Encrypted USB Drives: When the Lock Guards Nothing
Somewhere in a warehouse right now, there are boxes of USB sticks promising 'military-grade fingerprint encryption' that a twelve-year-old with a spudger could...
Cybersecurity
Application security, threat analysis, secure coding practices, and the evolving cybersecurity landscape.
21 articles
Linux TCP Use-After-Free: Patch vs Mitigate
Your kernel has a remotely reachable use-after-free in the TCP handshake path, your distro hasn't shipped a fix, and someone has already demonstrated a working...
Crypto Exchange Security Fails on Speed, Not Cryptography
Twenty minutes. That's how long it reportedly took attackers to pull $6.3 billion out of Binance — less time than most incident response teams need to assemble...
Cursor Marketplace Backdoor: VS Code Fork Trust Problem
A developer opens Cursor on a Tuesday morning, sees an update to the Claude Code extension, and lets it install. Nothing looks different. The extension loads,...
Anti-LLM Obfuscation: Fingerprinting Scripts Fight Back
A researcher hooked every canvas call on 10,000 of the web's biggest sites, collected over a thousand fingerprinting renderings, and went looking for the...
Steal My Bitcoin: PHP Exploit Hype Meets Reality
If you spent any time on security social media recently, you saw the claim: the new PHP remote code execution bugs are so trivial that AI agents are already...
Switch 2 Jailbreak: The Exploit Chain That Beat Secure Boot
A fresh console ships with a hardened microkernel, pointer authentication on every return address, execute-only memory, control-flow integrity, and a signed...
PyPI Supply Chain Attack: The LiteLLM Lesson
Three files. That's the entire footprint of one of the nastiest Python supply chain attacks we've seen: a 12-byte cook.pth, a 22 KB cook.py, and a 25 KB...
eMudhra's Weak CA Keys: 5 PKI Myths, Busted
One of eMudhra's certificate authority private keys is the number 4. Not a 384-bit number that starts with 4 — just 4, with 47 zero bytes padding it out to...
PHP CVE Window: Why Pulling the Plug Beat Clever Fixes
When the PHP project announced that a critical security release was coming — days before the patch actually existed — the internet did what it always does: it...
Intermediate CA Compromise: When Trust Chains Snap
Here's a take that sounds backwards: the worst certificate authority incidents aren't the ones where an attacker breaks in. The recent eMudhra intermediate CA...
NIST Curve Seeds Solved: 5 Myths About ECDSA Origins
For twenty-five years, the NIST ECDSA curve seeds were the closest thing applied cryptography had to an unsolved cold case. Five seemingly random 160-bit...
Containment vs Monitoring for AI Agents: When Each Wins
When an LLM agent at a frontier lab reached out of its test environment and poked a hole in Hugging Face's infrastructure, the headlines wrote themselves:...
When Hackers Defrost Your Supermarket: OT Security Lessons
Imagine you're the night-shift manager at a supermarket in Lyon. At 3 a.m., the overnight crew notices frost melting off the frozen-food cases. Then the...
CLI Tools Shouldn't Install Background Daemons by Default
A developer runs npm install -g @openai/codex to try an AI coding assistant, and ends up with a persistent, self-updating background daemon they never asked...
Your Fitness App Is a Surveillance Tool
A French newspaper recently tracked the real-time location of France's only aircraft carrier — the Charles de Gaulle, one of the most strategically sensitive...
The Evolution of sudo: Unix su to Modern Privileges
Here's a fact that surprises most people: when you type your password into sudo, you don't see any feedback at all. No asterisks, no dots, nothing. The cursor...
When Internet Safety Laws Become Censorship Tools
In 2023, a domestic violence support forum was blocked by a major UK ISP's content filter. The filter, designed to protect children from harmful content, had...
Quantum Cryptography: What Developers Actually Need to Know
Charles Bennett and Gilles Brassard won the Turing Award for their foundational work on quantum information science — specifically, for the BB84 quantum key...
What the Xbox Hack Teaches About Hardware Security Models
Microsoft designed the Xbox One's security architecture to be impenetrable. A hardware root of trust. A custom hypervisor. Encrypted storage with per-console...
The Blind Spots in Cloud Authentication Logging
A security team at TrustedSec recently disclosed their third and fourth methods for bypassing Azure sign-in logging. That's four independent techniques for...