#Security

One Slow Instruction Breaks SMM's Core Guarantee

A second-long memory load desynchronizes CPU cores, reviving a dormant class of firmware TOCTOU bugs.

Article · 2w ago0

One Missing Firestore Rule Exposed 181,874 Meetings

The tl;dv leak is a Firebase story first, and a warning about how much access AI notetakers concentrate.

Article · 2w ago2

Docker's Answer to YOLO-Mode Agents Is a VM, Not a Container

The sbx CLI wraps coding agents in disposable microVMs with a credential-injecting proxy — and a mandatory login.

Article · 2w ago1

Claude Code's Permission Prompts Were Security Theater All Along

Anthropic's data on rubber-stamped approvals justifies the auto mode default — but the sandbox is still your job.

Article · 2w ago4

Claude Code's Permission Prompt Isn't a Security Boundary

Version 2.1.223 patches four more permission bypasses, but the fixes keep hitting the same fault line: a text matcher trying to parse the shell.

Article · 2w ago0

Ransomware Gangs Have Discovered Middle Management

New Zscaler data shows attackers optimizing for approval authority and business access, not admin rights or executive titles.

Article · 2w ago0

CSS alone can steal passwords from your webmail

PortSwigger's Gareth Heyes turned a decade of CSS injection tricks into working account takeovers on Outlook, Gmail and more.

Article · 2w ago0

Stop Running LLM-Generated Code in Your Own Process

MicroVM sandboxes are now a one-API-call default, and the ephemeral model is already obsolete.

Article · 3w ago2

Lock Down Service-to-Service Traffic with mTLS via cert-manager

Bootstrap a private CA with cert-manager and enforce mutually authenticated TLS between pods, with automatic rotation.

Tutorial · 3w ago0

The x86 CPU Backdoor That Was Hiding in the Datasheet

VIA's C3 chips let userland code jump straight to ring 0 — and the mechanism was documented years before anyone called it a backdoor.

Article · 3w ago2

Synced Passkeys Have a Malware Problem

Unit 42's Pass-ta-key attacks steal Google passkeys from a compromised endpoint without breaking any crypto.

Article · 3w ago2

AI Crawlers Broke the Web's Oldest Bargain

One site's server logs show the crawl-for-referrals deal is dead, and per-site firewalls can't fix it.

Article · 3w ago1

Metabase's 0-Day Burned Framework. Self-Hosters Are Next

An unauthenticated SQL injection in a password-reset endpoint turned a BI dashboard into an exfiltration pipeline.

Article · 3w ago1

Framework's Metabase Breach Wasn't a Patching Failure

A CVSS 10.0 zero-day hit Metabase Cloud, and every column piped into analytics became breach-notification surface.

Article · 3w ago1

AWS Dogwood Gives Agent Guardrails a Memory

By extending Cedar with temporal logic, AWS makes 'what happened before?' an enforceable question at the tool-call boundary.

Article · 3w ago0