Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 3d ago 3

AI Didn't Kill JS Obfuscation, It Repriced It

LLMs erased renaming and shred obfuscator.io defaults, but runtime-dependent and polymorphic protection still costs attackers real money.

Ji-ho Choi

Unrevoked Shims Kept Secure Boot Broken for Years

Microsoft-signed boot shims sat trusted for a decade. Revocation, not crypto, is the real weak link.

Article · 1mo ago1

Patch the SharePoint and AD FS zero-days first

July’s record Patch Tuesday is huge, but only two CVEs are already live in attacks—and one product just lost support.

Article · 1mo ago1

Cursor's Unpatched Git.exe RCE Still Hits Windows Devs

Six months after report, opening a poisoned Windows repo still runs attacker code with no prompt.

Article · 1mo ago1

Hardware Passkeys Gate OpenAI’s Frontier Cyber Models

Identity assurance is joining model safety as a core control for high-privilege AI access.

Article · 1mo ago1

Audit AI-Built MVPs Before First Paying Users

Cursor and v0 ship demos that work. They also ship the same access-control bugs attackers try first.

Article · 1mo ago1

CrashStealer Proves Notarized Mac Malware Is Here

A Gatekeeper-cleared dropper and native C++ stealer raise the bar for defending developer Macs.

Article · 1mo ago0

Grok Build's Full-Repo Upload Broke Local-First Trust

Wire captures show the CLI shipped entire git bundles to GCS, and the privacy toggle never controlled it.

Article · 1mo ago5

Chromium 148 Made Math.tanh an OS Fingerprint

A quiet V8 switch to host std::tanh now leaks Linux, macOS, or Windows from a single double.

Article · 1mo ago0

Motorola MR2600 LAN RCE via Firmware Path

Two broken auth checks plus unsigned SEAMA images let any LAN host flash and own the gateway.

Article · 1mo ago0

SQL Injection Still Chains to RCE on Apple

A single unparameterized CFML query behind a JSON API turned a travel portal into remote code execution.

Article · 1mo ago2

Claude Code’s Silent Permission Click on Windows

A reported TUI focus bug can approve or reject tool prompts you never read. Audit now.

Article · 1mo ago0

How Fake Commit Activity Masked a Massive Go Malware Campaign

A sophisticated campaign weaponized Go pseudo-versions and automated commits to distribute Windows remote access trojans.

Article · 1mo ago5

Inside the Stealth Browser Arms Race Against Cloudflare

When bot detection returns a quiet 403 with an HTML body, LLM agents confidently hallucinate instead of failing.

Article · 1mo ago2

GhostLock: The 15-Year-Old Linux Kernel Bug That Defeated Lockdep

A deep dive into CVE-2026-43499, a stack use-after-free in the rtmutex subsystem affecting nearly every Linux distribution.

Article · 1mo ago0

The High Price of Vibe Coding

As AI-assisted development drives a massive surge in leaked secrets and architectural flaws, the industry faces a compounding security debt.

Article · 1mo ago0