#Security

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Article · 12h ago1

The Sandbox Was the Weakest Link

Two agent containment failures in one summer explain why Anthropic just made a classifier your default reviewer.

Article · 17h ago1

Encrypted Chain-of-Thought Was Security Theater

Researchers replayed frontier models' hidden reasoning into their cheaper siblings, and the raw thoughts, secrets included, spilled out.

Article · 1d ago0

Fake ClaudeBots Are Scanning for Your AI Credentials

A spoofing campaign probing for Claude settings and .env files shows user-agent strings were never identity.

Article · 1d ago0

Fake ClaudeBot Is the New Fake Googlebot

Mass vulnerability scans are hiding behind AI crawler user-agents, hunting the credential files AI coding tools leave behind.

Article · 1d ago0

Detect AI-Generated Images, Audio, and Text with Open-Source Models

Wire three Hugging Face classifiers into one local pipeline that flags synthetic media before it reaches users.

Tutorial · 1d ago0

AI Bug Hunters Just Broke OpenSSH's Release Calendar

Version 10.5 lands five weeks after 10.4, and the project says on-demand security releases are the new normal.

Article · 1d ago1

Copilot's Context Engine Doesn't Know What a Secret Is

A mitmproxy teardown shows greedy context harvesting shipping .env secrets, while the controls to stop it are enterprise-gated.

Article · 2d ago0

OpenSSH 10.5 Rewrites Its Release Clock for the AI Era

Three real fixes ship early because AI-assisted bug hunters keep rediscovering the same holes.

Article · 2d ago0

The Chain-of-Thought You Sealed Isn't Secret

A new attack replays encrypted reasoning blocks into a weaker sibling model that reads them back in plaintext.

Article · 2d ago0

Ransomware Comes for On-Prem SharePoint, Again

CISA's ransomware flag on a patched SharePoint RCE replays the ToolShell playbook against servers that just lost Microsoft support.

Article · 2d ago0

One Slow Instruction Breaks SMM's Core Guarantee

A second-long memory load desynchronizes CPU cores, reviving a dormant class of firmware TOCTOU bugs.

Article · 2d ago0

One Missing Firestore Rule Exposed 181,874 Meetings

The tl;dv leak is a Firebase story first, and a warning about how much access AI notetakers concentrate.

Article · 3d ago2

Docker's Answer to YOLO-Mode Agents Is a VM, Not a Container

The sbx CLI wraps coding agents in disposable microVMs with a credential-injecting proxy — and a mandatory login.

Article · 3d ago1

Claude Code's Permission Prompts Were Security Theater All Along

Anthropic's data on rubber-stamped approvals justifies the auto mode default — but the sandbox is still your job.

Article · 3d ago4