Articles
Long-form writing on tech, culture, and the edges of the internet.
The door Mythos left unlocked
Mythos is an identity management failure. Privileged access boundaries were not enforced. Lateral movement reached sensitive data.
Typosquatted Microsoft AI packages harvest developer credentials
How attackers weaponised typosquatted Microsoft AI tooling to harvest OpenAI, HuggingFace, AWS, and Azure credentials from developer workstations.
Your CA just picked sides
Let's Encrypt restricts certificate issuance in US sanctioned territories. The CA is now conditional. Operator response and dependency inventory required.
Your supply chain isn't compromised. It's working.
Microsoft's open-source developer tools executed credential-stealing code through normal package resolution. The control plane never inspected what was returned.
Antibody catalogs are unsanitized user input
Thermo Fisher antibody metadata manipulation is a supply chain attack against bioinformatics pipelines - not a data integrity issue. Here is the mechanism.
CVE-2024-3400 shipped exploited before the advisory
Why the gap between CVE disclosure and production detection is structural - and where attackers operate inside it.
Cypherpunk frees the key schedule twice
UAF in the Cypherpunk Library's context teardown - CWE-416, heap reuse, sandbox-free RCE path, and why EDR misses the corruption stage.
Massachusetts bans precise geolocation sales
Massachusetts banned the sale of precise location data. The statute kills a commercial attack vector and creates real telemetry gaps for defenders.
Motorola bricked your routers
A board-level read on the Motorola router event: vendor authority over fielded equipment is a primary risk vector, and silence is the visible control failure.
NovaMind reframes breach disclosure as system design
After a thousand breaches, the gap between compromise and disclosure is widening. The fix is treating disclosure as a pipeline, not a crisis.
Pentagon raises Israel espionage threat to highest level
The Pentagon's elevated Israeli espionage threat exposes how access controls built on allied trust drift silently from current risk posture.
Texas data centers failed the voltage test
Texas grid voltage failures at data center and crypto sites expose the same admission-without-enforcement gap every identity boundary already has.