Articles
Long-form writing on tech, culture, and the edges of the internet.
Heartbleed was a C bug, not a web bug
CVE-2014-0160 was an out-of-bounds read in OpenSSL C, not a JavaScript flaw. The real mechanism, the network-only telemetry gap, and what survived the patch.
NetScaler trusts snprintf, leaks adjacent heap memory
Why 'silent' vulnerabilities like Citrix Bleed (CVE-2023-4966) are already exploited at the network edge, what they produce in telemetry, and where defenders are blind.
PackageKit waved 1500 packages through unchecked
Arch Linux calls a 1500-package malware incident contained. An install path that skips verification was never a control, only a delivery channel.
The design is the vulnerability
Twenty one zero-days in FFmpeg are a symptom; the finding is an architecture that parses untrusted input with no enforced audit gate.
The valet's key still opens your Civic
How a Honda Civic keeps granting access long after the conditions of trust expire, and why reference replaces verification across systems.
1992 hardware, no MMU, every payload lands
The Game Boy Work Boy exposes a system with no MMU, DEP, or ASLR - flat executable memory and a fixed layout where any write becomes code execution.
Nothing crashed, nothing shipped
An agent committed at 03:17; production absorbed it at 03:20. Eleven silent hours later: why every commit is a deployment, and how to watch them land.
Ring 0, fed a stranger's save file
The US directive suspending Fable 5 and Mythos 5, analyzed: why game clients are privileged code, how asset and netcode bugs work, and why trust is the flaw.
The seed money didn't kill that repo.
An AI OSS tool repo archived overnight after a 73M seed round. The targeting, scrub, and OSINT operation are not confirmed. What the facts actually support.
A broken boot is not a breach
macOS 27 beta stops Asahi Linux booting. Not a confirmed breach: a demonstration that the assumed boundary between OS domains was never enforced.
A reverse shell dressed as a Firefox patch
Inside the 2025 AUR compromise: how CHAOS RAT shipped in fake browser packages, why update automation made it worse, and how to audit PKGBUILDs in 30 seconds.
Boundary change, not version bump
WASI 0.3 shifts IPC to shared memory. If runtime isolation is not enforced, your trust boundary does not exist. An operator briefing on what must change.