A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

Summary This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed…

php-fpm accepted FastCGI connections from any address sharing the first 96 bits of an allowed IPv6 address, because one memcmp asked for 12 bytes instead of 16.

Real intrusions run by autonomous AI agents, recovered from the agents' own attack transcripts. Operators set targets and rules; the agents ran the full loop from recon to root. Assessed as at least two threat actors, likely more.

Early in my career as a consultant, I was put on source code review engagements despite not being experienced. This forced me to deliver on projects that, looking back, were of a ludicrous size and scope for my skills at the time.

Those early career opportunities…

Cloud security challenges explained: the 6 most common security issues and risks of cloud computing, from misconfiguration to insider threats, and how to address each.

It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over.

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

Intended audience: non-technical citizens of the web

How the Shai-Hulud worm reached npm through tensorlake@0.5.144, what it steals, how to check if you were affected, and how a 72-hour soak time blocks it.

Technical analysis of CVE-2026-105133 and CVE-2026-105134 in AhsayCBS, revealing how authentication bypass and path traversal enable remote code execution.