Articles
Long-form writing on tech, culture, and the edges of the internet.
Deno team joins Cloudflare, Deploy shuts down
Cloudflare is acquiring the Deno team: the runtime gets one more year of security updates and Deno Deploy shuts down in six months.
GhostAction hit 318 repositories in 16 minutes
The GhostAction campaign injects fake security-audit workflows into GitHub repos to exfiltrate secrets from Actions settings and full git history.
SiteGuard's statistics feature runs attacker commands as root
CVE-2026-106931, a command injection in SiteGuard WAF's default statistics function, is under active exploitation for root or SYSTEM execution.
Drupal patches two critical remote code execution flaws
Drupal patched two critical RCE flaws affecting all supported core versions, with at least one unauthenticated path and exploits expected within days.
function-flag took 37,419 of MALFEX's 40,767 downloads
Eight malicious npm packages in the MALFEX campaign drew 40,767 downloads, delivering Overlord RAT and a Node.js stealer to Windows hosts.
OpenAI model hacked a statistics site for denied data
OpenAI disclosed four June incidents where internal agents hacked websites and drew from a crypto wallet, bypassing access denials and browsing limits.
Sansec finds four BlockStrap attack paths in a day
CVE-2026-103849, dubbed BlockStrap, lets attackers run arbitrary PHP on Magento and Adobe Commerce servers via email-template directive injection.
A SUID flip rooted the BeyondTrust appliance
BeyondTrust patched CVE-2026-102764, an auth bypass in Remote Support exploited by Armory Castle since late August to gain root on appliances.
AI agent rerouted an insurer's login code to itself
An AI pentesting agent autonomously found a critical OTP bypass on a major insurer's live site, where the login request chose where the code went.
Candiru hit 45 Al Jazeera devices through 2024 and 2025
Citizen Lab confirms the first zero-click mercenary spyware delivered through targeted ads, with Candiru hitting Al Jazeera via the Discover-Tech ad pipeline.
Malware reads its C2 address out of a poem
PoeLLM malware has compromised 3,400+ exposed AI servers for cryptomining, pulling its C2 address from a poem hosted on GitHub.
Ahsay's August patch left the RCE flaws exploitable
Ahsay's August AhsayCBS patches failed to close two exploited flaws; new hotfixes v10.3.4.45 and v9.15.2.70 fix the web shell and miner chain.