Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

The OIDC Double-Edge: Inside the Injective SDK Backdoor

A compromised maintainer account and trusted publishing pipeline expose the limits of passive dependency scanning.

Article · 1mo ago0

Why AI Editors Keep Generating Prototype Pollution Vulnerabilities

Recursive merge helpers generated by AI tools frequently lack basic security guards, exposing JavaScript applications to prototype pollution.

Article · 1mo ago0

Why You Need a Vulnerability Harness, Not a Security Agent

Stop pointing raw LLMs at your codebase. Build a stateful, model-agnostic pipeline to find and validate real security bugs.

Article · 1mo ago0

How Serverless SQL Injection Becomes Cloud Privilege Escalation

When application-level vulnerabilities meet over-privileged IAM roles, classic database exploits can compromise entire AWS environments.

Article · 1mo ago0

Stop Using Self-Signed Certificates for Internal Services

Why split-horizon DNS and public ACME certificates are the only secure way to handle internal HTTPS.

Article · 1mo ago0

OpenBSD kernel race gives local users a root shell

CVE-2026-57589 is a use-after-free in the SysV semaphore path, hard to exploit but total in impact.

News · 1mo ago2

GitLost Proves Agentic Workflows Have No Trust Boundary

A single public GitHub issue tricked an AI agent into pasting private repo contents into a comment anyone could read.

News · 1mo ago1

The Tenda Firmware Backdoor and the Cost of Silent Vendors

A hardcoded fallback in Tenda routers bypasses authentication entirely, leaving administrators with no choice but to isolate or replace devices.

Article · 1mo ago0

Why a "Verified" GitHub Commit Hash Is Not Unique

Signature malleability allows attackers to alter verified commit hashes without breaking their cryptographic signatures or possessing private keys.

Article · 1mo ago0

Securing GitHub Agentic Workflows Against the GitLost Exploit

The GitLost vulnerability exposes private repositories through public issues, proving that English-programmed agents require strict, traditional security boundaries.

Article · 1mo ago0

A 19-Year-Old Linux Kernel Zero-Day Discovered via kernelCTF

A type confusion bug in the network bonding driver exposes the persistence of silent, long-lived kernel vulnerabilities.

Article · 1mo ago0

Hardening the Pipe: Why OpenSSH 10.4 is a Mandatory Upgrade

Stricter transport protocol enforcement, fatal sandbox failures, and experimental post-quantum signatures make OpenSSH 10.4 a critical upgrade.

Release · 1mo ago0

Januscape: The 16-Year-Old KVM Flaw Breaking x86 Isolation

A cross-architecture guest-to-host escape in the KVM shadow MMU threatens multi-tenant cloud infrastructure and nested virtualization.

Article · 1mo ago0

When Your Agent Starts Building Someone Else's Minecraft Temple

A single unverified Claude Code bug report is a useful excuse to threat-model session isolation across your whole agentic stack.

Article · 1mo ago1

Why Your Security Fails: The Case for Informal Threat Models

How to use lightweight, graph-based threat modeling to expose architectural flaws before writing a single line of code.

Article · 1mo ago1