threat intelligence
32 posts
XBOW topped HackerOne in 2025 and fixed nothing
Vulnerability research rewards finding, not fixing. Exploitation tracks disclosure, not the flaw. Why attackers react to reported CVEs, and where telemetry goes blind.
The copy runs past the allocation, again
Recurring dystopian tech vulnerabilities persist because defenders patch the CVE instance and never hunt the underlying mechanism. The inaction is the vuln.
Kalshi ships an unauthenticated oracle
Kalshi resolves contracts against unauthenticated public news feeds - an oracle-manipulation flaw that lets crafted narratives move regulated markets.
Read the mark hidden in your bot's requests
Steganographic request marking as a targeted reconnaissance primitive: how invisible-Unicode carriers survive into logs and why SIEM normalization goes blind.
Flock's real attack surface was never the camera
Flock ALPR cameras are a national sensor grid - the security risk isn't recording, it's a queryable movement database reachable by thousands of weak accounts.
Server returns 200, Google returns nothing
De-indexing removes content from Google's index, not the web - a complaint-driven, trust-based pipeline that lets implicated parties suppress public records.
Mirai's hardcoded logins still answer on 554
Open webcams indexed by Shodan and Censys are not a privacy footnote - they map insecure OEM firmware, exposed services, and supply chain risk.
Mythos AI cleared for distribution, no validation report
REDLINE breaks down the security risk in releasing Mythos AI to trusted US organizations: not the model, the missing adversarial validation and zero prompt-level telemetry.
The device is the inventory
Smart TV apps embed residential proxy SDKs that turn devices into exit nodes. The trust failure lives in the build pipeline, not the hardware.
The patch opens the attack window.
The Coming Loop is the collapsing gap between vulnerability disclosure and mass exploitation of internet-facing appliances - and why edge telemetry stays blind.
Contagious Interview ends at npm install
How DPRK actors turn LinkedIn job offers into code execution via npm postinstall hooks, what BeaverTail steals, and why developer endpoints stay blind.
Forum sellers timestamp breaches before victims notice
A cybercriminal's first forum sales thread is often a fresh breach - a timeline anchor, an attribution leak, and the earliest warning most orgs ignore.