Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

The Security Question Your Scanner Can't Ask

Access control tops OWASP's 2025 list again because authorization is business logic, and no tool audits that for you.

Article · 1w ago1

Security Code Fails Silently. Test It Like It Does.

A FastAPI hardening pass shows why exception handlers, logging, and secret sweeps each deserve their own regression tests.

Article · 1w ago5

VLC's 33-Second Bug Wasn't Really VLC's Fault

Defender allegedly quarantined the player's plugin cache — a warning for anyone shipping Windows apps with generated files.

Article · 1w ago0

One Vendor Finally Published the Attacks It Can't Catch

An open benchmark with a public failure list beats unverifiable detection claims — but a self-scored 99.8% still isn't proof.

Article · 1w ago0

Stop Treating Your JWT Like a Database

The payload is base64, not ciphertext — and the fix isn't encryption, it's putting less in the token.

Article · 1w ago0

A Poisoned PDF Turned Atlassian's Rovo Into a Data Mule

The exfiltration flaw sat unfixed for months, and the mitigation admins would reach for doesn't actually work.

Article · 1w ago0

Your Keras Model File Is Executable Code, Not Data

safe_mode keeps getting bypassed because the format was built to run whatever the config names.

Article · 1w ago0

A Schema Name Becomes a Shell in n8n's Latest RCE

Prototype pollution in n8n's XML and GSuiteAdmin nodes chains a poisoned env var straight to code execution — patch today.

Article · 1w ago0

Your LLM Writes GitHub Actions Like It's 2022

Model-generated workflows inherit the permissive habits of their training data; gate the permissions block, not just the syntax.

Article · 1w ago0

One Global Key Guarded Every Hidden AI Reasoning Trace

Researchers replayed encrypted chain-of-thought into weaker sibling models and pulled live credentials out of public agent logs.

Article · 1w ago1

21,000 Exposed MCP Servers Are a Defaults Problem

New internet-wide scanning research shows MCP's authorization spec works — the way developers deploy servers doesn't.

Article · 1w ago0

NanoClaw Went Zero-CVE. Its Worst Bug Wasn't One

Echo's hardened images are real hygiene, but agent security lives at the host boundary, where scanners don't look.

Article · 2w ago0

Unicode Never Forgets, and That's a Security Problem

Twelve meaningless kanji, encoded forever by accident, explain why blocklist-style input validation keeps losing.

Article · 2w ago0

Ruby 4.0's New RCE Chain Proves Patching Gadgets Won't Save You

A fresh universal Marshal.load chain works back to Ruby 3.3 — and the real lesson is architectural, not a version bump.

Article · 2w ago0

Ruby's Marshal.load Just Became Unpatchable RCE

A new universal gadget chain anchors on Time and Hash internals the maintainers can't remove without breaking the language.

Article · 2w ago4