» Tag
security
92 postsNew API integer overflow turns $0.10 balance into $16.9 trillion
CVE-2026-71479 lets one request overflow New API's billing math, turning a $0.10 balance into $16.9T. CVSS 9.1, fixed in v1.0.0-rc.18.
IETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
MCP Security: Trust Boundaries and the Attacks the Spec Won't Stop
A breakdown of MCP's four trust boundaries, stdio server risks, OAuth 2.1/PKCE/CIMD updates, and the confused-deputy attack class engineers must handle.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comAI Escape Room: Docker CTF Rebuilds the 2026 Hugging Face Breach
A Docker Compose CTF lab recreates the 2026 Hugging Face agent breach, covering SSRF, SSTI, HDF5 exfiltration, and Kubernetes pivoting for security training.
CertiK Uncovers Five DoS Vulnerabilities in Ethereum's Besu Client
CertiK found five DoS vulnerabilities in Ethereum's Besu client, patched in v26.7.1 with advisories following two weeks later.
Python Bytecode: The Security Blind Spot Beyond Source Review
Study of over 1M PyPI packages shows Python .pyc bytecode bypasses source-level security review, exposing CPython to crashes and memory-corruption bugs.
RovoBlast: One Click Turns Atlassian's AI Assistant Into a Data Leak
Varonis details RovoBlast, a one-click prompt injection flaw in Atlassian's Rovo AI assistant that can expose sensitive enterprise data.
Cloudflare OS Bets on Never Trusting Its AI Agents
Cloudflare OS uses a Gatekeeper to simulate unapproved AI agent actions, sandbox every app, and swap credentials for revocable capabilities.
FIPS 140-3 Certifies a Module, Not Your Actual Security Posture
FIPS 140-3 validates a crypto module's algorithms, not overall product security. Real incidents show why engineers should read the fine print.
Malicious Rust Crate Arrayref Executes a Build-Time Payload
A compromised release of the arrayref crate runs a malicious payload at build time, raising security concerns for developers.