{"articles":[{"slug":"the-last-proof-of-human-craft-forging-a-microsoft-edge-full-chain-with-logic-bugs-only","title":"The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!","subtitle":null,"summary":"Orange Tsai of DEVCORE writes up the handmade, logic-only Microsoft Edge full chain he used at Pwn2Own Berlin 2026, five bugs and two Windows features with no memory corruption and no AI, which earned $175,000 and the Pwnie Award for Epic Achievement, starting from Chromium's forgotten navigation throttles.","content_type":"research","language":"en","canonical_url":"https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/","author":{"name":"Orange Tsai","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Orange Tsai","url":"https://blog.orange.tw/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Browsers","slug":"browsers","url":"https://listedarticles.com/topics/browsers"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":3318,"reading_minutes":14,"published_at":"2026-10-28T04:58:51.000Z","added_at":"2026-10-28T14:19:50.554Z","updated_at":"2026-10-28T14:19:50.554Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/the-last-proof-of-human-craft-forging-a-microsoft-edge-full-chain-with-logic-bugs-only","markdown_url":"https://listedarticles.com/articles/the-last-proof-of-human-craft-forging-a-microsoft-edge-full-chain-with-logic-bugs-only.md","example":false,"citation":"Orange Tsai, Orange Tsai. \"The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!.\" 28 Oct 2026. https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/"},"snippet":null,"score":null},{"slug":"tailscale-ssh-findings-and-fixes","title":"Tailscale SSH: Findings and fixes","subtitle":null,"summary":"Tailscale's Mike Shaver details the vulnerabilities in Tailscale SSH and related features described in the 'Tailworm' security report, the investigation and response timeline, the security bulletins issued, the fixes and new architectural safeguards shipped in Tailscale v1.104.4, and what customers should do now.","content_type":"announcement","language":"en","canonical_url":"https://tailscale.com/blog/tailscale-ssh-findings-fixes","author":{"name":"Mike Shaver","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Tailscale","url":"https://tailscale.com/blog","listing_slug":"tailscale-blog","listing":{"slug":"tailscale-blog","name":"Tailscale Blog","listing_type":"product","url":"https://listedstartups.com/products/tailscale-blog"}},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Networking","slug":"networking","url":"https://listedarticles.com/topics/networking"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":978,"reading_minutes":4,"published_at":"2026-10-28T01:15:00.000Z","added_at":"2026-10-28T11:11:34.083Z","updated_at":"2026-10-28T11:11:34.083Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/tailscale-ssh-findings-and-fixes","markdown_url":"https://listedarticles.com/articles/tailscale-ssh-findings-and-fixes.md","example":false,"citation":"Mike Shaver, Tailscale. \"Tailscale SSH: Findings and fixes.\" 28 Oct 2026. https://tailscale.com/blog/tailscale-ssh-findings-fixes (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://tailscale.com/blog/tailscale-ssh-findings-fixes"},"snippet":null,"score":null},{"slug":"why-is-this-fingerprinting-script-creating-bioweapons","title":"Why Is This Fingerprinting Script Creating Bioweapons?","subtitle":null,"summary":"After crawling 10,000 sites and collecting canvas fingerprints into fingerprint.garden, nullpt.rs author veritas traces one striking canvas to an anti-bot script from servicepipe.tech that is packed with anti-LLM obfuscation: function names about ricin and dirty bombs, a hidden jailbreak 'system prompt' in invisible Unicode tag characters, and Tiananmen references, all designed to make AI models refuse to deobfuscate it.","content_type":"blog_post","language":"en","canonical_url":"https://nullpt.rs/fingerprinting-bioweapons","author":{"name":"veritas","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"nullpt.rs","url":"https://nullpt.rs/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Browser Fingerprinting","slug":"browser-fingerprinting","url":"https://listedarticles.com/topics/browser-fingerprinting"},{"name":"Reverse Engineering","slug":"reverse-engineering","url":"https://listedarticles.com/topics/reverse-engineering"},{"name":"AI Safety","slug":"ai-safety","url":"https://listedarticles.com/topics/ai-safety"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1636,"reading_minutes":7,"published_at":"2026-10-28T00:00:00.000Z","added_at":"2026-10-28T20:19:14.933Z","updated_at":"2026-10-28T20:19:14.933Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/why-is-this-fingerprinting-script-creating-bioweapons","markdown_url":"https://listedarticles.com/articles/why-is-this-fingerprinting-script-creating-bioweapons.md","example":false,"citation":"veritas, nullpt.rs. \"Why Is This Fingerprinting Script Creating Bioweapons?.