Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

Why JWTs Are a Security Anti-Pattern for Sessions

Relying on stateless JSON Web Tokens for persistent user sessions introduces severe security risks and architectural complexity.

Article · 2mos ago0

Steam Workshop Wallpapers Exploited to Run Malicious Binaries

Attackers leverage Wallpaper Engine's application feature to execute backdoors and hijack active user sessions.

Article · 2mos ago5

AMD Strips TSME Memory Encryption From Consumer CPUs

Developers relying on consumer Ryzen hardware for secure edge or workstation deployments must re-evaluate their physical trust boundaries.

News · 2mos ago2

Why CVE Counts Misrepresent Rust and C/C++ Security

Comparing vulnerability counts ignores how the two language ecosystems define the boundary between library bugs and caller misuse.

Article · 2mos ago0

How a Fake LinkedIn Job Offer Delivered a Node Backdoor

Attackers are using stolen identities and malicious npm lifecycle scripts to target developers during the recruitment process.

Article · 2mos ago4

Curl Pauses Vulnerability Report Intake for July 2026

The project's HackerOne form and security inbox go dark for a month, pushing coordinated disclosure plans into August.

News · 2mos ago2

How Public AOSP Test Keys Compromise Automotive Headunits

Shipping production firmware signed with default Android test keys exposes vehicles to local arbitrary code execution.

Article · 2mos ago2

Sophisticated AUR Malware Waves Expose Container and Pipeline Risks

A second wave of obfuscated malware targeting Arch Linux's user repository highlights the danger of unpinned, automated builds.

Article · 2mos ago3

Arch's AUR Malware Sprawl Hits 1,579 Packages

A user-repository compromise that started at 400 packages ballooned past 1,500 before Arch developers purged the malicious commits.

News · 2mos ago6

AI Agents Uncover 21 Zero-Day Vulnerabilities in FFmpeg

Autonomous security agents found decades-old memory safety flaws in the widely deployed media processing library, prompting urgent updates.

News · 2mos ago2

AUR Supply Chain Attack Delivers eBPF Rootkit and Infostealer

A spoofed maintainer adopted over 400 Arch User Repository packages, injecting preinstall scripts that fetch malicious NPM payloads.

News · 2mos ago0

Inside 'The Gentlemen' Ransomware: TTPs, AI, and Network Hardening

Understand the technical tactics of this rapidly expanding RaaS group to defend your edge devices and Active Directory.

Article · 2mos ago2

Critical Ivanti Sentry RCE Under Active Exploitation

A maximum-severity unauthenticated command injection vulnerability in Ivanti Sentry is being actively targeted following a public exploit release.

News · 2mos ago0

Hundreds of AUR Packages Trojanized with Malicious npm Dependency

A widespread supply chain attack on the Arch User Repository injects an infostealer via malicious npm install scripts.

News · 2mos ago0

BorgBackup Server's Security Model: Surviving a Breach on Either Side

Append-only repositories, client-side encryption, and a pull-based agent design mean a compromised client can't destroy history — and a compromised server can't reach your machines.

Article · 2mos ago0