Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

AI Coding Assistants Turn Local Git Repos Into Cloud Exploits

A high-severity Amazon Q flaw highlights how Model Context Protocol configurations let malicious repositories run code and steal credentials.

Article · 2mos ago2

The MCP Security Blind Spot in AI Coding Assistants

A high-severity flaw in Amazon Q Developer highlights how repository-carried configuration files are turning simple git clones into cloud compromises.

Article · 2mos ago0

When Seven AI Security Gates All Say LGTM

A viral incident report is pure fiction, but every way its AI defenses fail is already happening in production.

Article · 2mos ago2

Node.js as a Portable Attack Vector in Phishing Campaigns

Attackers are dropping standalone Node.js runtimes into user space to bypass security controls and run persistent implants.

Article · 2mos ago0

Miasma Proves Trusted Publishing Can Backfire Spectacularly

The self-propagating Miasma worm exploits GitHub Actions OIDC and phantom build files to turn security standards against developers.

Article · 2mos ago0

The Client-Side Illusion: Lessons from the J&J Web App Vulnerabilities

Relying on frontend SSO flows without backend token validation is a recipe for trivial administrative takeovers.

Article · 2mos ago0

The AI Auditing Wave and the End of Battle-Tested Code

As AI-driven vulnerability discovery systematically strips latent bugs from curl, developers must rethink their dependency patching strategies.

Article · 2mos ago1

The OAuth Supply Chain: Lessons From the LastPass Breach

A third-party OAuth compromise exposes customer data, highlighting the critical need for strict API token scoping and zero-trust integrations.

Article · 2mos ago4

The CAPTCHA is Dead (And AI Killed It)

Active puzzles no longer stop modern bots, forcing developers to shift to passive, cryptographic, and behavioral defense layers.

Article · 2mos ago3

The Cordyceps Exploits: Why Your CI/CD Pipelines Are Wide Open

A systemic workflow composition flaw exposes hundreds of major repositories, proving we must stop treating CI/CD as passive configuration.

Article · 2mos ago0

Vulnerability Reports Lost Their Privilege. Now What?

Cheap LLM bug-hunting has collapsed the signal-to-noise of disclosures, and the old etiquette of coordinated reporting no longer pays for itself.

Article · 2mos ago3

The Cryptographic Battle for the Bot-Era Web

A new industry coalition proposes PACT to replace broken CAPTCHAs without locking users into proprietary hardware ecosystems.

Article · 2mos ago0

GitHub Hardens actions/checkout to Block Pwn Request Attacks

The latest security update stops common pipeline exploits but leaves structural CI/CD risks for developers to manage.

Article · 2mos ago0

The Secure Boot Cert Expiry Won't Brick Your Box — But It Bites Elsewhere

Microsoft's 2011 UEFI signing key ages out in June 2026, and the real damage lands on sealed secrets and unpatchable firmware.

Article · 2mos ago3

Beyond Encryption: The Supply Chain Threat of Pure Exfiltration

The Tata Electronics breach highlights why developers must secure intellectual property far beyond the corporate perimeter.

Article · 2mos ago4