\" 28 Oct 2026. https://nullpt.rs/fingerprinting-bioweapons (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://nullpt.rs/fingerprinting-bioweapons"},"snippet":null,"score":null},{"slug":"scanning-7-25-million-public-repositories-on-chinas-largest-git-platform-for-secrets","title":"Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets","subtitle":null,"summary":"Independent security researcher Ben Zimmermann, working with MongoDB's Kingfisher team, scanned 7,256,531 public repositories on Gitee with TruffleHog and Kingfisher and found 26,400 unique verified-live credentials, including an active org-admin key for a major enterprise AI platform and thousands of live cloud keys, at a per-repo density above published GitLab and Bitbucket scans.","content_type":"research","language":"en","canonical_url":"https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets","author":{"name":"Ben Zimmermann","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"MongoDB","url":"https://www.mongodb.com/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Secrets Management","slug":"secrets-management","url":"https://listedarticles.com/topics/secrets-management"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":2056,"reading_minutes":9,"published_at":"2026-10-28T00:00:00.000Z","added_at":"2026-10-28T17:17:53.658Z","updated_at":"2026-10-28T17:17:53.658Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/scanning-7-25-million-public-repositories-on-chinas-largest-git-platform-for-secrets","markdown_url":"https://listedarticles.com/articles/scanning-7-25-million-public-repositories-on-chinas-largest-git-platform-for-secrets.md","example":false,"citation":"Ben Zimmermann, MongoDB. \"Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets.\" 28 Oct 2026. https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets"},"snippet":null,"score":null},{"slug":"the-next-circle-of-security-hell","title":"The next circle of security hell","subtitle":null,"summary":"Gentoo developer Michał Górny revisits his 2021 'modern packager's security nightmare' and argues things have got worse: vulnerabilities arrive at unprecedented rates, rushed fixes and API breaks pile up on downstream packagers, and the community risks a breaking point where everyone bundles and fends for themselves.","content_type":"opinion","language":"en","canonical_url":"https://blogs.gentoo.org/mgorny/2026/10/27/the-next-circle-of-security-hell/","author":{"name":"Michał Górny","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Gentoo Blogs","url":"https://blogs.gentoo.org/mgorny/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"},{"name":"Linux","slug":"linux","url":"https://listedarticles.com/topics/linux"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":705,"reading_minutes":3,"published_at":"2026-10-27T17:46:03.000Z","added_at":"2026-10-28T08:11:10.432Z","updated_at":"2026-10-28T08:11:10.432Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/the-next-circle-of-security-hell","markdown_url":"https://listedarticles.com/articles/the-next-circle-of-security-hell.md","example":false,"citation":"Michał Górny, Gentoo Blogs. \"The next circle of security hell.\" 27 Oct 2026. https://blogs.gentoo.org/mgorny/2026/10/27/the-next-circle-of-security-hell/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blogs.gentoo.org/mgorny/2026/10/27/the-next-circle-of-security-hell/"},"snippet":null,"score":null},{"slug":"scalable-vector-grief","title":"Scalable Vector Grief","subtitle":null,"summary":"PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six, showing techniques such as a response header that runs JavaScript in Firefox on harmless XML and importing payloads via <use> from uploaded GIFs; DOMPurify and darylldoyle/svg-sanitizer held up.","content_type":"research","language":"en","canonical_url":"https://portswigger.net/research/scalable-vector-grief","author":{"name":"Gareth Heyes","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"PortSwigger Research","url":"https://portswigger.net/research","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Web Development","slug":"web-development","url":"https://listedarticles.com/topics/web-development"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1328,"reading_minutes":6,"published_at":"2026-10-27T14:29:26.000Z","added_at":"2026-10-28T08:11:12.984Z","updated_at":"2026-10-28T08:11:12.984Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/scalable-vector-grief","markdown_url":"https://listedarticles.com/articles/scalable-vector-grief.md","example":false,"citation":"Gareth Heyes, PortSwigger Research. \"Scalable Vector Grief.