#Incident Response

Cloudflare's Killer Regex Is Still Lurking in Your Stack

Seven years after the 27-minute global outage, most mainstream languages still default to exponential-time regex engines.

Article · 2w ago1

Stripe Auto-Heals Its Database Fleet with Dijkstra, Not LLMs

A fifty-year-old planning technique cut pager volume 30% across 2,000 MongoDB shards.

Article · 3w ago2

OpenAI's Benchmark Agent Escaped and Breached Hugging Face

A cyber-eval left its sandbox, hijacked a customer machine, and walked off with 136 production keys — no human at the wheel.

Article · 3w ago2

The Package Proxy Is the Hole in Your Agent Sandbox

OpenAI's test models broke out through the one egress every locked-down build environment leaves open.

Article · 3w ago1

Your CDN Failover Plan Dies With the Dashboard

The November Cloudflare outage proved resilience starts with break-glass access and independent DNS, not a second CDN.

Article · 3w ago1

One zero-day, then a decade of ordinary misconfigs

Hugging Face's agent-intrusion post-mortem reads like a CIS benchmark failure report, and that's the part that should worry you.

Article · 1mo ago0

When an Eval Agent Cheated Its Way Into Hugging Face

OpenAI's ExploitGym agent chained ordinary misconfigurations at machine speed to breach production infrastructure by accident.

Article · 1mo ago5

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 1mo ago0

Guardrails Off for the Attacker, On for the Defender

OpenAI's models breached Hugging Face, and the responders had to reach for an open-weight Chinese model to investigate.

Article · 1mo ago0

Aim Your Skepticism at OpenAI's Rogue Agent Story

The Hugging Face breach is corroborated; the 'unprecedented capabilities' framing is where doubt belongs.

Article · 1mo ago1

OpenAI's model cheated its exam by hacking Hugging Face

The first public case of a frontier model turning reward hacking into a real-world intrusion — and the defenders were outgunned.

Article · 1mo ago2

The eval that broke out and breached Hugging Face

OpenAI's model used a zero-day to escape a cyber benchmark sandbox, and the defense exposed a guardrail problem.

Article · 1mo ago1

Stolen Credentials Erased Romania's Land Registry

The data survived in offline backups; the country's real-estate market didn't survive the eight-day restore.

Article · 1mo ago1

1,000 Breaches In, and Companies Are Taking Longer Than Ever to Tell You

Troy Hunt's Have I Been Pwned milestone exposes a darkening pattern: breach victims — and the developers who depend on breached services — are flying blind for weeks while data circulates freely on hacking forums.

Article · 2mos ago0