Articles
Long-form writing on tech, culture, and the edges of the internet.
Reporting the Canvas breach details is malpractice
Canvas LMS breach analysis where vector, scope, and data classes remain unconfirmed, and what structural identity exposure that creates.
The breach scope you're quoting is fiction
Canvas breach scope is not confirmed. Operator brief on what failed, what must be assumed, and what users and institutions must do now.
The record count is not the breach
A board-level brief on the healthcare data breach: access governance did not hold at runtime, and assurance must now be proven, not assumed.
US extradites alleged Chinese state hacker
An extradition in an alleged state-aligned cyber matter shifts the standard of care boards will be measured against in disclosure and litigation.
Wiper hits Venezuelan cyberattack victims
A wiper identified in the Venezuelan cyberattack resets the threat profile from intrusion to destruction. What failed, what it exposes, what must change.
Your perimeter is not absorbing this
AISLE published 38 CVEs against OpenEMR. What the volume confirms, what remains unconfirmed, and what operators must verify per deployment.
AI costs more than humans
Nvidia says AI costs more than human workers. The real issue is architecture, not compute price. Here is how to fix the unit economics.
cat is now an exploit
MAD Bugs establishes that cat readme.txt is not a passive read. The terminal is an interpreter and untrusted bytes are program input.
Chat message steals your credentials
CVE-2026-44843 reduces credential theft to message receipt. The failure is identity boundary enforcement, not chat parsing. Operator breakdown.
Copilot's new 27x Opus multiplier breaks your budget
Copilot's 9x Sonnet and 27x Opus multipliers turned model selection into a governed engineering decision. Most teams have no routing layer.
CVE-2026-31337: Dirty Frag roots every major distro
Technical analysis of CVE-2026-31337 'Dirty Frag': a Linux kernel UAF in IP fragment reassembly giving local root across major distros.
CVE-2026-44843 turns one message into credential theft
CVE-2026-44843 collapses the boundary between chat message receipt and credential disclosure. What failed, what is not confirmed, and what must change.