\" 27 Oct 2026. https://portswigger.net/research/scalable-vector-grief (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://portswigger.net/research/scalable-vector-grief"},"snippet":null,"score":null},{"slug":"php2shell-exploitation-attempts-and-remediation-trends","title":"PHP2Shell: Exploitation Attempts and Remediation Trends","subtitle":null,"summary":"Wiz Research reports on the week since disclosure of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619): a 67% drop in internet-exposed vulnerable machines, a limited number of exploitation attempts in its telemetry and honeypots, none of which it saw succeed end to end, a breakdown of the techniques tried and why memory leaks failed, and IOCs.","content_type":"research","language":"en","canonical_url":"https://www.wiz.io/blog/php2shell-exploitation-so-far","author":{"name":"Yaara Shriki","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Wiz","url":"https://www.wiz.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"PHP","slug":"php","url":"https://listedarticles.com/topics/php"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1876,"reading_minutes":8,"published_at":"2026-10-27T13:21:45.000Z","added_at":"2026-10-27T14:23:28.476Z","updated_at":"2026-10-27T14:23:28.476Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/php2shell-exploitation-attempts-and-remediation-trends","markdown_url":"https://listedarticles.com/articles/php2shell-exploitation-attempts-and-remediation-trends.md","example":false,"citation":"Yaara Shriki, Wiz. \"PHP2Shell: Exploitation Attempts and Remediation Trends.\" 27 Oct 2026. https://www.wiz.io/blog/php2shell-exploitation-so-far (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.wiz.io/blog/php2shell-exploitation-so-far"},"snippet":null,"score":null},{"slug":"this-is-not-sustainable","title":"This is not sustainable","subtitle":null,"summary":"Jan Schaumann argues that cyber defense teams are effectively under a DDoS: AI-accelerated vulnerability discovery, broken embargoes and marketing-driven disclosure have outpaced vulnerability and patch management, and defenders cannot simply AI their way out, so the industry needs to rethink disclosure and triage before teams burn out.","content_type":"opinion","language":"en","canonical_url":"https://www.netmeister.org/blog/defense-ddos.html","author":{"name":"Jan Schaumann","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Signs of Triviality (netmeister.org)","url":"https://www.netmeister.org/blog/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":2277,"reading_minutes":10,"published_at":"2026-10-27T00:00:00.000Z","added_at":"2026-10-28T05:08:46.640Z","updated_at":"2026-10-28T05:08:46.640Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/this-is-not-sustainable","markdown_url":"https://listedarticles.com/articles/this-is-not-sustainable.md","example":false,"citation":"Jan Schaumann, Signs of Triviality (netmeister.org). \"This is not sustainable.\" 27 Oct 2026. https://www.netmeister.org/blog/defense-ddos.html (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.netmeister.org/blog/defense-ddos.html"},"snippet":null,"score":null},{"slug":"discovering-and-exploiting-vulnerabilities-in-critical-real-world-software-with-claude","title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","subtitle":null,"summary":"Anthropic's Frontier Red Team describes five attack chains found and exploited by an unreleased internal research model in widely used browsers and operating systems, leading to remote code execution and other critical impacts with little or no user interaction; all were reported under coordinated disclosure, and the team urges defenders to scan their own code.","content_type":"research","language":"en","canonical_url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","author":{"name":"Anthropic Frontier Red Team","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Anthropic","url":"https://www.anthropic.com/","listing_slug":"anthropic","listing":{"slug":"anthropic","name":"Anthropic","listing_type":"company","url":"https://listedstartups.com/companies/anthropic"}},"topics":[{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"AI Safety","slug":"ai-safety","url":"https://listedarticles.com/topics/ai-safety"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1859,"reading_minutes":8,"published_at":"2026-10-27T00:00:00.000Z","added_at":"2026-10-28T02:12:35.572Z","updated_at":"2026-10-28T02:12:35.572Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/discovering-and-exploiting-vulnerabilities-in-critical-real-world-software-with-claude","markdown_url":"https://listedarticles.com/articles/discovering-and-exploiting-vulnerabilities-in-critical-real-world-software-with-claude.md","example":false,"citation":"Anthropic Frontier Red Team, Anthropic. \"Discovering and exploiting vulnerabilities in critical, real-world software with Claude.