Articles
Long-form writing on tech, culture, and the edges of the internet.
Monday's iOS 18.7.11 backports a CoreGraphics fix to older iPhones
Apple backported the fix for exploited CoreGraphics flaw CVE-2026-86950 to iOS and iPadOS 18.7.11, extending it to older iPhone and iPad models.
ASD disconnected 180,000 computers from one Amadey controller
Australia's ASD breached one Amadey operation's backend and disconnected its controller from 180,000 infected computers, but stolen data stays stolen.
Claude rediscovered CVE-2026-56132 proving 123 libraries crash-free
Anthropic and Theorem used Claude to write formal proofs for 239 OSS-Fuzz entry points across 123 libraries, finding bugs trillions of fuzzing runs missed.
In October 2026, 44 agents hit 16 Japanese targets
Trend Micro found an attack platform running 44 AI agents against Japanese targets, automating recon through reporting while opening the same old doors.
Volt Typhoon exploited four zero-days through router relays
Volt Typhoon's Silent Train framework routes zero-day attacks through chains of compromised relay devices that operators strip within hours of each operation.
Microsoft pushed an emergency .NET patch Sunday
CVE-2026-111497 (HTTP2Shell/Node2Shell) is a Brotli decoder buffer overflow enabling RCE across Node.js, Python, and .NET. Patched versions and why blocking inbound requests isn't enough.
October 25 Tailworm report shows one device reaching root
A researcher's Tailworm report shows one hacked device on a Tailscale SSH network can reach root on other servers, with no patch yet available.
The host key warning on 333 hijacked Tor relays
How 333 infected Tor exit relays ran an Ebury-based SSH interception and unencrypted-mail collection campaign, and how a researcher found and helped take them down.
Forever Security found a malicious AGENTS.md in Downloads
A malicious AGENTS.md dropped into ~/Downloads can steer an AI coding agent into installing rogue packages or leaking its OAuth token.
On October 21, Ovi detailed Telegram spyware copying 2FA passwords
uCreator, a rentable Android spyware kit, hides inside tampered Telegram and WeChat apps to steal 2FA passwords in plaintext and clone accounts.
SBI leak put Central KYC numbers on BreachForums
SBI disclosed a leak of 3,897 customer records, including hard-to-rotate KYC data that feeds India's live PII lookup market.
Unit 42 flagged an attack packaged for an AI
PHP2Shell hit a European government network; Unit 42 saw agentic-AI post-exploitation and CYFIRMA tracked a Lazarus-linked scan of 216 hosts.