In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
Today is a big day for us, and for everyone who cares about transparency, privacy, and having full control over their own traffic. We’re finally open-sourcing the protocol that powers AdGuard VPN. And it now has a name: TrustTunnel.
That cheapo cable you bought online? Probably a counterfeit. We x-rayed a suspicious cable to show you exactly what that means, and why counterfeits work worse and wear out faster.
Proofcraft’s Chief Engineer Rafal Kolanski has completed a major “architecture split” overhaul of the seL4 proofs, resulting in the removal of 250k lines of proof and strengthening the link between proofs on different architectures. These changes will significantly reduce future effort required to maintain and extend…
What the accidental Claude Code source code leak tells us about the real value of code, product market fit, and why integration is what actually makes software great.
DMARC has been public since 2012. We checked 67,336 domains: 68.4% still have no policy or one that does not enforce it.
According to the Apple support document How to identify the DFU port on Mac , the DFU (device firmware update) port location for MacBook Pro models with Apple silicon is as follows:
Research on aligning AI with human values and intent, and reports documenting model failures.
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
AISLE's autonomous analyzer found all 12 CVEs in the January 2026 coordinated release of OpenSSL, the open-source cryptographic library.
Big fish. Small counter. Root shell.
| Read on LessWrong | Comment on HN | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access.
This page is taking an unexpected detour...
I let AWS Cognito gaslight me for three weeks so you don't have to. Here's the unfiltered autopsy.
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
In a dramatic middle-of-the-night stand off, a bipartisan set of lawmakers pushing for true reform and privacy protections for Americans bought us some more time to fight! They are holding out for, at a minimum, the requirement of an actual probable cause warrant for FBI access to information...
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match for a new position based on your prior experience. It might not be what it seems at a first glance.
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
I purchased a Matrix CoolRunner Rev D back in 2017. This little chip is called a glitcher and it’s a type of modchip. Its sole purpose, the reason it was designed, is to deliver a short pulse of energy (~ 100 nanoseconds) to an Xbox 360 Console.
A dive into how we share IPs between VMs while making SSH work.
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
A convincing lookalike of the popular 7-Zip archiver site has been silently turning victims’ machines into residential proxy nodes.
Last week I wrote a thing about how to run Claude Code when you don’t trust Claude Code. I proposed the creation of a dedicated user account & standard unix access controls. The objective was to stop Claude from dancing through your .env files, eating your secrets. There are some usability problems with that guide- I…
FINAL STATUS (2026-10-21): the CVE-2026-109618 / CVE-2026-109619 memory-corruption class shipped patches 2026-10-21. On the patch, that class is closed: the cached-pointer chain dies at the addref and the serialize-state path is a memory-safety bug, not code execution. Two session-handling flaws survive on…
