Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 11h ago 1

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Emeka Okafor

Why AI Editors Keep Generating Prototype Pollution Vulnerabilities

Recursive merge helpers generated by AI tools frequently lack basic security guards, exposing JavaScript applications to prototype pollution.

Article · 1mo ago0

Why You Need a Vulnerability Harness, Not a Security Agent

Stop pointing raw LLMs at your codebase. Build a stateful, model-agnostic pipeline to find and validate real security bugs.

Article · 1mo ago0

How Serverless SQL Injection Becomes Cloud Privilege Escalation

When application-level vulnerabilities meet over-privileged IAM roles, classic database exploits can compromise entire AWS environments.

Article · 1mo ago0

Stop Using Self-Signed Certificates for Internal Services

Why split-horizon DNS and public ACME certificates are the only secure way to handle internal HTTPS.

Article · 1mo ago0

OpenBSD kernel race gives local users a root shell

CVE-2026-57589 is a use-after-free in the SysV semaphore path, hard to exploit but total in impact.

News · 1mo ago2

GitLost Proves Agentic Workflows Have No Trust Boundary

A single public GitHub issue tricked an AI agent into pasting private repo contents into a comment anyone could read.

News · 1mo ago1

The Tenda Firmware Backdoor and the Cost of Silent Vendors

A hardcoded fallback in Tenda routers bypasses authentication entirely, leaving administrators with no choice but to isolate or replace devices.

Article · 1mo ago0

Why a "Verified" GitHub Commit Hash Is Not Unique

Signature malleability allows attackers to alter verified commit hashes without breaking their cryptographic signatures or possessing private keys.

Article · 1mo ago0

Securing GitHub Agentic Workflows Against the GitLost Exploit

The GitLost vulnerability exposes private repositories through public issues, proving that English-programmed agents require strict, traditional security boundaries.

Article · 1mo ago0

A 19-Year-Old Linux Kernel Zero-Day Discovered via kernelCTF

A type confusion bug in the network bonding driver exposes the persistence of silent, long-lived kernel vulnerabilities.

Article · 1mo ago0

Hardening the Pipe: Why OpenSSH 10.4 is a Mandatory Upgrade

Stricter transport protocol enforcement, fatal sandbox failures, and experimental post-quantum signatures make OpenSSH 10.4 a critical upgrade.

Release · 1mo ago0

Januscape: The 16-Year-Old KVM Flaw Breaking x86 Isolation

A cross-architecture guest-to-host escape in the KVM shadow MMU threatens multi-tenant cloud infrastructure and nested virtualization.

Article · 1mo ago0

When Your Agent Starts Building Someone Else's Minecraft Temple

A single unverified Claude Code bug report is a useful excuse to threat-model session isolation across your whole agentic stack.

Article · 1mo ago1

Why Your Security Fails: The Case for Informal Threat Models

How to use lightweight, graph-based threat modeling to expose architectural flaws before writing a single line of code.

Article · 1mo ago1

How MSI Center Exposed SYSTEM Privileges to Local Users

A look at how weak IPC security and cryptographic obscurity left Windows systems vulnerable to local privilege escalation.

Article · 1mo ago0