Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

A camera login page leaked admin access to Hanwha's GitHub

The culprit is a one-line Vite build footgun that bakes your entire CI environment into shipped code.

Article · 1mo ago5

One Phone Call Undid 13 Years of Namecheap Account Security

A firsthand Hacker News account says support reset a password and account email for an unverified caller who simply asked.

Article · 1mo ago0

Your Flaky Test Might Be a Use-After-Free

Buildkite traced intermittent Rails test failures to heap corruption in Ruby's hiredis driver — code that also ran in production.

Article · 1mo ago6

The eval that broke out and breached Hugging Face

OpenAI's model used a zero-day to escape a cyber benchmark sandbox, and the defense exposed a guardrail problem.

Article · 1mo ago1

npm's Cooldown Works Because You Never Vetted Anything

The security-theater critique misreads who actually catches registry malware — but it's right about what attackers do next.

Article · 1mo ago0

440 Linux CVEs in a Day Is the System Working

The kernel's mass CVE drops punish checkbox security and reward teams that simply track stable releases.

Article · 1mo ago0

440 Kernel CVEs in a Day Means Your Triage Model Is Dead

The Linux CNA floods the zone by design — and per-CVE patching can't survive contact with it.

Article · 1mo ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 1mo ago4

Stolen Credentials Erased Romania's Land Registry

The data survived in offline backups; the country's real-estate market didn't survive the eight-day restore.

Article · 1mo ago1

AI turned a routine SQL bug into a WordPress catastrophe

The scary part of wp2shell isn't discovery. It's how cheaply a model chained the flaw to full RCE.

Article · 1mo ago1

Windows GDID Is a Device ID With No Off Switch

A court filing confirmed a persistent Windows install fingerprint that survives VPNs and privacy toggles.

Article · 1mo ago1

n8n Cross-Issuer Bug Turns JWT sub Into Account Takeover

Multi-issuer token exchange ignored iss, so matching subjects meant full account access.

Article · 1mo ago1

Voice Auth Is Dead. Your IVR Just Doesn't Know It Yet

AI clones any voice from three seconds of audio, and the fraud numbers say detection alone can no longer save you.

Article · 1mo ago2

Microsoft's 570 Patches Break Old Triage

AI discovery turned Patch Tuesday into a firehose. Treat exploitability ratings as outdated signals.

Article · 1mo ago1

Tailscale SSH Flag Injection Broke Non-Root ACLs

A getent argument-handling bug let any allowed SSH user become root with the username -i.

Article · 1mo ago1