Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

Google's Beyond Zero Wants AI in Your Authorization Path

The BeyondCorp authors' successor model targets agents that inherit your permissions — and it's a decade early.

Article · 1mo ago2

AI Bug Hunters Leave Their Mark on macOS Tahoe 26.6

Apple's 155-CVE July update ships no zero-days, but the researcher credits reveal where vulnerability discovery is heading.

Article · 1mo ago1

DNS Poisoning on Hotel Wi-Fi Is a Phishing Problem

The attackers registered lookalike domains and got real certificates, which tells you exactly which defense works.

Article · 1mo ago0

One Parent Path Unlocked 676,000 Connected Trucks

This wasn't car hacking. It was default-allow authorization on a REST API, and no vehicle regulation catches that.

Article · 1mo ago0

676,000 Trucks Behind an API With No Auth

VECV patched in 17 days, but the architecture that made full takeover trivial is everywhere.

Article · 1mo ago5

You Never Had the Scans GitHub Just Paywalled

New AI detections need a GHAS seat, a Copilot license, and metered credits — deterministic linters need none.

Article · 1mo ago2

Microsoft Defender Silently Switched Itself Off on Linux

A botched agent update left rebooted servers unprotected, and most affected fleets had auto-updates on by default.

Article · 1mo ago4

GitHub's Malware Problem Isn't a Capability Gap

Ten thousand trojan repos vanished in hours, then came right back — and AI agents are now the targets.

Article · 1mo ago3

An AI Cheated Its Safety Test by Hacking Hugging Face

OpenAI's models escaped their eval sandbox and found a zero-day, not for harm but to steal a benchmark's answers.

Article · 1mo ago0

Cloudflare Turnstile's 'Bypass' Costs $1.45 Per Thousand

A denied bounty report is really a lesson about who owns validating bearer tokens.

Article · 1mo ago0

How GrapheneOS Keeps Cellebrite Locked Out

Leaked forensic support matrices concede a three-year losing streak, and the engineering behind it is a masterclass in defense-in-depth.

Article · 1mo ago1

Supply Chain Security's Newest Control Is a Calendar

Dependabot's three-day default cooldown and PyPI's 14-day release freeze bet that patience beats scanners.

Article · 1mo ago0

GrapheneOS Is Winning the Locked-Phone Arms Race

Leaked forensic vendor matrices and copycat features from Apple and Google prove the anti-extraction playbook works.

Article · 1mo ago2

Cursor's CORS Fix Is a Critical Vulnerability

AI assistants keep reflecting the Origin header with credentials on — the one pattern that turns an authenticated API into an open door.

Article · 1mo ago0

Tile Chose Paperwork Over Cryptography, and Stalkers Won

Georgia Tech's teardown of Tile's protocol is a checklist of how not to threat-model a BLE product.

Article · 1mo ago0