» Tag
security
518 postsSpectre Flaw Leaks JWT Tokens on Cloudflare Workers via Remote Timers
A new Spectre attack bypasses Cloudflare Workers' DyPrIs defense, leaking JWT tokens via microarchitectural timers; Cloudflare responded with MPK-based isolation.
New API integer overflow turns $0.10 balance into $16.9 trillion
CVE-2026-71479 lets one request overflow New API's billing math, turning a $0.10 balance into $16.9T. CVSS 9.1, fixed in v1.0.0-rc.18.
IETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comMCP Security: Trust Boundaries and the Attacks the Spec Won't Stop
A breakdown of MCP's four trust boundaries, stdio server risks, OAuth 2.1/PKCE/CIMD updates, and the confused-deputy attack class engineers must handle.
AI Escape Room: Docker CTF Rebuilds the 2026 Hugging Face Breach
A Docker Compose CTF lab recreates the 2026 Hugging Face agent breach, covering SSRF, SSTI, HDF5 exfiltration, and Kubernetes pivoting for security training.
Sabba: A Security Tool That Proves Bugs by Actually Running Them
Sabba is an MCP security tool that verifies every bug finding by actually compiling and running the exploit, not just guessing with an LLM.
Kernel-Level Enforcement for AI Agents via eBPF-LSM and Z3
Solo-built eBPF-LSM prototype enforces AI agent guardrails at the kernel syscall boundary with Z3 SMT checks; open break-it challenge on GitHub.
One ChatGPT link could plant a rogue AI agent inside your company
OpenAI's ChatGPT agent builder had an AgentForger flaw letting a single link spawn a rogue AI agent with an employee's full access.
CVE-Bench: A Sandbox Benchmark for LLM Agents Fixing Real CVEs
CVE-Bench is an open-source benchmark testing LLM agents' ability to fix real Python CVEs inside sandboxed Docker containers.
AI Agents in Production: Why 88% of Enterprise Pilots Fail
Why 88% of enterprise AI agent pilots stall before production, and the isolation, identity, secrets, and audit controls the successful 12% use.