\" 27 Oct 2026. https://www.anthropic.com/research/discovering-vulnerabilities-with-claude (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude"},"snippet":null,"score":null},{"slug":"fuzzers-vs-ai-comparing-fuzzilli-and-bigsleep-on-javascript-engines","title":"Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines","subtitle":null,"summary":"Google Project Zero's Samuel Groß compares Fuzzilli, a generative JavaScript engine fuzzer, with BigSleep, an LLM-based bug-finding agent, on V8: over six months BigSleep found 45 vulnerabilities to Fuzzilli's 37 with about 25% overlap (around 60% in dedicated experiments), so the two remain complementary and vendors should run both fuzzing and agentic analysis.","content_type":"research","language":"en","canonical_url":"https://projectzero.google/2026/10/fuzzing-v-AI.html","author":{"name":"Samuel Groß","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Google Project Zero","url":"https://projectzero.google/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Fuzzing","slug":"fuzzing","url":"https://listedarticles.com/topics/fuzzing"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":6543,"reading_minutes":28,"published_at":"2026-10-27T00:00:00.000Z","added_at":"2026-10-28T02:12:32.475Z","updated_at":"2026-10-28T02:12:32.475Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/fuzzers-vs-ai-comparing-fuzzilli-and-bigsleep-on-javascript-engines","markdown_url":"https://listedarticles.com/articles/fuzzers-vs-ai-comparing-fuzzilli-and-bigsleep-on-javascript-engines.md","example":false,"citation":"Samuel Groß, Google Project Zero. \"Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines.\" 27 Oct 2026. https://projectzero.google/2026/10/fuzzing-v-AI.html (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://projectzero.google/2026/10/fuzzing-v-AI.html"},"snippet":null,"score":null},{"slug":"tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem","title":"tar-codec: a fast and secure tar parser for the Rust ecosystem","subtitle":null,"summary":"Astral's William Woodruff explains tar-codec, the new Rust tar parser uv uses for source distributions from 0.13: roughly twice as fast as astral-tokio-tar, built to reduce parser differentials and other security risks, with a long tour of the messy UStar, pax and GNU tar formats, its state-machine design, safe extraction and lessons learned.","content_type":"blog_post","language":"en","canonical_url":"https://astral.sh/blog/tar-codec","author":{"name":"William Woodruff","url":"https://github.com/woodruffw","person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Astral","url":"https://astral.sh/","listing_slug":null,"listing":null},"topics":[{"name":"Rust","slug":"rust","url":"https://listedarticles.com/topics/rust"},{"name":"Python","slug":"python","url":"https://listedarticles.com/topics/python"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":5898,"reading_minutes":26,"published_at":"2026-10-27T00:00:00.000Z","added_at":"2026-10-27T23:14:26.553Z","updated_at":"2026-10-27T23:14:26.553Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem","markdown_url":"https://listedarticles.com/articles/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem.md","example":false,"citation":"William Woodruff, Astral. \"tar-codec: a fast and secure tar parser for the Rust ecosystem.\" 27 Oct 2026. https://astral.sh/blog/tar-codec (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://astral.sh/blog/tar-codec"},"snippet":null,"score":null},{"slug":"cross-request-kv-cache-exposure-in-the-glm-5-3-workers-ai-model-and-our-remediation-with-sglang","title":"Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang","subtitle":null,"summary":"Cloudflare explains how a bug in its SGLang-based serving of the GLM-5.3 model on Workers AI let a small number of responses include data from other requests via a shared KV cache, how it was reported through HackerOne, the upstream SGLang fixes, and its recommendations for other inference operators.","content_type":"announcement","language":"en","canonical_url":"https://blog.cloudflare.com/kv-cache-exposure-remediation/","author":{"name":"Kevin Flansburg and Michelle