Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

npm v12 Kills Auto-Run Scripts: What Developers Must Do

GitHub is finally disabling automatic lifecycle scripts in npm v12, forcing a major shift in dependency security.

Article · 2mos ago1

Agentjacking: How Public Sentry Keys Turn AI Coding Agents Into Trojan Horses

A newly disclosed exploit chain weaponizes public DSNs and the Model Context Protocol to execute arbitrary code on developer machines.

Article · 2mos ago4

Securing AI Agents: Inside NVIDIA's SkillSpector Scanner

NVIDIA's open-source tool introduces capability governance to protect agentic workflows from prompt injection, tool poisoning, and malicious skills.

Article · 2mos ago3

The Android 17 GrapheneOS Port and the Play Integrity Trap

GrapheneOS achieves launch-day parity with Android 17, but escalating enterprise attestation blocks threaten its real-world viability.

Article · 2mos ago3

Agentic Security: Standardizing Cyber Workflows for AI Developers

Structured, framework-mapped skill trees are turning terminal-based AI agents into compliant, deterministic security copilots.

Article · 2mos ago0

Demystifying iOS Device Fingerprinting with Loupe

Mysk's open-source tool exposes the public APIs that native iOS apps use to quietly track and identify users.

Article · 2mos ago3

The AUR Namespace Trap: Lessons from the Atomic Arch Attacks

The recent compromise of over 1,500 AUR packages exposes the structural danger of flat namespaces in developer-focused package repositories.

Article · 2mos ago5

North Korean Hackers Poison Mastra AI in npm Attack

The compromise of the Mastra AI framework exposes critical gaps between CI/CD provenance and registry-level publish permissions.

Article · 2mos ago1

GPS Spoofing at Scale Demands Zero Trust Location

As continental-scale signal tampering corrupts GNSS reliability, developers must treat location data as an untrusted input.

Article · 2mos ago0

The Cryptographic Debt Fueling the FortiBleed Campaign

How a deferred password hashing upgrade left over 86,000 FortiGate appliances vulnerable to automated, GPU-accelerated credential stuffing.

Article · 2mos ago0

The GitHub Clone Farm That Beat VirusTotal

A 10,000-repo Trojan campaign weaponizes GitHub's trust signals, search ranking and commit history — and the next mark is your AI agent.

Article · 2mos ago2

Zero-Touch OAuth: Securing the MCP Enterprise Agent Stack

The Enterprise-Managed Authorization extension replaces manual consent prompts with centralized, identity-driven token exchange for AI agents.

Article · 2mos ago2

License Plate Readers Can Now Fingerprint Your Phone, Earbuds, and Tires

Leonardo's ELSAG SignalTrace bolts RF device-detection onto plate readers. Here's the wireless tech that makes it work — and why it's so hard to dodge.

Article · 2mos ago0

Anatomy of a 27-Year-Old OpenBSD Authentication Bypass

A simple validation omission in OpenBSD's PPP stack shows how easily decoupled memory bounds can compromise system security.

Article · 2mos ago0

Dismantling the IIS Attack Surface

Why Microsoft's legacy web server remains a prime target for modern reconnaissance and how to harden your Windows workloads.

Article · 2mos ago0