Articles
Long-form writing on tech, culture, and the edges of the internet.
curl pauses security report intake for July
curl is closing its vulnerability intake for July 2026 to survive AI-generated report spam, and the precedent it sets for open source disclosure.
GrapheneOS Android 17 degrades every exploit primitive
GrapheneOS's Android 17 port: how sync MTE, hardened_malloc, and a hardened kernel degrade mobile exploit chains-and why failed attempts are the loudest telemetry.
No mitigations, full code execution
Memory corruption in shared embedded firmware components grants attacker code execution at firmware privilege, replicated across hundreds of vendor devices.
Removing curl and wget stops nothing
Bash /dev/tcp opens TCP sockets and sends HTTP with no curl or wget, evading process-name detection while leaving cleartext on the wire.
The door was unlocked, not picked
Federal concern over fable 5 was a trust boundary failure, not a jailbreak. Fix this code targets content, not access enforcement.
1994's eight fallacies hit AI agents harder
The eight fallacies of distributed computing turn 21, and autonomous AI agents make every one of those architectural assumptions more dangerous.
Contagious Interview ends at npm install
How DPRK actors turn LinkedIn job offers into code execution via npm postinstall hooks, what BeaverTail steals, and why developer endpoints stay blind.
DELETE leaves the body
DROP TABLE and DELETE in Postgres destroy nothing: MVCC dead tuples, unlinked relfilenodes, and WAL keep the data recoverable, and replicas diverge.
Forum sellers timestamp breaches before victims notice
A cybercriminal's first forum sales thread is often a fresh breach - a timeline anchor, an attribution leak, and the earliest warning most orgs ignore.
One login screen now guards your entire machine
Windows 11's forced Microsoft account moves the identity boundary to one access point. Compromise the account and you assume the control, not bypass it.
The 34x price hike isn't the problem
Hetzner raised dedicated server prices 34x. The cost is the symptom. The exposure is single-vendor control over a boundary the customer cannot enforce.
The contract you pasted is now giving orders
Large AI context windows turn conversations into unsecured databases, breaking DLP assumptions and opening prompt injection paths. Here's how to reassess the risk.