23 articles with this tag
The Maintenance Sabbatical: curl's Bug Pause & AI CVE Crisis
How Daniel Stenberg's decision to pause curl vulnerability reports in July 2026 exposes the crisis of AI-generated CVE spam and open-source maintainer burnout.
Inside the Cursor 0-Day: Remote Code Execution via Git Path Hijacking
Anatomy of the unpatched Cursor RCE on Windows. Learn how path search order hijacking executes malicious git.exe and how to secure workspaces.
Inside Ghostcommit: How Malicious PNGs Bypass AI Code Reviewers
Anatomy of the Ghostcommit vulnerability. Learn how steganographic prompt injections in PNGs bypass AI code review bots and how to secure your pipelines.
The AI Workspace Hijack: Anatomy of the Jscrambler NPM Attack
Anatomy of the Jscrambler NPM supply chain attack. Learn how a Rust-based infostealer targeted local AI assistant settings and how to protect your workspace.
Inside 'Bad Epoll' (CVE-2026-46242): Why Your AI Agent Missed the Bug
We analyze the Linux kernel CVE-2026-46242 epoll race condition and discuss the critical limits of semantic LLMs in detecting systems security bugs.
NGINX Rift: How Autonomous AI Found an 18-Year-Old RCE Bug
An 18-year-old heap buffer overflow in NGINX was found by an autonomous AI agent in 6 hours. We analyze NGINX's script engine memory layout and exploit chain.
Your European Workloads Run on American Law. What Changes in May.
85% of European cloud runs on US infrastructure. The EU's CADA legislation drops May 27. What Staff+ engineers need to know about sovereign architectures.
We Built a Technical SEO Audit Tool. Then We Pointed It at Ourselves.
A 32-check SEO engine with Node.js and SSE, the SSRF landmines nobody warns you about, and what happened when we dogfooded our own site.
The Alignment Tax: ASI09 & ASI10 — Your Agent IS the Threat
OWASP Agentic Top 10 series finale. ASI09 (Trust Exploitation) and ASI10 (Rogue Agents) — the threats that don't need an external attacker.
The Trivy Cascade: 75 Poisoned Tags, a Blockchain Worm, 5 Days of Chaos
A complete technical dissection of the TeamPCP supply chain attack that cascaded from Trivy to Checkmarx to npm to PyPI — the largest CI/CD compromise of 2026.
NVIDIA NemoClaw: The SELinux for Agent Governance
NVIDIA NemoClaw adds kernel-level sandboxing and out-of-process policy enforcement to OpenClaw. We map its architecture against the OWASP Agentic Top 10.
When One Agent Falls, They All Fall: ASI07 & ASI08 — The Distributed Systems Nightmare That Multi-Agent Architectures Weren't Built to Survive
Amazon's Kiro deleted a production environment. 40% of multi-agent pilots fail in 6 months. ASI07 and ASI08 are distributed systems problems in AI costumes.
The Invisible Wire: 175,000 Naked AI Agents, a WireGuard Mesh, and Why Tailscale Is Becoming the Nervous System of Agentic Infrastructure
175,000 AI agents exposed with zero authentication. The network layer nobody is securing, and how a WireGuard mesh with identity-based access closes it.
When Your Agent Becomes the Exploit: ASI05 & ASI06 — The Twin Threats That Turn AI Autonomy Against You
A deep dive into OWASP Agentic ASI05 and ASI06: the Claude Code CVEs, the Summer Yue incident, and how code execution chains with memory poisoning.
The OpenClaw Meltdown: 9 CVEs, 2,200 Malicious Skills, and the Most Comprehensive Real-World Test of the OWASP Agentic Top 10
In 5 weeks, OpenClaw triggered 8 of 10 OWASP Agentic vulnerability classes. This is the forensic dissection every engineer building AI agents needs to read.
The New Security Bible: Why Every Engineer Building AI Agents Needs the OWASP Agentic Top 10
The OWASP Agentic Top 10 is the first security framework for autonomous AI agents. 10 risks, real incidents, and the attack chains that connect them.
The Chrysalis Dissection: How a State-Sponsored APT Weaponized Your Text Editor's Update Button
How APT Lotus Blossom compromised Notepad++ updates to deploy Chrysalis backdoor. DLL sideloading, API hashing, and detection rules.
Open Claw & Moltbook: The Complete Guide to the Agentic Web Revolution
A technical dive into Open Claw's local-first AI agents and Moltbook's AI-only social network: installation, security analysis, and what they signal.
React2Shell (CVE-2025-55182): The Critical RCE That's Turning React and Next.js Into a Hacker's Playground
React2Shell (CVE-2025-55182) is a CVSS 10.0 pre-auth RCE in React Server Components and Next.js. Default configs are vulnerable and exploits are live.
The Agentic Singularity: Unrolling OpenAI’s Codex Loop and the Death of the 'Chat' Interface
The chatbox era is over. OpenAI's Atlas and the Codex loop introduce recursive state management, turning stateless chat into stateful agent execution.
The World-Class SSH Key Generator: Theory, Practice, and Battle-Tested Workflows
SSH keys from the math to the muscle memory: RSA, ECDSA and Ed25519 compared, plus a full walkthrough of the gsstk SSH key generator.
The MCP Git Wake-Up Call: Why Your Agentic Workflow Is an Attack Surface
Three critical vulnerabilities in Anthropic's MCP Git server expose a new attack class: indirect prompt injection through tool servers.
MCP Security: The Uncomfortable Truth About Tool Poisoning and Prompt Injection
Two authors disagree on MCP security. Icarus calls the design fundamentally unsafe; Hephaestus argues tool poisoning and injection are manageable risks.