Articles
Long-form writing on tech, culture, and the edges of the internet.
A February 2025 migration exposed DigiCert customer records online
A February 2025 server migration exposed a DigiCert internal system, and a self-registered account read archived customer data and identity documents.
Long Passwords Bypass Alpine SSH Authentication
OpenSSH 10.6p2 fixes a critical password authentication bypass affecting Alpine Linux and other potentially vulnerable musl systems.
Long passwords unlock disabled accounts
The "*sshole" flaw lets oversized passwords log into *-disabled accounts on musl-based OpenSSH servers like Alpine under certain configurations. Fixed in 10.6p2.
One phishing page runs two account-takeover attacks
Fake OpenAI, SpaceX and Anthropic event pages run Kali365 device code and VoidProxy AiTM attacks to steal Microsoft and Google sessions, past MFA.
October 2026 teardown of Apple Intelligence's kinship classifier
Apple Intelligence's Personal Knowledge Graph ships an undocumented family classifier and plaintext kinship data on every Mac, readable with Full Disk Access.
Zyxel's June patch still runs attacker commands as root
Zyxel's Patch 2 for the GS1900 switches runs its bounds check too late, leaving the same unauthenticated root exploit open until Patch 3.
On October 30, an AI tool breached WorkOS
WorkOS says an attacker used the ARTEX AI offensive framework to breach an internal sales app and access CRM contacts and customer call summaries.
Vulnerable Windows Paint can pass scans as patched
The Paint fix for CVE-2026-83844 ships only through the Microsoft Store as build 11.2609.401.0, and the CVE record's lower version lets scanners miss it.
Malware ranks what you're worth
VOLTA-AUTODOXER is a Windows infostealer that uses Claude, Kimi, and Gemini via OpenRouter to rank a victim's stolen data by its monetization value.
62,969 exploit attempts hit WordPress days after patch
A WordPress Core RCE in the upgrade process drew 62,969 blocked attacks in 24 hours; patch to 7.1.4 to close the race window.
A ChatGPT link read your chats
A shared ChatGPT link could run attacker code in a victim's logged-in session and read private chats; OpenAI fixed the P1 flaw in eight days.
A crafted regex runs code on GitLab servers
CVE-2026-97229, a max-severity integer overflow in GitLab's CI/CD regex compiler, is exploited for unauthenticated RCE and is now in CISA's KEV.