Bookmarks tagged “security”
51 bookmarks tagged “security”
Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection
From a website summary task, to python module shadowing to code execution in Claude Code Opus 5 Auto Mode
Internet centralization and the original sin of NAT
How NAT broke the concept of an internet connection
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
Humans missed 1 in 3 threats approving AI agent commands across 40,000 plays
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
Matt’s Script Archive: The Scripts That Reshaped The Web
The high schooler who developed everyone’s forums and guestbooks in 1996 didn’t really think about security. But Matt’s Script Archive was more than exploits.
I discovered a large-scale malware distribution on GitHub
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to f
Email address obfuscation: What works in 2026?
Snowflake Cortex AI Escapes Sandbox and Executes Malware
A vulnerability in the Snowflake Cortex Code CLI allowed malware to be installed and executed via indirect prompt injection, bypassing human-in-the-loop command approval and escaping the sandbox.
remotely unlocking an encrypted hard disk
what's a few systemd services in initramfs between friends?
Why Self-host?
Let me make the argument why you should start self-hosting more of your personal services.
AI haters build tarpits to trap and trick AI scrapers that ignore robots.txt
Attackers explain how an anti-spam defense became an AI weapon.
U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams
The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams, commonly known as “pig butchering." In January
OAuth's Role in MCP Security
Limits and Opportunities in the Identity Layer
TLS Certificate Lifetimes Will Officially Reduce to 47 Days | DigiCert
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
Beware of Integer Overflows in Your C Code – Giovanni Dicanio's Blog
Summing signed integer values on computers, with a *finite* number of bits available for representing integer numbers (16 bits, 32 bits, whatever) is not always possible, and can lead to subtle bug…
Beware of Unsafe Conversions from size_t to int – Giovanni Dicanio's Blog
Converting from size_t to int can cause subtle bugs! Let’s take the Win32 Unicode conversion API calls introduced in previous posts as an occasion to discuss some interesting size_t-to-int bu…
The massive bug at the heart of the npm ecosystem
An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products
JSON Hijacking | You’ve Been Haacked
A while back I wrote about a subtle JSON vulnerability which could result in the disclosure of sensitive information. That particular exploit involved overriding the JavaScript Array constructor to disclose the payload of a JSON array, something which most browsers do not support