Backdoor

A compromised maintainer account and trusted publishing pipeline expose the limits of passive dependency scanning.

Article · 1mo ago0