241
On caring for user data: NeoVim caused Vim undo files to be deleted
A blog about software craft and quality
242
Document-borne AI worms can self-propagate through Copilot for Word
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
243
Notepad++ supply chain attack breakdown
Kaspersky GReAT experts discovered previously undocumented infection chains used in the Notepad++ supply chain attacks. The article provides new IoCs related to those incidents which employ DLL sideloading and Cobalt Strike Beacon delivery.
244
245
OAuth for all
Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core OAuth engine to make it happen.
246
Canada’s Bill C-22 Is a Repackaged Version of Last Year’s Surveillance Nightmare
Last year, Canada's Bill C-2 was so bad it didn’t even make it to committee because of the backlash from the privacy community. Now, the spring’s worst sequel, Bill C-22, aka The Lawful Access Act, is trying it again.
247
Zero-day CSS: CVE-2026-2441 exists in the wild
The Stable channel has been updated to 145.0.7632.75/76 for Windows/Mac and 145.0.7632.75 for Linux, which will roll out over the coming d...
248
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
249
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
250
The RCE that AMD won't fix
After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.
251
Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API…
252
So, you’ve hit an age gate. What now?
EFF is against age gating and age verification mandates, and we hope we’ll win in getting existing ones overturned and new ones prevented. But mandates are already in effect, and every day many people are asked to verify their age across the web, despite prominent cases of sensitive data getting leaked in the process.
253
Wanted to download an ISO, ended up writing a kernel exploit
My TP-Link EAP770 v1 corrupts downloads over Wi-Fi and TP-Link EOL'd it before I unboxed it. The fix is two zeros in sysfs. TP-Link's shell won't let me write them, so I wrote a kernel exploit for my own fucking access point.
254
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
255
The Vercel breach: OAuth attack exposes risk in platform environment variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
256
How kernel anti-cheats work
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
257
Tailscale state file encryption no longer enabled by default
View changes to the Tailscale client and service.
258
Obsidian plugin was abused to deploy a remote access trojan
A sophisticated campaign is abusing the Obsidian note-taking app to deliver a new RAT, PHANTOMPULSE, to targets in the finance and crypto sectors using...
259
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
260
Do the math: How we took over ChatGPT accounts
By bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
261
Open source security at Astral
Insights and guidance from our engineering team on how Astral secures its tools.
262
Humiliating IIS servers for fun and jail time
cybersecurity, tech, and personal annoyance log
263
Large-Scale Online Deanonymization with LLMs
We measure the capabilities of LLMs to deanonymize users online.
264
We are retiring our bug bounty program
For almost a year now, Turso has had a program that pays $1,000 for any bug that can be demonstrated to lead to data corruption. Today, we are retiring this program.
265
We installed a single turnstile to feel secure
After the acquisition by a much larger company, security became a top priority. Our company occupied three tall buildings, each at least 13 stories high. Key card readers were installed next to every
266
EU Age Control: The trojan horse for digital IDs
A technical look at the EU age verification reference app — the gap between marketed and shipped cryptography, relay attacks the protocol can't stop, and why the 'privacy-preserving' system is a trojan horse for digital ID infrastructure.
267
I asked Meta’s Muse for its filesystem and it sent me 6.8GB
I asked Muse to archive the files it could see and send them to my Google Drive. It did.
268
Self-Hosting on the Dark Web
This site is now reachable over Tor as a hidden service, at a .onion address that resolves only inside the Tor network. Tor relays and encrypts your traffic as …
269
SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…
270
Fast16: High-precision software sabotage 5 years before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.