Articles
Long-form writing on tech, culture, and the edges of the internet.
Arista's October 22 VeloCloud flaw turns read-only into operator
Arista's VeloCloud Orchestrator has an exploited zero-day SQL injection, CVE-2026-114625 at CVSS 9.9, escalating read-only accounts to operator.
By October 23, one Brotli flaw reached every language
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that lets unauthenticated attackers run code via crafted compressed streams.
Google wants your ID to ship Android apps
Google's 2027 rule forces every Android developer to register identity and signing-key evidence before their apps can install, even outside the Play Store.
fortnew.py scraped 70,000 credentials from exposed appliances
k0t harvested 70,000+ credentials from exposed Fortinet and Palo Alto edge devices, using CVEs or brute force, OpenConnect footholds, and ransomware links.
GitLab regex flaw since 2014
CVE-2026-110264 is an unauthenticated CVSS 10.0 RCE in GitLab's Onigmo regex engine affecting every self-managed release since 7.0, with backported fixes.
Malware rode in LiteLLM's installer
LiteLLM 1.107.0 shipped from a hacked release pipeline with malware that steals cloud, AI, and developer credentials before the app even runs.
Node.js patched a code-execution Brotli bug October 21
Imperva's Node2Shell runs code on a stock Node.js 24.22.0 image through a bundled Brotli decoder flaw, CVE-2026-111497. What is exposed and how to patch.
SafePay routed 600 ransomware hits through Mullvad
CISA and partner agencies detail SafePay ransomware, which has hit 600+ critical infrastructure orgs since August 2024, plus how to defend against it.
Zeabur breach exposes 3.22 million environment-variable records
A practitioner-focused method for separating systemic security failures from routine breach-cycle operations.
A crafted regex runs code on every GitLab since 2014
GitLab's CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in the Onigmo regex compiler, hitting every self-managed version since 7.0. Patch now.
A malicious LiteLLM release stole credentials on install
LiteLLM 1.107.0 on PyPI shipped a credential stealer and an hourly backdoor that ran at every Python startup; the upstream GitHub source never had them.
Four chained Plex bugs reach unauthenticated RCE, now exploited
Four chained Plex Media Server bugs (Plex2Shell) enabling unauthenticated RCE are in CISA's KEV catalog, exploited to drop miners and proxy malware. Patch now.