Articles
Long-form writing on tech, culture, and the edges of the internet.
Northflank Breach Exposes AI API Keys
Northflank warned customers to rotate stored secrets after a breach led to reported unauthorized use of AI API keys.
A ChatGPT share link leaked your private conversations
Researchers turned a public ChatGPT share link into JavaScript running as the victim, reading private conversations through authenticated APIs.
Attackers probed Oracle EBS on October 27
Attackers are probing Oracle EBS CVE-2026-101767, an unauthenticated SQL injection in the TCF servlet that chains to RCE, days after Oracle's patch.
One POST read cross-tenant secrets
Five critical cross-tenant bugs in Azure API Connections let one tenant's requests reuse another tenant's stored backend credentials via Logic Apps.
SSH backdoor shipped in Cursor's Claude Code extension
Phorion found an SSH backdoor in Claude Code for VS Code 2.1.312 and 2.1.313 on the Cursor Marketplace. How the implant works and how to remove it.
Attackers walk straight through Drupal's checkout
Drupal is urging admins to patch CVE-2026-118539, a missing authorization flaw in Commerce Core that attackers are already exploiting in the wild.
KeyDrift steals Cisco SD-WAN keys via a 2023 zero-day
Cisco Talos found KeyDrift malware inside Catalyst SD-WAN controllers stealing AES-256 keys via CVE-2026-20127. What it takes, who runs it, and how to respond.
One WAP Push SMS crashes Android below the October 2026 patch
A malformed WAP Push SMS crashes com.android.phone on unpatched Android, dropping calls and looping reboots. How it works, recovery, and the October 2026 fix.
TeamViewer bug lets the host attack the viewer
TeamViewer's CVE-2026-111585 lets a controlled host crash or run code on the viewer connecting to it. Fixed in 15.83, with no workaround.
A 2.7 that silences logs
Warp Panda exploited VMware ESX logging flaw CVE-2026-41709 as a zero-day against U.S. law firms to cut audit-trail visibility. CISA added it to the KEV catalog.
Hacktivists leak 40,000 DHS personnel records
The Department of Peace stole records on more than 40,000 DHS employees by subverting single sign-on; DDoSecrets posted the data online.
macOS command-line tools still trust the compromised eMudhra certificates
macOS still ships git, curl and python3 that trust the compromised eMudhra CA, and 27.2 reverted the manual fix. How to check and mitigate.