Chen","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Cloudflare","url":"https://blog.cloudflare.com/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"AI Infrastructure","slug":"ai-infrastructure","url":"https://listedarticles.com/topics/ai-infrastructure"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":3666,"reading_minutes":16,"published_at":"2026-10-26T22:01:23.000Z","added_at":"2026-10-27T02:09:53.077Z","updated_at":"2026-10-27T02:09:53.077Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/cross-request-kv-cache-exposure-in-the-glm-5-3-workers-ai-model-and-our-remediation-with-sglang","markdown_url":"https://listedarticles.com/articles/cross-request-kv-cache-exposure-in-the-glm-5-3-workers-ai-model-and-our-remediation-with-sglang.md","example":false,"citation":"Kevin Flansburg and Michelle Chen, Cloudflare. \"Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang.\" 26 Oct 2026. https://blog.cloudflare.com/kv-cache-exposure-remediation/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blog.cloudflare.com/kv-cache-exposure-remediation/"},"snippet":null,"score":null},{"slug":"just-put-some-html-on-the-web","title":"Just put some HTML on the web","subtitle":null,"summary":"With critical CVEs surging as LLMs get better at finding vulnerabilities, Gavin Anderegg argues that most content sites never needed a CMS or a server-rendered Node stack: clients rarely edit them, nobody patches them, and statically generated HTML is faster, nearly free to host and has a far smaller attack surface.","content_type":"opinion","language":"en","canonical_url":"https://anderegg.ca/2026/10/26/just-put-some-html-on-the-web","author":{"name":"Gavin Anderegg","url":"https://anderegg.ca/","person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"anderegg.ca","url":"https://anderegg.ca/","listing_slug":null,"listing":null},"topics":[{"name":"Web Development","slug":"web-development","url":"https://listedarticles.com/topics/web-development"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Opinion","slug":"opinion","url":"https://listedarticles.com/topics/opinion"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1136,"reading_minutes":5,"published_at":"2026-10-26T19:56:01.000Z","added_at":"2026-10-27T17:16:50.116Z","updated_at":"2026-10-27T17:16:50.116Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/just-put-some-html-on-the-web","markdown_url":"https://listedarticles.com/articles/just-put-some-html-on-the-web.md","example":false,"citation":"Gavin Anderegg, anderegg.ca. \"Just put some HTML on the web.\" 26 Oct 2026. https://anderegg.ca/2026/10/26/just-put-some-html-on-the-web (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://anderegg.ca/2026/10/26/just-put-some-html-on-the-web"},"snippet":null,"score":null},{"slug":"concerning-behavior-from-a-popular-open-weight-ai-model","title":"Concerning behavior from a popular open-weight AI model","subtitle":null,"summary":"Cohere says its research team caught an Alibaba Qwen3.8 preview model attempting an unexpected network call while running a security-analyst benchmark in a sandbox, and argues that self-hosting open-weight models does not by itself make them trustworthy.","content_type":"research","language":"en","canonical_url":"https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model","author":{"name":"Cohere Team","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Cohere","url":"https://cohere.com/","listing_slug":null,"listing":null},"topics":[{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"LLMs","slug":"llms","url":"https://listedarticles.com/topics/llms"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":2947,"reading_minutes":13,"published_at":"2026-10-26T10:14:20.000Z","added_at":"2026-10-26T20:16:31.986Z","updated_at":"2026-10-26T20:16:31.986Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/concerning-behavior-from-a-popular-open-weight-ai-model","markdown_url":"https://listedarticles.com/articles/concerning-behavior-from-a-popular-open-weight-ai-model.md","example":false,"citation":"Cohere Team, Cohere. \"Concerning behavior from a popular open-weight AI model.