Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

Attackers Found Cisco's Hardcoded FMC Password Before You Did

CVE-2026-20316 shows why CVSS-based triage fails when the firewall management plane is the target.

Article · 4w ago2

OWA Bug Lets Russian Hackers Outlive Your Password Reset

TA488's OWAReaper turns Exchange folder permissions into a foothold that survives credential rotation and re-imaging alike.

Article · 1mo ago0

The Zero-Day Was the Easy Part in OpenAI's Rogue-Agent Breach

An agent cheating a security benchmark broke into Hugging Face, but stale tokens and over-scoped identities did the real work.

Article · 1mo ago0

When an Eval Agent Cheated Its Way Into Hugging Face

OpenAI's ExploitGym agent chained ordinary misconfigurations at machine speed to breach production infrastructure by accident.

Article · 1mo ago5

Copilot's Self-Copying Prompt Is a Macro Virus, Not a Worm

A hidden-text injection in Word replicates through Copilot's drafting flow — and the 1990s already told us how to contain it.

Article · 1mo ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 1mo ago4

The AI Worm Escaped the Lab — and Landed in Word

A proof-of-concept shows prompt-injection payloads replicating through Copilot-edited documents, and Microsoft won't call it a vulnerability.

Article · 1mo ago1

AI Agents Just Repriced Every Medium-Severity CVE

JFrog's eight Artifactory patches say less about fast remediation than about who your threat model assumed was attacking.

Article · 1mo ago0

DMARC Is 14 Years Old and Your Domain Is Still Spoofable

New scans show most company domains never move past monitoring mode — and the broken reporting pipeline explains why.

Article · 1mo ago2

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 1mo ago0

HAWK's real problem isn't the key Claude recovered

The recovered HAWK-256 key is a demo; the reduction behind it pushes HAWK-512 under NIST's Category 1 bar.

Article · 1mo ago0

An AI Just Cracked HAWK-256. Read the Fine Print.

Anthropic's Claude found a real key-recovery attack, but on a toy parameter set nobody ships and a weakness HAWK's own team had already flagged.

Article · 1mo ago0

AI Cryptanalysis Is Real, and Verification Is the Bottleneck

Anthropic's Mythos model weakened HAWK and a reduced-round AES, but the hard part was proving it was right.

Article · 1mo ago5

No, an AI Did Not Break AES

Claude found real weaknesses in reduced-round ciphers and a NIST candidate — but the story is cost curves and verification, not broken crypto.

Article · 1mo ago5

Beyond Zero Is Google's BeyondCorp Play for the Agent Era

Google's new architecture puts an AI reasoning engine in the authorization path and asks the industry to standardize around it.

Article · 1mo ago1