Topic

#Security

166 articles on Security — news, releases, guides and analysis from the SourceFeed engine.

Article 8h ago 1

Domas Turns DRAM Scrambling Into a Skeleton Key

A single register poke rewires physical addresses so every fence built above the memory controller quietly falls apart.

Lenn Voss

440 Kernel CVEs in a Day Means Your Triage Model Is Dead

The Linux CNA floods the zone by design — and per-CVE patching can't survive contact with it.

Article · 3w ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 3w ago4

Stolen Credentials Erased Romania's Land Registry

The data survived in offline backups; the country's real-estate market didn't survive the eight-day restore.

Article · 3w ago1

AI turned a routine SQL bug into a WordPress catastrophe

The scary part of wp2shell isn't discovery. It's how cheaply a model chained the flaw to full RCE.

Article · 3w ago1

Enable Touch ID for sudo and SSH Authentication on macOS

Stop typing your password for sudo and SSH. Configure pam_tid for privilege escalation and a Secure Enclave-backed SSH agent for key auth, both unlocked with a fingerprint.

Tutorial · 4w ago2

Add TOTP-Based Two-Factor Authentication to Your Web App

Build a working Flask app that generates a QR-code enrollment flow and enforces rotating 6-digit codes on login, using pyotp for the TOTP math.

Tutorial · 4w ago1

Microsoft's 570 Patches Break Old Triage

AI discovery turned Patch Tuesday into a firehose. Treat exploitability ratings as outdated signals.

Article · 4w ago1

Tailscale SSH Flag Injection Broke Non-Root ACLs

A getent argument-handling bug let any allowed SSH user become root with the username -i.

Article · 4w ago1

Dependabot's Three-Day Cooldown Is Incomplete

The new default delays routine version PRs, but install paths and package managers still need their own age gates.

Article · 4w ago1

Audit AI-Built MVPs Before First Paying Users

Cursor and v0 ship demos that work. They also ship the same access-control bugs attackers try first.

Article · 4w ago1

Copilot /security-review Moves Vuln Catching Earlier

The slash command scans in-flight diffs for high-confidence issues without leaving the coding workflow.

Article · 4w ago1

Codex Encrypts Multi-Agent Messages, Kills Audit Trails

OpenAI now ships subagent tasks as ciphertext, extending opaque-blob design at a real cost to local debugging.

Article · 4w ago1

Grok Build Uploaded Full Repos Without Real Opt-Out

Wire captures show the CLI shipped complete git history to GCS, and the privacy toggle did nothing.

Article · 1mo ago0

Clawk Puts Coding Agents in Disposable VMs

Hypervisor isolation beats permission prompts when agents need root, packages, and a real network.

Article · 1mo ago0

Grok Build Quietly Uploads Entire Repos to GCS

The privacy toggle only covers training consent. Full workspace uploads still run by default.

Article · 1mo ago1