28/05/2026 Introduction A few years ago we looked at how Visual Studio Code extensions could be used for initial access in red team engagements; at the time, the results were...

Broken access control in GraphQL API allowing unauthorized access to orders and event data.

This is a quick post I wanted to write about a “hobby project” I spent a weekend on. It has little to do with real cryptography, and mostly doesn’t expose a particularly exciting …

15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.

Benchmarking LLMs on real-world CVE patching

A single attacking IP tells you little. The back end it pulls its payload from, and the client fingerprint it presents, are the parts operators reuse. Correlating both across the sensor network collapses internet noise into discrete operations: one cluster…

Open-source secret scanner in Rust. SIMD on the CPU, an Aho-Corasick automaton on the GPU, SARIF + JSON + TUI output, 14,512 adversarial cases per build.

Stars and downloads tell you about popularity, not safety. Here's a practical checklist for evaluating an npm package's security, reliability, and long-term maintenance in 2026.

Digital rights activists say Iran's selective internet restoration is being used to identify, track, and arrest individuals linked to January protests.

LLMReaper is a proof-of-concept Chrome extension (Manifest V3) demonstrating passive DOM-based exfiltration of AI conversations from ChatGPT, Claude, and Gemini using MutationObserver, no special permissions, no network interception. Captured conversations…