1_DevOps'ish

Summary A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic STP timers without an IFF_UP guard. The teardown path taken by dellink never synchronously deletes those timers, so … Linux Bridge STP Timer Use-After-Free Read More »

Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didn't exist.

4.1K likes. "Black Hat USA 2026: The 'Breaking' News: The OpenAI–Hu...

Security researchers say that Kimi K3, an open-weight model from China, wandered off to the internet in an attempt to cheat on a test it was given.

Discover how to find the best Mario Kart 8 build using the Pareto frontier method. This interactive guide explores multi-objective optimization of speed, acceleration, and other key stats to help you beat your friends on the race track.

43 likes, 2 comments. "My thoughts on AI and Open Source"

Why attacks that look like normal traffic are the hardest to stop. How L3/4 and L7 defenses differ, and what four real DDoS incidents reveal about each.

I asked all 11 Massachusetts DAs for their case data. Six million charges came back. The system holding them is "obsolete" — and its replacement is being bought right now, in silence.

Meta is the latest company to disclose an AI agent breach, raising cyber-security concerns.

A security practitioner's account of running Claude Mythos Preview in a vulnerability-hunting harness for 30 days: where it proved exploits and what it cost ($42K).

HashiCorp has released a public beta of Vault Kubernetes key management, a KMS v2-compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise, moving the key encryption keys that protect etcd data out of the cluster and into a separately governed trust domain.

This essay originally appeared in Foreign Policy. Earlier this month, two of OpenAI’s models broke out of their containment sandbox and attacked another AI company. The story is kind of wild. OpenAI was running security tests on two of its models: GPT-5.6 Sol and an unreleased model that is almost certainly GPT-6. In particular, it was running the ExploitGym benchmark, which measures how good a model is at turning security vulnerabilities into working exploits: basically, offensive cyberattacks. Since these were internal tests, OpenAI locked those models in a secure sandbox that denied them access to the internet. But it was running the models without any safety filters that would prevent them from offensive cyber-actions. That meant that there was nothing to prevent the models from trying to ...

Self-host LLM inference when you clear ~2M tokens a day or face data-privacy rules. Below that, an API is cheaper. Most teams want a hybrid.

GitHub Stacked PRs

For nearly two years, researcher Vangelis Stykas has maintained access to North Korean hackers’ servers. His work shows they pulled off intrusions in a shocking number of systems across the globe.

The misbehavior is called reward hacking. This is what you need to know.

The discovery comes after OpenAI's Hugging Face breach last month.

The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is compromised.

Go supply chain security, step by step: govulncheck, pinning, SBOM, container scan, secrets, GitHub Actions hardening, and signing.

Top scores increased by 5x.

Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor.

We are actively investigating a coordinated malware campaign affecting a broad set of highly downloaded packages by Jared Wray (GitHub) and affecting the cacheable ecosystem.

Anti-AI-slop design skill for Claude Code, Cursor, and Codex. - Nutlope/hallmark

The Trump administration has struggled over how to approach “open source” models, which are freely available to download and favored by Chinese companies.

Trends we have observed in threat actor use of software supply chain compromise, and provide mitigation and hardening recommendations.

Software development has emerged as the killer use case for generative AI today, with half of all tokens consumed on OpenRouter being used for code generation. Cursor, for example, has ramped from $100M to $4B of ARR in the last 12 months. We’re in the first innings of the biggest shift in the history of… Continue reading How Agentic Coding Is Reshaping the Software Development Lifecycle

In January 2026, Anthropic released the massive ecosystem launch of Claude Cowork.

The White House said it met its deadline to establish a voluntary framework for evaluating advanced AI models — but it won't say what the framework contains.

AI makes you great at what you're good at.