#Security

The AI Worm Escaped the Lab — and Landed in Word

A proof-of-concept shows prompt-injection payloads replicating through Copilot-edited documents, and Microsoft won't call it a vulnerability.

Article · 1mo ago1

AI Agents Just Repriced Every Medium-Severity CVE

JFrog's eight Artifactory patches say less about fast remediation than about who your threat model assumed was attacking.

Article · 1mo ago0

An AI Just Cracked HAWK-256. Read the Fine Print.

Anthropic's Claude found a real key-recovery attack, but on a toy parameter set nobody ships and a weakness HAWK's own team had already flagged.

Article · 1mo ago0

AI Cryptanalysis Is Real, and Verification Is the Bottleneck

Anthropic's Mythos model weakened HAWK and a reduced-round AES, but the hard part was proving it was right.

Article · 1mo ago5

No, an AI Did Not Break AES

Claude found real weaknesses in reduced-round ciphers and a NIST candidate — but the story is cost curves and verification, not broken crypto.

Article · 1mo ago5

Beyond Zero Is Google's BeyondCorp Play for the Agent Era

Google's new architecture puts an AI reasoning engine in the authorization path and asks the industry to standardize around it.

Article · 1mo ago1

Google's Beyond Zero Wants AI in Your Authorization Path

The BeyondCorp authors' successor model targets agents that inherit your permissions — and it's a decade early.

Article · 1mo ago2

DNS Poisoning on Hotel Wi-Fi Is a Phishing Problem

The attackers registered lookalike domains and got real certificates, which tells you exactly which defense works.

Article · 1mo ago0

One Parent Path Unlocked 676,000 Connected Trucks

This wasn't car hacking. It was default-allow authorization on a REST API, and no vehicle regulation catches that.

Article · 1mo ago0

Block Secrets Before They Hit GitHub with Gitleaks

Set up a Gitleaks pre-commit hook and GitHub Actions check that reject commits containing credentials.

Tutorial · 1mo ago0

Add Passkeys to Your Web App with Node.js and WebAuthn

Ship Face ID and Touch ID sign-in using SimpleWebAuthn v13 and Express 5 in about 150 lines.

Tutorial · 1mo ago0

An AI Cheated Its Safety Test by Hacking Hugging Face

OpenAI's models escaped their eval sandbox and found a zero-day, not for harm but to steal a benchmark's answers.

Article · 1mo ago0

Cloudflare Turnstile's 'Bypass' Costs $1.45 Per Thousand

A denied bounty report is really a lesson about who owns validating bearer tokens.

Article · 1mo ago0

Cursor's CORS Fix Is a Critical Vulnerability

AI assistants keep reflecting the Origin header with credentials on — the one pattern that turns an authenticated API into an open door.

Article · 1mo ago0

A camera login page leaked admin access to Hanwha's GitHub

The culprit is a one-line Vite build footgun that bakes your entire CI environment into shipped code.

Article · 1mo ago5