Articles
Long-form writing on tech, culture, and the edges of the internet.
Ahsay's patched flaws still dropped miners October 7
Two unpatched AhsayCBS flaws, still present in 10.3.4, are being chained to deploy webshells and an XMRig miner; Huntress saw the activity on October 7.
Atlassian flaw exploited two hours after watchTowr's report
Attackers began exploiting Atlassian's unauthenticated file-access flaw CVE-2026-21589 within two hours of a public PoC. Affected products and mitigations.
Bricksforge RCE flaw exploited since October 7
CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, is under active exploitation for unauthenticated RCE. Update to 4.0.1 and audit uploads.
Bricksforge writes attacker PHP where the client asks
A CVSS 10.0 unauthenticated RCE in the Bricksforge WordPress plugin (CVE-2026-85097) is under active exploitation. Update to 4.0.1 and audit uploads.
Exploit attempts hit SonicWall two days after its patch
A maximum-severity pre-auth SSRF in SonicWall SMA 1000 drew 135 exploitation attempts within days of the October 6 patch.
AgentCore and the Metadata Problem
Zenity's AgentCorruption research shows how one prompt to an AWS Bedrock AgentCore agent could expose credentials and widen blast radius.
iVerify discloses new DarkSword iOS variant
P7 DarkSword adds iOS wallet theft, keychain extraction, and remote command execution through SpringBoard-injected implants.
LMCache Exposes Remote Code Execution
CVE-2026-105192 lets unauthenticated attackers run code on exposed LMCache multiprocess servers, with no patched release available.
OpenAI Safety Firings Raise Control Questions
OpenAI's firing of three safety researchers shows how unclear research-handling rules can weaken AI safety review and accountability.
86,644 FortiGate boxes still take the old password
The FBI says FortiBleed is still active, using 86,644 Fortinet credentials harvested months ago to plant admin accounts and feed ransomware crews.
Cisco warns of five NX-OS bugs that reach root
Cisco patched five critical NX-OS flaws allowing root code execution on Nexus 3000 and 9000 switches, plus regardless-of-config Cisco License bugs.
DeepSeek 4.1 Flash Looks Boring
DeepSeek 4.1 Flash matters because cheap long coding sessions change agent governance more than they introduce a new exploit.