RC RANDOM CHAOS

Articles

Long-form writing on tech, culture, and the edges of the internet.

Asahi 7.1 maps the DMA layer under macOS
Apple SiliconAsahi Linux

Asahi 7.1 maps the DMA layer under macOS

Asahi Linux 7.1 exposes Apple Silicon coprocessors, DART IOMMU boundaries, and a silent SMC firmware ABI change - the layer below every macOS EDR agent.

7 min read
Bypassed controls are absent controls
credential stuffingauthentication

Bypassed controls are absent controls

Leanstral 1.5 bypassed CAPTCHA and rate limiting. Those controls score requests, not identity, the only boundary that refuses credential replay.

7 min read
Bypassing the paywall is not a billing bug
access controlcloudflare

Bypassing the paywall is not a billing bug

Cloudflare's x402 monetization gateway collapses payment and access enforcement onto one bypassable point, turning a billing layer into a single failure domain.

7 min read
CVE-2026-31840 blames the encoder, corrupts the decoder heap
ffmpegheap-corruption

CVE-2026-31840 blames the encoder, corrupts the decoder heap

CVE-2026-31840: FFmpeg's AAC path carries a heap out-of-bounds write and UAF. The bug is in the decoder, not the encoder - mechanism, exploitation surface, and telemetry.

6 min read
Log4Shell executed exactly as written
vulnerability-researchsupply-chain-security

Log4Shell executed exactly as written

Log4Shell, xz-utils, and Spring4Shell weren't isolated bugs. They were composition failures in systems too deep for anyone to fully read. The disease is complexity.

7 min read
Read the mark hidden in your bot's requests
steganographydetection-engineering

Read the mark hidden in your bot's requests

Steganographic request marking as a targeted reconnaissance primitive: how invisible-Unicode carriers survive into logs and why SIEM normalization goes blind.

7 min read
Schrems II broke US data transfers, July 2020
data-residencygdpr

Schrems II broke US data transfers, July 2020

Schrems II (CJEU C-311/18) makes US-hosted EDR telemetry on EU endpoints a restricted transfer. Why data residency now degrades detection fidelity.

6 min read
Your subject can end your investigation
OSINT securityoperational security

Your subject can end your investigation

A US ambassador used Belgian police to halt reporting. The failure is an unscoped trust channel from subject to enforcement, not a press dispute.

6 min read
A single rubber stamp guards the transatlantic data pipe
data privacyEU-US Data Privacy Framework

A single rubber stamp guards the transatlantic data pipe

The EU-US Data Privacy Framework authorised transfers on an adequacy premise the Commission never controlled. That is a failed control, not a blowup.

7 min read
In 2026 the memory discount quietly expired
systems drifttrust validation

In 2026 the memory discount quietly expired

Memory lifecycle plans keep resolving a price the market no longer charges. The gap is structural drift, not a failure of hardware or planning.

7 min read
One million passports now sit in the open
passport data exposureidentity verification risk

One million passports now sit in the open

One million passport records exposed online: a board-level view of identity-layer risk, control failure, and the conditions leadership must now enforce.

7 min read
Security teams mislabeled the GPU bubble
resource scarcityaccess control

Security teams mislabeled the GPU bubble

The GPU bubble is not a hardware vulnerability. It is a demand spike against allocation systems that enforce no limit under scarcity.

8 min read