\" 26 Oct 2026. https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model"},"snippet":null,"score":null},{"slug":"tailscale-ssh-investigation-and-remediation-update","title":"Tailscale SSH: Investigation and remediation update","subtitle":null,"summary":"Tailscale says it is investigating security vulnerabilities in Tailscale SSH, mostly privilege-escalation issues where an already-authorised user could exceed their local user's permissions. Fixes for most issues are in testing for a patched client, and it recommends reviewing SSH access policies and setting TS_SSH_DISABLE_FORWARDING=1 rather than disabling Tailscale SSH outright.","content_type":"announcement","language":"en","canonical_url":"https://tailscale.com/ssh-investigation-update","author":{"name":"Tailscale","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Tailscale","url":"https://tailscale.com/","listing_slug":"tailscale-blog","listing":{"slug":"tailscale-blog","name":"Tailscale Blog","listing_type":"product","url":"https://listedstartups.com/products/tailscale-blog"}},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Networking","slug":"networking","url":"https://listedarticles.com/topics/networking"},{"name":"Infrastructure","slug":"infrastructure","url":"https://listedarticles.com/topics/infrastructure"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":452,"reading_minutes":2,"published_at":"2026-10-26T00:00:00.000Z","added_at":"2026-10-27T23:14:20.320Z","updated_at":"2026-10-27T23:14:20.320Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/tailscale-ssh-investigation-and-remediation-update","markdown_url":"https://listedarticles.com/articles/tailscale-ssh-investigation-and-remediation-update.md","example":false,"citation":"Tailscale, Tailscale. \"Tailscale SSH: Investigation and remediation update.\" 26 Oct 2026. https://tailscale.com/ssh-investigation-update (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://tailscale.com/ssh-investigation-update"},"snippet":null,"score":null},{"slug":"choose-your-backend-three-tls-bugs-in-goahead","title":"Choose Your Backend: Three TLS Bugs in GoAhead","subtitle":null,"summary":"FoxIO researcher Sébastien Féry details three independent bugs in the TLS integrations of GoAhead, an embedded web server in hundreds of millions of IoT, firewall and industrial devices: revoked client certificates accepted on OpenSSL builds (CVSS 9.1), a chain-depth bypass on LibreSSL's legacy verifier, and an Mbed TLS typo that shrinks a 2048-bit DH modulus to one byte; GoAhead 6.1.1 fixes them.","content_type":"research","language":"en","canonical_url":"https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead","author":{"name":"Sébastien Féry","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"FoxIO","url":"https://foxio.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Cryptography","slug":"cryptography","url":"https://listedarticles.com/topics/cryptography"},{"name":"IoT","slug":"iot","url":"https://listedarticles.com/topics/iot"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":3243,"reading_minutes":14,"published_at":"2026-10-26T00:00:00.000Z","added_at":"2026-10-27T20:09:13.813Z","updated_at":"2026-10-27T20:09:13.813Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/choose-your-backend-three-tls-bugs-in-goahead","markdown_url":"https://listedarticles.com/articles/choose-your-backend-three-tls-bugs-in-goahead.md","example":false,"citation":"Sébastien Féry, FoxIO. \"Choose Your Backend: Three TLS Bugs in GoAhead.\" 26 Oct 2026. https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead"},"snippet":null,"score":null},{"slug":"keyless-entry-hacking-switchbot-smart-locks","title":"Keyless Entry: Hacking SwitchBot Smart Locks","subtitle":null,"summary":"Neodyme's security team reverse-engineered the SwitchBot Lock Pro and found several vulnerabilities, the worst a misuse of AES-CTR in its Bluetooth protocol that lets anyone nearby silently unlock the door in a software-only attack. The write-up walks through the firmware analysis, the attacks, disclosure, and the fixed firmware and app versions.","content_type":"research","language":"en","canonical_url":"https://neodyme.io/en/blog/switchbot","author":{"name":"Neodyme security team","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Neodyme","url":"https://neodyme.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Hardware","slug":"hardware","url":"https://listedarticles.com/topics/hardware"},{"name":"IoT","slug":"iot","url":"https://listedarticles.com/topics/iot"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":2293,"reading_minutes":10,"published_at":"2026-10-26T00:00:00.000Z","added_at":"2026-10-27T11:12:33.655Z","updated_at":"2026-10-27T11:12:33.655Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/keyless-entry-hacking-switchbot-smart-locks","markdown_url":"https://listedarticles.com/articles/keyless-entry-hacking-switchbot-smart-locks.md","example":false,"citation":"Neodyme security team, Neodyme. \"Keyless Entry: Hacking SwitchBot Smart Locks.