Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Why Is This Fingerprinting Script Creating Bioweapons?
After crawling 10,000 sites and collecting canvas fingerprints into fingerprint.garden, nullpt.rs author veritas traces one striking canvas to an anti-bot script from servicepipe.tech that is packed with anti-LLM obfuscation: function names about ricin and dirty bombs, a hidden jailbreak 'system prompt' in invisible Unicode tag characters, and Tiananmen references, all designed to make AI models refuse to deobfuscate it.
7 min · 1,636 words
tar-codec: a fast and secure tar parser for the Rust ecosystem
Astral's William Woodruff explains tar-codec, the new Rust tar parser uv uses for source distributions from 0.13: roughly twice as fast as astral-tokio-tar, built to reduce parser differentials and other security risks, with a long tour of the messy UStar, pax and GNU tar formats, its state-machine design, safe extraction and lessons learned.
26 min · 5,898 words
Bruce Ediger digs into Apache logs from his "Scraper Junkyard" honeypot site and confirms that at least one centrally controlled web crawler is operating out of thousands of Contabo GmbH cloud IP addresses, analysing its request patterns and rates.
11 min · 2,633 words
Distributed data, centralized fixes
After a week of breaches and vulnerabilities (Railway, Zeabur, eMudhra, PHP, GitLab, LiteLLM and more), Miren's Paul Hinze sorts the incidents into three structural shapes - concentrated secrets, fragmented patching and hijacked update channels - and explains how Miren's self-hostable design aims to keep data distributed while centralizing fixes.
6 min · 1,278 words
Giving Cloud Agents Production Access with OIDC, Not Secrets
Formal engineer Aditya Saligrama explains how the company lets cloud coding agents such as Cursor and Devin query production data and cloud infrastructure without long-lived secrets: the agents act as OIDC issuers, and Formal grants each session short-lived, read-only, policy-controlled and auditable access tied to the engineer, repository and run.
8 min · 1,799 words
Aikido's Dania Durnas tracks how the Brotli decompression flaw CVE-2026-111497, first disclosed for Node.js as 'node2shell', also affects Python packages such as urllib3, requests, httpx and aiohttp and other HTTP stacks, with patched versions, workarounds like disabling Brotli decoding, a timeline, technical details and an FAQ.
11 min · 2,503 words
Indian government sites are serving revoked eMudhra certificates
After eMudhra revoked 9,356 certificates on its emSign RSA hierarchy on 19 October 2026 (separate from the compromised G3 intermediates), Nemo scanned Indian government hosts and found many, including MeitY bodies like STPI, Bhashini, UIDAI and the CCA's India PKI site, still serving revoked certificates days later, contradicting MeitY's claim of limited impact.
16 min · 3,696 words
Drew Silcock walks through a week of severe vulnerabilities and incidents, from the PHP2Shell CVEs and a compromised eMudhra intermediate CA to GitLab, musl, LiteLLM and leaked Linux kernel bugs, then asks whether AI-accelerated bug discovery makes this the new normal and what teams can do about it.
19 min · 4,290 words
Kevin Coleman recounts falling for a phishing campaign that began with a fake YouTube support ticket and a lookalike Google login, and argues the scariest part was the attacker quietly registering a new passkey on his account, which would have let them back in even after a password change.
5 min · 1,215 words
Cloudflare deploys protections against php2shell vulnerability
Cloudflare describes the default WAF Managed Ruleset protections it deployed for the newly disclosed php2shell PHP vulnerabilities ahead of public disclosure, how the rules detect exploitation attempts, and why customers should still update PHP while keeping the protection enabled.
5 min · 1,162 words
Your MCU Likely Escaped the eMudhra Intermediate CA Compromise
Daniel Mangum explains why most microcontroller-based devices likely escaped the eMudhra intermediate CA compromise disclosed on October 20, 2026: embedded firmware usually ships only the specific root CA certificates it needs rather than a broad trust store.
7 min · 1,579 words
What the PHP2Shell rumors got wrong, from inside the PHP security team
Alexandre Daubois, writing from inside the PHP security team, explains how the PHP2Shell leak got the severity right but most details wrong: CVE-2026-109618 is an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
6 min · 1,331 words
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Scott Helme explains how eight eMudhra intermediate CA private keys were recoverable from their public certificates in under a second because the keys were trivially small, how Chrome and Mozilla responded with CRLSet/OneCRL blocks and root removal, why the compromise cannot be contained, and what site operators should do now.
7 min · 1,642 words
How I got over 300 Tor exit nodes removed
The author of KABA.CX describes discovering that 333 compromised Tor exit relays, about 10% of all exits, were redirecting SSH connections to interception servers to steal passwords and spread the Ebury backdoor. They explain how an exitmap script and an sshesame honeypot exposed the relays, and how the Tor network health team got them flagged and shut down within days.
4 min · 965 words
Cloud of suspicion lifted from NIST curves
John D. Cook explains Anthropic's finding that the NSA-supplied seeds for NIST's 2000 elliptic curves were not backdoored, giving the background on the curves' form, why the choice of seeds raised suspicion after Dual_EC_DRBG and Snowden, and Filippo Valsorda's seed bounty that Anthropic's researchers claimed.
2 min · 469 words
yet another way to invoke functions without parentheses
A short JavaScript security write-up showing a new way to invoke arbitrary functions without parentheses: overwrite Error.prepareStackTrace with the Function constructor, control the generated code through prototype properties, then trigger it with a valueOf coercion, producing a parenthesis-free alert payload.
2 min · 361 words
Google's selfie video sign-in puts your face on its servers
Proton's Elena Constantinescu examines Google's new selfie video account recovery, which stores a multi-angle reference video of your face on Google's servers, and what that could mean for AI training, US government data requests and age checks, compares Facebook's video selfie checks and lists recovery options that avoid it.
5 min · 1,229 words
The NIST Elliptic Curves Seeds Bounty Has Been Claimed
Filippo Valsorda reports that the long-mysterious seeds of the NIST P-curves were not hashes of forgotten sentences but drand48 output seeded with UNIX timestamps from 1997–98. A team from Anthropic solved it and claimed his bounty, donating the tripled $36,864 prize to ISRG, the non-profit behind Let's Encrypt.
5 min · 1,181 words
Lessons learned building Fronteira
Alcides Fonseca describes building Fronteira, an MCP proxy that acts as a behavioral firewall, logging tool calls across MCP servers and enforcing logic-based policies against lethal-trifecta attacks. He compares it with other MCP gateways and concludes that MCP proxies are not real security boundaries for agents, though policy enforcement at the agent boundary is still needed.
7 min · 1,592 words
Ghidra + CBMC = Assembly Model Checker
Philip Zucker describes ASMC, glue that lifts Ghidra assembly semantics into CBMC's GOTO IR so you can bounded-model-check binaries, with notes on why CBMC's pragmatism still matters in an agentic AI era.
10 min · 2,373 words