» curated · synthesized
Skip the noise.
Read the signal.
Curated tech news and synthesis for developers and technology professionals.
» Latest posts
379 postsAuthenticated RCE Exploits Hit Redis via Stream, TDigest, TopK Bugs
Authenticated RCE chain hits Redis 6.2.22 through 8.8.1 via stream NACK double-free, TDigest and TopK module bugs, bypassing two prior CVE patches.
RefluXFS: XFS reflink race lets Linux users escalate to root (CVE-2026-64600)
Qualys details RefluXFS (CVE-2026-64600), an XFS reflink race enabling local privilege escalation to root on default RHEL, Rocky, and Fedora Server installs.
ExploitGym Benchmark Tests If AI Agents Can Build Real Exploits
ExploitGym benchmarks whether AI agents can convert 869 real-world security bugs into working, code-execution-achieving exploits.
mcpgrade audit: a third of 36 popular MCP servers score D or F
mcpgrade graded 36 MCP servers on agent usability, not spec compliance — a third scored D/F due to undocumented parameters and naming collisions.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comWhen AI Writes Most of the Code, Peer Review Must Be Redesigned
As AI agents write and review most production code, traditional PR-approval compliance controls no longer reflect reality—here's what should replace them.
LeakyLMs: Timing Attacks Expose LLM Architecture and Inference Tricks
LeakyLMs shows how timing side-channels can leak LLM architecture details and speculative decoding setups from production APIs like Gemini and Llama.
Reverse-Engineering Windows' Undocumented Offline Device ID API
A reverse-engineering deep dive into Windows' undocumented GetOfflineDeviceUniqueID function, tracing its RPC path from clipc.dll to clipsvc.dll.
Turning the Database Inside Out: Kleppmann's Samza Talk Revisited
Revisiting Martin Kleppmann's classic talk on using Apache Samza and Kafka to rethink databases as streams of immutable facts.
RubyGems CDN Caching Bug Could Leak Legacy API Keys to Other Users
A RubyGems.org CDN caching flaw could leak legacy API keys between users for up to an hour; CVSS 7.2, all legacy keys have been revoked.
No Fine-Tuning: Facts Hand-Wired Directly Into Llama-3.1-8B's Weights
A mechanistic-interpretability method hand-wires facts into Llama-3.1-8B's weights without fine-tuning, LoRA, or RAG — with a live neuron visualizer.