AI tools, cybersecurity and development news aggregated from top sources — saved permanently with unique URLs.
GHSA-8R6M-32JQ-JX6Q: GHSA-8R6M-32JQ-JX6Q: XML Entity Expansion Bypass in fast-xml-parser via Repeated DOCTYPE Declarations
GHSA-8R6M-32JQ-JX6Q: XML Entity Expansion Bypass in fast-xml-parser via Repeated DOCTYPE Declaration…
An SVG can be valid enough to render and still deserve a text-only preflight
An SVG is XML-shaped text, but opening it as an image is not the same as reading inert pixels. The …
The OpenAI and Hugging Face Incident Was an Agent Boundary Failure
The OpenAI and Hugging Face Incident Was an Agent Boundary Failure OpenAI said on July 21 that two…
GHSA-F88M-G3JW-G9CJ: GHSA-F88M-G3JW-G9CJ: Multiple Memory Safety and Integer Overflow Vulnerabilities in libvips affecting sharp
GHSA-F88M-G3JW-G9CJ: Multiple Memory Safety and Integer Overflow Vulnerabilities in libvips affectin…
Secure direct-to-cloud file uploads: presigned URLs, magic bytes, and the gotchas nobody warns you about
A teacher clicks "Upload," picks a PDF of this week's lecture notes, and a second later it shows up …
From Wordlists to Polynomials: Understanding BIP39 and Shamir's Secret Sharing
Most explanations of BIP39 and Shamir's Secret Sharing (SSS) stop at "here's what they do." I wanted…
what is BSD? -- notes from my first SecTalks
First impressions: good to be in the company of Security people again made new connections BSD — a…
An Agent Harness Is Not a Security Boundary: Reading AgentSmith as a Workflow Layer
Coding agents do not fail only because a model lacks context. Teams also lose the workflow around th…
Verifying AI Agent Actions: Proof Submission Patterns
There’s a dirty little secret in the world of autonomous AI agents: you can’t always trust them. Whe…
Your coding agent runs a shell on your machine. I audited mine.
A coding agent that can run bash on your laptop is a remote shell on localhost. It has that threat m…
CVE-2026-16221: CVE-2026-16221: Interpretation Conflict leading to Host Confusion and SSRF Bypass in fast-uri
CVE-2026-16221: Interpretation Conflict leading to Host Confusion and SSRF Bypass in fast-uri Vul…
Police dismantle Kratos phishing platform, arrest developer
Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a…