Articles
Long-form writing on tech, culture, and the edges of the internet.
Third party broke kernel LPE embargo
A kernel LPE entered public circulation when a third party broke the disclosure embargo. The control under review was the agreement, not the patch.
Attacker code ran on Foxconn's floor
Foxconn ransomware breakdown: what failed, why scale is not a control, and why continuous validation of identity and execution is the only defence.
Microsoft disclaims European sovereign cloud under oath
Microsoft's France legal affairs director told the Senate under oath he cannot guarantee European sovereign cloud data stays out of US reach.
NVD stopped, your scanner didn't notice
NVD enrichment is no longer keeping pace with CVE volume. What that breaks inside vulnerability management programs, and what operators must now own.
Shai-Hulud goes public
Shai-Hulud worm published to GitHub by teampcp. What is confirmed, what is not, and the publication interval that matters.
A junior operator, an API key, a hundred payloads
Google warns AI-powered hacking has reached industrial scale. Practical operational resilience steps for defenders facing faster, cheaper, adaptive attacks.
Dirty Frag races the refcount
Dirty Frag (CVE-2026-XXXX) is a Linux kernel page migration race yielding root LPE on all major distros. Mechanism, telemetry, and patch boundary.
Four Windows 11 zero-days on one desk
One researcher controls the release cadence on four Windows 11 zero-days, including BitLocker bypass yellowkey and LPE greenplasma.
Internship orders interns to install cracked Burp
A cybersecurity internship told interns to install cracked Burp Suite Pro. Here is what that directive actually means and why the operator must refuse it.
One chat message empties the credential vault
CVE-2026-44843 produces credential theft on chat message receipt. No user action required. Operator analysis of the failure mode and exposure pattern.
Patch status is not your risk variable
Operator brief on yellowkey and greenplasma, two public Windows 11 zero-days from the bluehammer and redsun researcher. What failed. What must now be true.
Polymarket breach claim, act now
Threat actor xorcat publicly claims a 300,000-user Polymarket data leak. Operator brief on contested boundary state, user exposure, and required posture.