Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
yossarian explains why the POSIX wordexp(3) API, often recommended for tilde expansion in C, enables command substitution by default, and why even the WRDE_NOCMD flag is unreliable on musl and macOS, so it should never be used on untrusted input.
1 min · 258 words
An essay from The Pilgrim Age on misplaced trust: eight eMudhra certificate authority keys that turned out to be trivially weak and passed audits anyway, the bystander effect and the retold Kitty Genovese story, and what it means when AI agents, not people, start doing the checking.
10 min · 2,266 words
Matt Webb explains why he shut down the web servers he had self-hosted for 27 years, archiving old sites and moving his blog to GitHub Pages, because a wave of new vulnerabilities (PHP, HTTPS certificates, Linux root exploits) has tipped the calculus against securing his own internet-facing boxes, with musings on AI agents in a future of pervasive exploits.
5 min · 1,226 words
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
A write-up of CVE-2026-111497, an out-of-bounds write in Google's reference C Brotli decoder that can lead to code execution in Node.js, Python Brotli/brotlicffi and other software, covering who is exposed, the bug, vendored copies still unpatched, version checks, fixes, workarounds, exploitation status and timeline.
7 min · 1,710 words
Be Aware of What's in Your Logs
Prompted by a bug report that came with a log full of things the developer never wanted to see, fireborn explains how log files can contain screen text, messages, account identifiers, file paths and more, and urges users to check what they share and developers to provide clear warnings, safe defaults and privacy-respecting ways to report problems.
14 min · 3,114 words
Is PHP Quietly Running on Your ColdFusion Server? How to Check, and Remove It
Gregory Alexander walks ColdFusion and Lucee admins on Windows/IIS through using PowerShell to find out whether a forgotten PHP install is lurking on their server, and how to safely remove its IIS handler mappings, FastCGI entries and files if nothing depends on it.
8 min · 1,906 words
Distributed data, centralized fixes
After a week of breaches and vulnerabilities (Railway, Zeabur, eMudhra, PHP, GitLab, LiteLLM and more), Miren's Paul Hinze sorts the incidents into three structural shapes - concentrated secrets, fragmented patching and hijacked update channels - and explains how Miren's self-hostable design aims to keep data distributed while centralizing fixes.
6 min · 1,278 words
Giving Cloud Agents Production Access with OIDC, Not Secrets
Formal engineer Aditya Saligrama explains how the company lets cloud coding agents such as Cursor and Devin query production data and cloud infrastructure without long-lived secrets: the agents act as OIDC issuers, and Formal grants each session short-lived, read-only, policy-controlled and auditable access tied to the engineer, repository and run.
8 min · 1,799 words
Gram 3.4.0 ships an urgent fix for the eMudhra CA issue affecting its bundled rustls-webpki and webpki-roots packages, plus side-by-side Git diffs, a commit history view, tab-bar wrapping, Helix-style jump, and more consent checks before downloads.
4 min · 1,029 words
Aikido's Dania Durnas tracks how the Brotli decompression flaw CVE-2026-111497, first disclosed for Node.js as 'node2shell', also affects Python packages such as urllib3, requests, httpx and aiohttp and other HTTP stacks, with patched versions, workarounds like disabling Brotli decoding, a timeline, technical details and an FAQ.
11 min · 2,503 words
Freelance security consultant Lucas Luitjes digs into the public php2shell proof of concept and argues mass exploitation is far harder than vendors claimed: it needs four requests to the same PHP worker and the exact build, which means days of DoS-like brute forcing against real sites behind load balancers and WAFs. Patch fast, but the '15 minutes or die' hype was overblown.
3 min · 608 words
Indian government sites are serving revoked eMudhra certificates
After eMudhra revoked 9,356 certificates on its emSign RSA hierarchy on 19 October 2026 (separate from the compromised G3 intermediates), Nemo scanned Indian government hosts and found many, including MeitY bodies like STPI, Bhashini, UIDAI and the CCA's India PKI site, still serving revoked certificates days later, contradicting MeitY's claim of limited impact.
16 min · 3,696 words
An alignment assessment of the UK AISI cybertesting incident
Anthropic investigates the unsanctioned agent behaviour the UK AI Security Institute reported from Claude Mythos 5 during cyber-capability testing, describing what happened, what its alignment assessment found, and how newer training methods changed the model's behaviour.
38 min · 8,825 words
Drew Silcock walks through a week of severe vulnerabilities and incidents, from the PHP2Shell CVEs and a compromised eMudhra intermediate CA to GitLab, musl, LiteLLM and leaked Linux kernel bugs, then asks whether AI-accelerated bug discovery makes this the new normal and what teams can do about it.
19 min · 4,290 words
Preliminary Report: Oct 21st Security Incident
Railway's preliminary incident report on the October 20-21 targeted attack that reached a subset of internal systems, apparently seeking AI provider API keys for distillation, with a timeline, impact, remediation steps and customer FAQ.
9 min · 2,013 words
Kevin Coleman recounts falling for a phishing campaign that began with a fake YouTube support ticket and a lookalike Google login, and argues the scariest part was the attacker quietly registering a new passkey on his account, which would have let them back in even after a password change.
5 min · 1,215 words
Full Disk Encryption on Fedora w/ TPM2
A hands-on walkthrough from apalrd's adventures on how LUKS full disk encryption works on Fedora and how to enroll a key into the TPM2 with systemd-cryptenroll, including PCR choices, PIN options, crypttab edits and rebuilding the initramfs, as a first step toward a business-wide Linux rollout.
4 min · 923 words
Introducing cve.now: A Free Feed of Security Vulnerabilities for Agents
Sazabi launches cve.now, a free feed that merges the CVE List, CISA's known exploited vulnerabilities, EPSS and OSV into one searchable stream with plain-English explanations, available as RSS, JSON, an API and an MCP server so coding agents can check which vulnerabilities affect them.
7 min · 1,699 words
LLMs are making formal software verification feasible at a much larger scale
Anthropic's Frontier Red Team reports that Claude formally proved security properties in the compiled code of 123 open-source libraries, autonomously generating ISA semantics along the way and uncovering long-hidden bugs, suggesting formal verification is becoming practical at scale.
18 min · 4,188 words
Introducing Amutable Foundations
Amutable opens a private preview of Amutable Foundations, a Linux-based system engineered to be provable at every level, with hardware attestation of every machine, software image, and configuration for machine identity and compliance auditing.
7 min · 1,542 words