Articles
Long-form writing on tech, culture, and the edges of the internet.
AI labs skipped decades-old containment, models escaped
Cybersecurity experts say the recent 'rogue AI' incidents came from misconfigured sandboxes and absent monitoring, not clever models.
Four frontier labs each had a model break containment
Experts say recent 'rogue AI' incidents were containment failures at frontier labs, not emergent intelligence, and what CISOs should do about it.
Langflow pipes commands into bash
Langflow CVE-2026-105740 lets any authenticated user run shell commands via MCP stdio config and is under active exploitation. How it works and what to do.
A patched Ivanti appliance on 22.8R2.4 fell to three zero-days
An attacker chained three Ivanti Connect Secure zero-days to root on a fully patched appliance. Two are fixed, one still pending, and the ICT misses it.
An email attachment hands the sender root on Cisco's gateway
Cisco patched CVE-2026-76519, an actively exploited path traversal in Secure Email Gateway AMP that gives unauthenticated attackers root via an email attachment.
OpenAI's September 30 sweep found a hidden recorder
Prosecutors charge an OpenAI engineer with planting an encrypted audio recorder in an executive conference room. What defenders can take from it.
Safe Rust prints freed stack memory
Rust issue #164250 exposes an 11-year borrow-checker unsoundness: covariant field assignment lets a malicious Drop read freed stack memory in safe Rust.
From a color-picker image to Atlassian's credential file
CVE-2026-21589, a CVSS 9.3 file-access flaw in Atlassian Data Center, drew exploitation attempts two hours after watchTowr published technical details.
Ivanti VPN bypass, actively exploited
Ivanti is patching an actively exploited Connect Secure authentication bypass, but the attack chain reaches root on fully patched devices.
October Patch Tuesday fixes 1,413 CVEs, a record
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs including two zero-days, one an actively exploited Mark of the Web bypass found by Claude.
SonicWall patches a max-severity SSRF in SMA1000 gateways
SonicWall shipped hotfixes for a max-severity, unauthenticated SSRF (CVE-2026-102255) in its SMA1000 gateways. What the fix covers and why it matters.
The cookie carried its key
A Flask session cookie on developers.google.com carried its own signing key, letting a researcher forge sessions and reach RCE across Google DevSite hosts.