How the Shai-Hulud worm reached npm through tensorlake@0.5.144, what it steals, how to check if you were affected, and how a 72-hour soak time blocks it.

Technical analysis of CVE-2026-105133 and CVE-2026-105134 in AhsayCBS, revealing how authentication bypass and path traversal enable remote code execution.

Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.

A scan of the web server my project builds reported a High-severity vulnerability in its HTTP/2 library. A second scanner, one that checks which functions a program actually calls, confirmed the vulnerability and found four more. I drafted the release note…

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show…

How a $1 million sandbox challenge led pwn to a Linux CHECKSUM_PARTIAL trust-boundary bug: a post-validation IPv4 header mutation, a 32-byte host-memory disclosure, and an owned-host VM escape.

139 catalog entries, 138 shipped bundles, and two apps whose outbound data sharing deserves a closer look.

A trivial ReDoS in symfony/http-foundation, reachable by default and unauthenticated through Cache-Control: on Laravel + nginx it turns into an application-layer DoS

RPKI now protects 70% of Internet routes. See what drove the 2026 jump, how well it stops invalid routes, and where gaps remain.

Microsoft’s CEO says companies can’t outsource responsibility for what AI does on their behalf. The law already holds executives to that personally, and AI is making it harder to sign honestly.

Why did people love Private Access Tokens but hate the Web Environment Integrity API? They're the same thing!

A use-after-free in Android’s Binder driver, recorded once and replayed at will. Part 1 of a series building a full kernel exploit chain with time travel debugging.

A formatter, minifier or deobfuscator can be made to turn one script into another. 186 techniques across 37+ JavaScript processors, from Chromium DevTools to WebCrack, plus a Tetris script that becomes Snake.