Articles
Long-form writing on tech, culture, and the edges of the internet.
The integration is the attack surface
Pentagon raised Israeli collection risk to top tier. The technical exposure is supply chain privilege inherited from vendor software, not espionage.
Your AI features are now your attack surface
Meta has confirmed over 1,000 Instagram accounts were compromised through abuse of its AI chatbot - a board-level view of the control failure.
Your living room TV is harvesting credentials
Smart TVs are operating as nodes in the AIScrap credential harvesting operation. Permissive defaults permit it. Unpatched firmware does not remediate it.
Claude Code deleted our deploy pipeline
Why semantic code understanding for Claude Code agents needs an entity index on top of git, not an LSP. Receipts from 90 days of production edits.
CVE-2023-2163 is now a config file away
Zeroserve exposes eBPF program loading through an HTTP scripting surface. The kernel verifier becomes the trust boundary for every web request.
IOCCC 2025 ships glibc tcache poisoning primitives
The 29th IOCCC's 2025 winners distill heap metadata corruption, tcache poisoning, and type confusion into legal C - the same primitives behind modern CVEs.
Meta's chatbot worked exactly as designed.
Meta's AI chatbot enabled mass Instagram account takeover by resolving conversational framing into identity actions through sanctioned internal workflows.
Motorola signed its own kill switch
Motorola's silent firmware push bricked its WiFi router line. The mechanism is identical to AcidRain. Here is what failed and why it repeats.
Nothing broke when your router died
Motorola's routers stopped as a class not from damage but because every device resolved a shared reference that no longer meant what it once did.
Q1 2026: Iranian crews living off P2P
Compromised P2P accounts are driving lateral movement and exfiltration in Israeli orgs. The fabric, not the platform, is the C2 channel.
Steam's I/O thread is holding a dead pointer
Transport-layer race condition in Valve's GameNetworkingSockets creates a remote UAF primitive that sits below session crypto and evades EDR telemetry.
The 64KB segment where every overflow rewrote a free list pointer
Win16's Local Heap overflow defines the metadata corruption class that still drives modern browser and kernel exploitation in 2026.