The cuckoo doesn’t build a nest: it lays its egg in another bird’s, which incubates and feeds it as its own. Nobody checks what’s inside the egg, only that it’s in the nest. Something similar has …
Researchers at Apiiro have found over 100,000 .claude/settings.local.json files pushed to public GitHub repositories. Of those, around 1,100, from 63 different organisations, had secrets inside: database passwords, API …
Since November 5, Outlook.com (and with it Hotmail, Live and MSN) has been bouncing part of the mail sent from domains that don’t publish a DMARC record. Thomas A. Johnson, from MailRoute, spotted it in their own …
Daniil Gentili has announced Psalm 7, the new version of the PHP static analyser. The list of changes is huge, but one stands out above the rest: security analysis is on by default and runs in the same pass as type …
Ozgun Kultekin, from Wakefield, has published sshhole, a flaw in OpenSSH on Linux systems that use musl as their C library instead of glibc. On those systems, under certain conditions, sshd accepts any password longer …
Postman is one of those tools that has been installed on almost every developer’s machine for years. That’s why an issue opened in its support repository caught my attention, with a rather blunt title: the …
On Thursday 29 October, for about eleven hours, the Claude Code extension for VS Code distributed through the Cursor marketplace carried a backdoor. Cursor has published a security notice and the security firm Phorion a …
Yesterday evening, 29 October, Binance, the world’s largest cryptocurrency exchange, suffered the largest crypto theft on record: according to the company itself, around $6.3 billion. The figure is still moving …
Alpine Linux has published an incident report on its GitLab instance with a lesson I think is very useful for anyone maintaining their own container images: they upgraded GitLab to a fixed version and were still …
A week ago I wrote about how PHP2Shell came out early and forced people to mitigate without a patch. Now something similar has happened one level further down, in the firmware that boots servers. TianoCore has published …
Update (28 October): according to a follow-up published by Dennis Jackson, eleven days after the report, the git, curl and python3 that Apple ships with macOS still accept the compromised certificates. On top of that, …
Cloudflare has published an incident report that I think is required reading for anyone serving language models: between 27 August and 9 September, the GLM-5.3 model on Workers AI returned to some customers responses …
