Articles
Long-form writing on tech, culture, and the edges of the internet.
The price sheet on your zero-day
Zero-days aren't disappearing. The underground exploit market matured, pricing is structured, and weaponization speed has compressed the defender's reaction window.
The Roblox cheat never touched Roblox
How a Roblox cheat turned into a Vercel supply chain compromise - stealer to stolen token to dependency confusion to persistent build-pipeline access.
Vercel hands attackers your build pipeline
Technical IR playbook for a Vercel CI/CD compromise: attack chain, MITRE ATT&CK mapping, telemetry gaps, containment sequence, and residual exposure.
Your backlog is my inventory
Technical, cognitive, and intent debt operate as live attack vectors. The gap between recognition and remediation is where breaches occur.
Your MSSP is selling you blindness.
MSSPs run perimeter-era detection while attackers operate inside the identity boundary. The gap is structural, not a resourcing problem.
Your Phone Is Nation-State Inventory
UK confirms 100 countries hold mobile spyware. The handset trust model has failed. Identity is the boundary, not the device.
Your security pipeline missed 271 bugs
Mozilla's Anthropic Mythos scan surfaced 271 Firefox 150 vulnerabilities. The delta exposes the limit of single-pipeline vulnerability assurance.
Back Button Hijacking Is Not a Bug-It's a Trust Boundary Failure
Back button hijacking isn't a bug-it's a trust boundary failure. When client-side state persists after logout, authenticated content remains accessible without server-side validation. This is not browser behavior; it's a design flaw in access control enforcement.
How Production Systems Actually Work With LLMs-Not Which Model You Choose
Production-grade AI systems don't depend on choosing between Claude and ChatGPT. They rely on consistent engineering: input sanitization, output validation, fallback logic, and structured pipelines-regardless of the underlying LLM.
How Trust Delegation Without Revalidation Creates Systemic Failure
Systems optimized for trust delegation without revalidation create persistent vulnerabilities. When automation assumes ongoing validity from trusted sources, adversaries exploit consistency-without breaking in-to propagate compromise at scale.
Running Gemma 4 Locally via Codex CLI: What Actually Works in Practice
Running Gemma 4 locally via Codex CLI offers isolation but not guaranteed consistency. Real reliability comes from input validation, output schema checks, and disciplined system design-not the model alone.
The Real Risk Isn't AI-It's Context Ignorance in Cybersecurity
AI-generated attacks fail in production due to unvalidated assumptions about access controls. The real risk isn't AI-it's context ignorance in cybersecurity operations.