An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny…

Analyzing Eufy Security Ecosystem and reverse engineering of its Homebase2 component

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

Summary This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed…

php-fpm accepted FastCGI connections from any address sharing the first 96 bits of an allowed IPv6 address, because one memcmp asked for 12 bytes instead of 16.

Real intrusions run by autonomous AI agents, recovered from the agents' own attack transcripts. Operators set targets and rules; the agents ran the full loop from recon to root. Assessed as at least two threat actors, likely more.

Early in my career as a consultant, I was put on source code review engagements despite not being experienced. This forced me to deliver on projects that, looking back, were of a ludicrous size and scope for my skills at the time.

Those early career opportunities…

Cloud security challenges explained: the 6 most common security issues and risks of cloud computing, from misconfiguration to insider threats, and how to address each.

It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over.

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

Intended audience: non-technical citizens of the web