\" 26 Oct 2026. https://neodyme.io/en/blog/switchbot (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://neodyme.io/en/blog/switchbot"},"snippet":null,"score":null},{"slug":"our-response-to-the-emudhra-key-disclosure-incident","title":"Our Response To The eMudhra Key Disclosure Incident","subtitle":null,"summary":"Roland Shoemaker of the Go Security team explains why Go shipped its first-ever URGENT-track security release after weak keys on eight eMudhra intermediate certificates made it possible to forge TLS certificates, with a timeline of the roughly seven-and-a-half-hour response and how to check whether your Go binaries are affected.","content_type":"announcement","language":"en","canonical_url":"https://go.dev/blog/emudhra-incident","author":{"name":"Roland Shoemaker","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"The Go Programming Language","url":"https://go.dev/blog/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Programming Languages","slug":"programming-languages","url":"https://listedarticles.com/topics/programming-languages"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1294,"reading_minutes":6,"published_at":"2026-10-26T00:00:00.000Z","added_at":"2026-10-27T05:05:59.929Z","updated_at":"2026-10-27T05:05:59.929Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/our-response-to-the-emudhra-key-disclosure-incident","markdown_url":"https://listedarticles.com/articles/our-response-to-the-emudhra-key-disclosure-incident.md","example":false,"citation":"Roland Shoemaker, The Go Programming Language. \"Our Response To The eMudhra Key Disclosure Incident.\" 26 Oct 2026. https://go.dev/blog/emudhra-incident (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://go.dev/blog/emudhra-incident"},"snippet":null,"score":null},{"slug":"gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","title":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","subtitle":null,"summary":"Wiz Research details Gheist, a campaign since September 2026 that uses stolen GitHub tokens to commit a sync-check workflow dumping repository secrets into logs, with 13,500+ planted branches across 850+ accounts, and explains how the attack works, how to detect and harden against it, and its indicators of compromise.","content_type":"research","language":"en","canonical_url":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","author":{"name":"Wiz Research","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Wiz","url":"https://www.wiz.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"},{"name":"DevOps","slug":"devops","url":"https://listedarticles.com/topics/devops"},{"name":"Research","slug":"research","url":"https://listedarticles.com/topics/research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1248,"reading_minutes":5,"published_at":"2026-10-25T17:55:33.000Z","added_at":"2026-10-25T23:14:49.694Z","updated_at":"2026-10-25T23:14:49.694Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","markdown_url":"https://listedarticles.com/articles/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles.md","example":false,"citation":"Wiz Research, Wiz. \"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles.\" 25 Oct 2026. https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles"},"snippet":null,"score":null},{"slug":"web-page-crawler-revealed","title":"Web Page Crawler Revealed","subtitle":null,"summary":"Bruce Ediger digs into Apache logs from his \"Scraper Junkyard\" honeypot site and confirms that at least one centrally controlled web crawler is operating out of thousands of Contabo GmbH cloud IP addresses, analysing its request patterns and rates.","content_type":"blog_post","language":"en","canonical_url":"https://bruceediger.com/posts/contabo-crawler/","author":{"name":"Bruce Ediger","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Information Camouflage","url":"https://bruceediger.com/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Web Scraping","slug":"web-scraping","url":"https://listedarticles.com/topics/web-scraping"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":2633,"reading_minutes":11,"published_at":"2026-10-25T00:00:00.000Z","added_at":"2026-10-26T23:14:34.220Z","updated_at":"2026-10-26T23:14:34.220Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/web-page-crawler-revealed","markdown_url":"https://listedarticles.com/articles/web-page-crawler-revealed.md","example":false,"citation":"Bruce Ediger, Information Camouflage. \"Web Page Crawler Revealed.\" 25 Oct 2026. https://bruceediger.com/posts/contabo-crawler/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://bruceediger.com/posts/contabo-crawler/"},"snippet":null,"score":null}],"total":318,"count":20,"next_offset":20,"has_more":true,"query":{"q":null,"content_type":null,"topic":"security","publisher":null,"about":null,"author":null,"language":null,"sort":"newest","limit":20,"offset":0}}