Blog
Writing about AI — how it works, where it helps, and what we learn building with it.
Latest posts
A One-Click Nextcloud App Was Being Backdoored for Five Weeks Before Anyone Was Told. Turning It Off Does Not HelpCVE-2026-110447 lets an unauthenticated request run commands on a Nextcloud server through the Collabora built-in CODE app. The fix shipped on 11 September without a security note, the first logged attack was on 10 September, and the advisory arrived on 14 October.Security
Cisco's Email Gateway Is Giving Up Root Again. This Time the Fix Had Been Sitting There for a MonthCVE-2026-76519 lets a crafted email attachment write files as root on a Cisco Secure Email Gateway. It is being exploited, CISA wants federal agencies patched by 17 October, and the component that decides whether you are exposed is not the one your inventory tracks.Security
XBOW Won Google's Top Chrome Bounty With a Public OpenAI Model. The Exploit Cost $40,000 to BuildGoogle's Chrome Vulnerability Reward Program paid XBOW $250,000 for a three-bug chain that ran code on Windows from a loaded web page. XBOW says one researcher and AI agents running OpenAI's publicly available GPT-5.6 Sol built it in six days for roughly $40,000 in compute — and that ratio, not the payout, is the story.Security
OpenAI's Intruder Did Not Go After the Weights. He Allegedly Went After the RoomThe Justice Department has charged an OpenAI engineer with hiding a recorder in the company's executive conference room. A year of frontier-lab security debate has been about model weights; the device that allegedly got inside was a microphone.Security
Ivanti's Zero-Day Chain Took Root on a Fully Patched VPN. Its Own Integrity Checker Said NothingIvanti disclosed CVE-2026-104935 and shipped fixes on October 13, the same day Volexity published its account of an actor chaining three flaws to root on an appliance running the newest available build. The Integrity Checker Tool did not detect it, there was no implant on disk, and the privilege escalation flaw in the chain is still unpatched.Security
Ledger's Genuine Check Passed. The Implant Was Sitting Next to the Chip It ChecksLedger has confirmed an unauthorized hardware implant in a wallet sold by an authorized reseller, with on-chain researchers estimating $86–93 million drained from more than 300 wallets. The device's own authenticity check could not have caught it.Security
Ahold Delhaize's Distribution Centres Stopped, Not Just Its Websites. In France, the Freezers Went the Other WayAhold Delhaize disclosed a network security issue on Monday morning, by which point work had already halted at several Albert Heijn distribution centres and US staff could not reach their schedules. The same weekend, attackers remotely warmed refrigeration cases in hundreds of French supermarkets — two unrelated incidents that both bypassed the customer database and went straight for the food.Security
GhostAction Has Stopped Settling for Your CI Secrets. It Now Reads the Whole Git HistoryGitGuardian, Socket and StepSecurity each published findings this week on a GitHub Actions supply-chain campaign that has been running since 2025. The new version does not just take named CI secrets — it mines the full commit history, which is why last year's rotation advice no longer covers it.Security
The iPhone Exploit Chain Built for Spies Now Steals Keychains and Crypto Wallets. Apple Patched It in MarchiVerify has found a new variant of the DarkSword iOS exploit chain, rebuilt to extract keychain entries and cryptocurrency wallet data instead of running surveillance. Every vulnerability it uses was fixed months ago, the last of them in iOS 26.3.Security