AI tools, cybersecurity and development news aggregated from top sources — saved permanently with unique URLs.
GHSA-QRWJ-VH9X-GW5V: GHSA-QRWJ-VH9X-GW5V: Cross-Agent Server-Side Request Forgery and Remote Code Execution in Coder Workspace Agent
GHSA-QRWJ-VH9X-GW5V: Cross-Agent Server-Side Request Forgery and Remote Code Execution in Coder Work…
Card-Testing Bots Will Find Your Checkout the Day You Launch. Here's the Pre-Charge Filter That Stops Them.
The first time you ship a public create-payment-intent route, you assume the risk is someone paying …
CVE-2026-35341: CVE-2026-35341: Local Privilege Escalation and Permission Degradation in uutils coreutils mkfifo
CVE-2026-35341: Local Privilege Escalation and Permission Degradation in uutils coreutils mkfifo …
Scan the tool description, I said. So I hid the payload somewhere else.
Last time I wrote about hiding a prompt-injection payload in an MCP tool's description and watching …
Someone Was Testing My Live App While I Was Asleep
I want to start with the comment, because the comment set the tone for everything that followed. It…
DAC, MAC, RBAC, ABAC: the Security+ access control models people keep swapping
Four access control models show up on the SY0-701 exam, and they blur together fast. DAC, MAC, RBAC,…
CVE-2026-35361: CVE-2026-35361: Security Permission Bypass via Improper File Cleanup in uutils coreutils mknod
CVE-2026-35361: Security Permission Bypass via Improper File Cleanup in uutils coreutils mknod Vu…
An identity provider told us who you were, and we believed it
Single sign-on has a quiet premise: when a user arrives from an identity provider, that provider has…
I put the same attack in two places. The one everyone warns about was the safe one.
I gave a model two tools. read_record, which does the obvious thing, and export_record, which ships …
Building Halo’s Multi-Agent Architecture: From Single Loop to Five Specialists
Today I moved Halo from a single autonomous loop to a proper five-agent architecture: Planner, Orche…
CVE-2026-35381: CVE-2026-35381: Input Sanitization and Logic Bypass in uutils coreutils cut Utility
CVE-2026-35381: Input Sanitization and Logic Bypass in uutils coreutils cut Utility Vulnerability…
Certificate Pinning for Video API Clients in PHP Python and Go
The 2 a.m. page that started this Last spring one of our multi-region cron workers — the PHP proce…