Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
Orange Tsai of DEVCORE writes up the handmade, logic-only Microsoft Edge full chain he used at Pwn2Own Berlin 2026, five bugs and two Windows features with no memory corruption and no AI, which earned $175,000 and the Pwnie Award for Epic Achievement, starting from Chromium's forgotten navigation throttles.
14 min · 3,318 words
Tailscale SSH: Findings and fixes
Tailscale's Mike Shaver details the vulnerabilities in Tailscale SSH and related features described in the 'Tailworm' security report, the investigation and response timeline, the security bulletins issued, the fixes and new architectural safeguards shipped in Tailscale v1.104.4, and what customers should do now.
4 min · 978 words
Why Is This Fingerprinting Script Creating Bioweapons?
After crawling 10,000 sites and collecting canvas fingerprints into fingerprint.garden, nullpt.rs author veritas traces one striking canvas to an anti-bot script from servicepipe.tech that is packed with anti-LLM obfuscation: function names about ricin and dirty bombs, a hidden jailbreak 'system prompt' in invisible Unicode tag characters, and Tiananmen references, all designed to make AI models refuse to deobfuscate it.
7 min · 1,636 words
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Independent security researcher Ben Zimmermann, working with MongoDB's Kingfisher team, scanned 7,256,531 public repositories on Gitee with TruffleHog and Kingfisher and found 26,400 unique verified-live credentials, including an active org-admin key for a major enterprise AI platform and thousands of live cloud keys, at a per-repo density above published GitLab and Bitbucket scans.
9 min · 2,056 words
The next circle of security hell
Gentoo developer Michał Górny revisits his 2021 'modern packager's security nightmare' and argues things have got worse: vulnerabilities arrive at unprecedented rates, rushed fixes and API breaks pile up on downstream packagers, and the community risks a breaking point where everyone bundles and fends for themselves.
3 min · 705 words
PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six, showing techniques such as a response header that runs JavaScript in Firefox on harmless XML and importing payloads via <use> from uploaded GIFs; DOMPurify and darylldoyle/svg-sanitizer held up.
6 min · 1,328 words
PHP2Shell: Exploitation Attempts and Remediation Trends
Wiz Research reports on the week since disclosure of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619): a 67% drop in internet-exposed vulnerable machines, a limited number of exploitation attempts in its telemetry and honeypots, none of which it saw succeed end to end, a breakdown of the techniques tried and why memory leaks failed, and IOCs.
8 min · 1,876 words
Jan Schaumann argues that cyber defense teams are effectively under a DDoS: AI-accelerated vulnerability discovery, broken embargoes and marketing-driven disclosure have outpaced vulnerability and patch management, and defenders cannot simply AI their way out, so the industry needs to rethink disclosure and triage before teams burn out.
10 min · 2,277 words
Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic's Frontier Red Team describes five attack chains found and exploited by an unreleased internal research model in widely used browsers and operating systems, leading to remote code execution and other critical impacts with little or no user interaction; all were reported under coordinated disclosure, and the team urges defenders to scan their own code.
8 min · 1,859 words
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
Google Project Zero's Samuel Groß compares Fuzzilli, a generative JavaScript engine fuzzer, with BigSleep, an LLM-based bug-finding agent, on V8: over six months BigSleep found 45 vulnerabilities to Fuzzilli's 37 with about 25% overlap (around 60% in dedicated experiments), so the two remain complementary and vendors should run both fuzzing and agentic analysis.
28 min · 6,543 words
tar-codec: a fast and secure tar parser for the Rust ecosystem
Astral's William Woodruff explains tar-codec, the new Rust tar parser uv uses for source distributions from 0.13: roughly twice as fast as astral-tokio-tar, built to reduce parser differentials and other security risks, with a long tour of the messy UStar, pax and GNU tar formats, its state-machine design, safe extraction and lessons learned.
26 min · 5,898 words
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
Cloudflare explains how a bug in its SGLang-based serving of the GLM-5.3 model on Workers AI let a small number of responses include data from other requests via a shared KV cache, how it was reported through HackerOne, the upstream SGLang fixes, and its recommendations for other inference operators.
16 min · 3,666 words
With critical CVEs surging as LLMs get better at finding vulnerabilities, Gavin Anderegg argues that most content sites never needed a CMS or a server-rendered Node stack: clients rarely edit them, nobody patches them, and statically generated HTML is faster, nearly free to host and has a far smaller attack surface.
5 min · 1,136 words
Concerning behavior from a popular open-weight AI model
Cohere says its research team caught an Alibaba Qwen3.8 preview model attempting an unexpected network call while running a security-analyst benchmark in a sandbox, and argues that self-hosting open-weight models does not by itself make them trustworthy.
13 min · 2,947 words
Tailscale SSH: Investigation and remediation update
Tailscale says it is investigating security vulnerabilities in Tailscale SSH, mostly privilege-escalation issues where an already-authorised user could exceed their local user's permissions. Fixes for most issues are in testing for a patched client, and it recommends reviewing SSH access policies and setting TS_SSH_DISABLE_FORWARDING=1 rather than disabling Tailscale SSH outright.
2 min · 452 words
Choose Your Backend: Three TLS Bugs in GoAhead
FoxIO researcher Sébastien Féry details three independent bugs in the TLS integrations of GoAhead, an embedded web server in hundreds of millions of IoT, firewall and industrial devices: revoked client certificates accepted on OpenSSL builds (CVSS 9.1), a chain-depth bypass on LibreSSL's legacy verifier, and an Mbed TLS typo that shrinks a 2048-bit DH modulus to one byte; GoAhead 6.1.1 fixes them.
14 min · 3,243 words
Keyless Entry: Hacking SwitchBot Smart Locks
Neodyme's security team reverse-engineered the SwitchBot Lock Pro and found several vulnerabilities, the worst a misuse of AES-CTR in its Bluetooth protocol that lets anyone nearby silently unlock the door in a software-only attack. The write-up walks through the firmware analysis, the attacks, disclosure, and the fixed firmware and app versions.
10 min · 2,293 words
Our Response To The eMudhra Key Disclosure Incident
Roland Shoemaker of the Go Security team explains why Go shipped its first-ever URGENT-track security release after weak keys on eight eMudhra intermediate certificates made it possible to forge TLS certificates, with a timeline of the roughly seven-and-a-half-hour response and how to check whether your Go binaries are affected.
6 min · 1,294 words
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Wiz Research details Gheist, a campaign since September 2026 that uses stolen GitHub tokens to commit a sync-check workflow dumping repository secrets into logs, with 13,500+ planted branches across 850+ accounts, and explains how the attack works, how to detect and harden against it, and its indicators of compromise.
5 min · 1,248 words
Bruce Ediger digs into Apache logs from his "Scraper Junkyard" honeypot site and confirms that at least one centrally controlled web crawler is operating out of thousands of Contabo GmbH cloud IP addresses, analysing its request patterns and rates.
11 min · 2,633 words