Articles
Long-form writing on tech, culture, and the edges of the internet.
Mid-2024: a drunk LLM found a ksmbd kernel bug
How researchers used degraded LLM prompts to find a remote OOB write in the Linux kernel's ksmbd module, and what it means for kernel security.
NGINX ships emergency patch for HTTP/3 heap overflow
CVE-2026-42945 technical analysis: heap overflow in NGINX HTTP/3 HEADERS frame parsing, worker RCE primitive, telemetry gaps, and patch boundary.
Patching nginx doesn't close this one
CVE-2026-42945 NGINX rewrite module heap buffer overflow: bug mechanism, exploit primitives, MITRE mapping, and EDR telemetry blind spots in worker exploitation.
Russian hands on Polish water valves
A board-level read on Russian-linked activity against Polish water utilities and what it means for directors governing critical services.
Your MFA assurance just expired
A board-level position on AI-developed 2FA bypass: reduced authentication assurance, category-level exposure, and the conditions required going forward.
A new tool is not a replacement
An open-source Burp alternative was built. Capability, stability, and handling of intercepted material are not confirmed. Verify before adoption.
AI just broke 2FA at scale
AI was used to develop a zero-day 2FA bypass deployed at mass scale. The control's economic assumption has been falsified in the wild.
arXiv just raised the bar
arXiv's one-year ban on unchecked LLM errors signals a shift: validation pipelines, not better prompts, now define competent AI systems.
Attackers weaponized AI to bypass 2FA at scale
A reported AI-developed zero-day 2FA bypass in mass use removes the assumption that 2FA terminates the account takeover chain.
Complexity theory never said that
Complexity theory does not prove human-level ML is impossible. Here is what the theorems actually say and how to design AI systems around real constraints.
Your patched Exchange is already compromised
Microsoft confirms an Exchange zero-day under active exploitation. What the warning establishes, what it does not, and the defender posture required now.
Audi wired vehicles into a consumer auth flow
Audi Connected Vehicle security from an operator view: the boundary is no longer the key, it is the identity layer behind the myAudi app.