Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Scott Helme explains how eight eMudhra intermediate CA private keys were recoverable from their public certificates in under a second because the keys were trivially small, how Chrome and Mozilla responded with CRLSet/OneCRL blocks and root removal, why the compromise cannot be contained, and what site operators should do now.
7 min · 1,642 words
Protecting Firefox users following the compromise of eMudhra intermediate certificates
Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1.
1 min · 272 words
Do minor curl vulnerabilities in the open
curl maintainer Daniel Stenberg announces that from October 26, 2026 the project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. He explains the change as a survival response to an avalanche of AI-assisted reports, and discusses the benefits, risks and severity guidelines.
4 min · 961 words
Header Accordions: QPACK amplification attacks against HTTP/3 servers
FoxIO research showing a remote, unauthenticated client can make HTTP/3 servers allocate tens to thousands of times more memory than it sends via QPACK header decoding; seven of ten tested implementations were vulnerable, with CVEs and fixes listed.
11 min · 2,595 words
Using Claude to reduce the attack surface of code
Anthropic's Frontier Red Team previews research on using Claude for automated attack surface analysis and reduction: mapping reachable code in large open-source projects, then removing or gating unused paths so unknown vulnerabilities become harder to reach in real deployments.
11 min · 2,564 words
How I got over 300 Tor exit nodes removed
The author of KABA.CX describes discovering that 333 compromised Tor exit relays, about 10% of all exits, were redirecting SSH connections to interception servers to steal passwords and spread the Ebury backdoor. They explain how an exitmap script and an sshesame honeypot exposed the relays, and how the Tor network health team got them flagged and shut down within days.
4 min · 965 words
OpenBSD 8.0, the project's 61st release, shipped on October 20, 2026. Highlights include a 512G amd64 kernel virtual address space, arm64 hibernate support, RISC-V vector, AIA and Sstc support, sparc64 moving to LLVM and loongson retired, drm(4) updated to Linux 6.18.53 with Intel Arc A-Series support, MP guests in vmm, and refreshed packages and third-party components.
27 min · 6,144 words
Blocking Identity Resolution Infrastructure
WebKit's John Wilander, Charlie Wolfe and Matthew Finkel explain identity resolution, the post-cookie tracking method where invisible third parties collect your email at login or signup and turn it into a persistent cross-site tracking ID and identity graph, and how Safari and WebKit in the 27 releases block network access to that infrastructure at the domain level.
4 min · 873 words
WhatsApp's Hidden Notes Told AI Not to Recommend a Regulator
Redact found hidden text on 80 of WhatsApp's 545 help pages instructing its support chatbot, including orders not to recommend data protection regulators to locked-out users and not to cite GDPR once a lawyer is mentioned, compares them with WhatsApp's privacy policy, and explains how to verify via the Internet Archive.
11 min · 2,543 words
Security Update – October 2026: Unauthorized Access to PingCAP Cloud Resources
PingCAP reports that between 9 September and 7 October 2026 an unauthorized party used stolen service account credentials to access internal systems, copy data, and obtain source code; the company describes containment, customer impact, and hardening steps.
3 min · 599 words
Setting up SSH keys on macOS with Touch ID
Nicolas Mattia shows a three-command way to create an SSH identity in the Mac Secure Enclave, protected by Touch ID and usable with GitHub, with no private key files on disk. He then digs into what sc_auth, CryptoTokenKit and Apple's ssh-keychain.dylib are actually doing, and where the documentation runs out.
9 min · 2,029 words
Inside Cairn: Open Windows into massive AI-Driven Cyber Operations
NorForge investigates more than 20 publicly exposed panels of Cairn, an AI-powered hacking system, showing how threat actors pick targets, direct autonomous agents, exploit vulnerabilities and keep access, how often they succeed, and how the exposed panels leak their victims' secrets, with case studies and indicators of compromise.
15 min · 3,527 words
Sammy Hajhamid (pepsipu) details ns2jb, a software-only tethered jailbreak for the Nintendo Switch 2 on firmware 23.0.1 that runs arbitrary native code as a sysmodule and as fs, enabling homebrew, game modding and save backups, including how Codex was used in the research harness.
11 min · 2,564 words
Hands Off: Detecting Model Weight Tampering
Stealthium introduces Rank-One Model Editing (ROME) attacks, where malicious Python code rewrites model weights in GPU memory to corrupt answers without touching disk, explains why CPU-focused EDR tooling misses them, and shows how its runtime sensor ties CUDA kernel launches and weight changes back to the Python code responsible.
13 min · 2,928 words
Cloud of suspicion lifted from NIST curves
John D. Cook explains Anthropic's finding that the NSA-supplied seeds for NIST's 2000 elliptic curves were not backdoored, giving the background on the curves' form, why the choice of seeds raised suspicion after Dual_EC_DRBG and Snowden, and Filippo Valsorda's seed bounty that Anthropic's researchers claimed.
2 min · 469 words
Should Police Wipe a Criminal's Cellphone Before Returning It?–U.S. v. Stathas
Eric Goldman analyses U.S. v. Stathas, where a court considered whether data on a convicted defendant's seized cellphone, used to commit the offense, should be wiped before the phone is returned, and what that means for forfeiture of digital data.
6 min · 1,363 words
Israeli ad-tech company was a delivery system for "mercenary spyware"And they used Google, Facebook and every other major ad platform to do it.
Cory Doctorow unpacks Citizen Lab's "Exposing AdFection" report on an Israeli ad-tech firm whose targeted ads, served through Google, Facebook and other major platforms, delivered mercenary spyware, and argues everyone should block programmatic ads and that surveillance advertising should be banned.
5 min · 1,140 words
Khalid Hamadeh shows that the 256-byte PITABLE in Ron Rivest’s RC2 cipher (RFC 2268), and a second unexplained table, are reproduced exactly by a Fisher–Yates shuffle driven by the decimal digits of π, three digits per draw, with code to verify it.
13 min · 2,954 words
yet another way to invoke functions without parentheses
A short JavaScript security write-up showing a new way to invoke arbitrary functions without parentheses: overwrite Error.prepareStackTrace with the Function constructor, control the generated code through prototype properties, then trigger it with a valueOf coercion, producing a parenthesis-free alert payload.
2 min · 361 words
Google's selfie video sign-in puts your face on its servers
Proton's Elena Constantinescu examines Google's new selfie video account recovery, which stores a multi-angle reference video of your face on Google's servers, and what that could mean for AI training, US government data requests and age checks, compares Facebook's video selfie checks and lists recovery options that avoid it.
5 min · 1,229 words