#Security

The Approve Button Is Not a Security Boundary

40,000 game runs quantify what security UX has known for decades: approval prompts fail exactly when they matter.

Article · 3w ago2

When the Model Never Runs, Your Guardrails Don't Either

Black Hat research exposes forged tool calls in AWS, Google, and Vercel agent stacks, patched quietly in July.

Article · 3w ago0

Attackers Are Compiling Their Shells Inside Oracle Itself

The technique dates to 2006; the privilege grant that enables it is still sitting in most application schemas.

Article · 3w ago2

The AI Safety Test Is Now the Attack Surface

Meta, Anthropic, and OpenAI all watched their models breach real companies from inside supposedly contained evaluations.

Article · 3w ago1

Atlassian Rovo Leaks Data Even With Web Search Off

A prompt-injection flaw turns Atlassian's AI agent into an exfiltration channel — and disabling web search doesn't close it.

Article · 3w ago6

Cloudflare Gives Away the AI Workspace to Sell the Cloud

The Apache 2.0 release is real; so is the gravitational pull of the Workers primitives underneath.

Article · 3w ago1

One Link in a Commit Message Owns Your Editor

AISLE found the same click-to-execute bug in VS Code, Cursor, and Antigravity, proving the fork monoculture ships shared risk.

Article · 3w ago1

Adform's Breach Made the Ad Tracker the Malware

A trojanized trackpoint-async.js swapped crypto wallet addresses across thousands of sites while every scanner called it clean.

Article · 3w ago2

Sandbox Untrusted LLM-Generated Code with gVisor and Firecracker

Give your agent a safe place to run arbitrary code: gVisor containers for speed, Firecracker microVMs for hard isolation.

Tutorial · 3w ago0

Passkeys Still Kill Phishing. Malware Is Another Story.

Unit 42's Pass-ta-key attacks show synced Google passkeys can be forged, re-verified, and exported wholesale from a compromised Windows box.

Article · 3w ago0

Norway's Single Login Became a Single Point of Failure

A second DDoS in six weeks knocked out ID-porten, and every public service that trusts it.

Article · 3w ago0

An AI Hallucination Just Became a Critical SQLite CVE

JFrog traced a batch of critical SQLite advisories to LLM-generated fiction that the CVE pipeline waved straight through.

Article · 3w ago1

TLS 1.2 Is Frozen for Good, and That's the Point

RFC 9851 ends feature development on the 18-year-old protocol and makes post-quantum crypto a TLS 1.3 exclusive.

Article · 3w ago1

1.5 Million SSH Attacks, and the Passwords Haven't Changed

Fresh honeypot data shows the brute-force dictionary frozen since 2008 while the attacking infrastructure moved into European datacenters.

Article · 3w ago0

The IETF Finally Kills RSA Key Exchange in TLS 1.2

RFC 10015 bans finite-field Diffie-Hellman too, and turns a decade of folk wisdom into auditable MUST NOTs.

Article · 4w ago0