Tech · Culture · Fiction
Article Forever Security found a malicious AGENTS.md in Downloads
A malicious AGENTS.md dropped into ~/Downloads can steer an AI coding agent into installing rogue packages or leaking its OAuth token.
Arista's October 22 VeloCloud flaw turns read-only into operator
Arista's VeloCloud Orchestrator has an exploited zero-day SQL injection, CVE-2026-114625 at CVSS 9.9, escalating read-only accounts to operator.
By October 23, one Brotli flaw reached every language
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that lets unauthenticated attackers run code via crafted compressed streams.
Google wants your ID to ship Android apps
Google's 2027 rule forces every Android developer to register identity and signing-key evidence before their apps can install, even outside the Play Store.
fortnew.py scraped 70,000 credentials from exposed appliances
k0t harvested 70,000+ credentials from exposed Fortinet and Palo Alto edge devices, using CVEs or brute force, OpenConnect footholds, and ransomware links.
GitLab regex flaw since 2014
CVE-2026-110264 is an unauthenticated CVSS 10.0 RCE in GitLab's Onigmo regex engine affecting every self-managed release since 7.0, with backported fixes.
Malware rode in LiteLLM's installer
LiteLLM 1.107.0 shipped from a hacked release pipeline with malware that steals cloud, AI, and developer credentials before the app even runs.
The Wire — latest
All →- Amazon's Toddler Tablets Clash With Pediatric Warnings
- F-Zero X on 3DS: An AI-Orchestrated Development
- How Disney Makes Animated Films: The Production Pipeline
- How the Demoscene Inspired a Career in Code
- iPhone Duo Teardown Reveals Hidden Crease Tech, Fragile Screens
- Large Context Windows Create New AI Failure Modes
- LLM Price Wars Heat Up as Models Become Commodities
- Static Sites Don't Need Next.js: Perfect Lighthouse via Framework Removal
- Turning Abandoned Tabs Into a Plant-Slashing Game
- 200K Creative Jobs Lost as AI Disrupts Digital Arts
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.