Recherche, sujets (tags des flux RSS), favoris et filtres de contenu.
Sujets les plus fréquents des 3 derniers jours. Un article doit porter tous les sujets choisis.
306 articles conservés pour « security »
Most small encryption tools fail in boring places, not in the cipher. They fail on what happens with a wrong password, a doctored header, a rolled-back state file, or a corrupted chunk. I spent a long time on those boring places for ATLOCK v5, and this post walks through the…
A GitHub Actions security gate for Node.js is a single workflow that runs on every pull request. It scans the new commits for leaked API keys, checks new dependencies for known vulnerabilities and confirms the lockfile is honest. If any of those checks finds something real, it…
Timing-Based Username Enumeration Most modern apps return generic "invalid credentials" messages, but the response time tells a different story. When bcrypt processes a valid username, it takes ~200ms to hash and compare. Invalid usernames skip this entirely. Measure the…
Day 17: AWS Secrets Manager Secrets Manager charges $0.40/secret/month but gives you something Parameter Store does not: automatic credential rotation with pre-built Lambda functions for RDS, Redshift, and DocumentDB. Retrieving Secrets in Go package main import ( "context"…
Day 17: Network commands for security This topic matters because it deals with network exposure and service reachability that people assume instead of proving using Bash and the native Linux tooling already on the box. The pattern #!/usr/bin/env bash set -euo pipefail dig +short…
Day 17/90: Working with Processes -- Python Security 90 Day Python Security Scripting Challenge Process analysis is core to incident response on any operating system. Today we use psutil to build practical triage tooling. Process Inventory with Security Context During triage you…
Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they…
Local AI Is Not a Privacy Switch: Build a Workload Routing Contract Running a language model on a laptop or an internal server can remove one important data transfer: the prompt no longer has to travel to a hosted inference provider. That is useful. It is not the same as making…
Once an agent can run for hours, deploy things and spend money, the interesting question stops being "is the model smart enough?" and becomes "who is allowed to stop it, and how?" I've been collecting posts from the Redreamality blog that treat that as an engineering problem…
Every MCP server you add to Claude, Cursor or your own agent is code that runs on your machine. Usually that's npx something or uvx something , and it runs with your environment variables and API keys sitting right there. I wanted to know how worried I should actually be. So I…
eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Any…
You get an email: "We are writing to inform you that your personal data may have been leaked." Do you know what to do next — and by when? Earlier this year, Japan's government asked citizens to "protect your own information." The public reaction was blunt: companies leak — how…
Tragically simple private keys used by a certification authority based in India have been compromised, meaning the 60-million-plus certs it has issued can’t be trusted and necessitating a massive clean-up job. The CA of concern in this case is called eMudhra, which boasts of…
Hey folks 👋 — this one is wild. On 19 October 2026, Snorre Fagerland of NorForge reported that a single Chinese-speaking operator used AI agents on the open-source Cairn platform to probe and breach websites. The operator wrote brief instructions (under 100 Chinese characters)…
This technical guide provides a try of a "practical blueprint" for implementing the Agent Payments Protocol (AP2) in our applications. We will explore the JSON structure of a Payment Mandate , how an AI agent attaches it to requests, and how a merchant service verifies it…
Governance Attack Surface Review: CCIP Target Protocol : CCIP (TVL: $1986.0M) Governance Attack‑Surface Review – Chainlink Cross‑Chain Interoperability Protocol (CCIP) TVL: ≈ $1.986 B (Ethereum + L2s) Date of Review: 20 Oct 2026 Prepared by: [Your Name], Senior DeFi Security…
Reuters reported it yesterday. One operator, 23 hours per intrusion, $5,000 in tokens. Offensive security just got industrialized. I found it because it had no login. Not a vulnerability. Not a misconfigured S3 bucket. A control panel for an AI agent platform called Cairn, just…
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. As of late morning Tuesday, browser makers…
Connecting a crypto wallet to a Web3 application can feel like a routine first step. You click a button, approve a request, and the application recognizes your wallet. But from a development perspective, there's an important distinction: connecting a wallet does not…
Can AI Agents Safely Access Your Accounting Firm's Data? 9 Actions Counted, 0 Deletes Financial Cents' answer, shipped today, is the strongest vendor gate in this series so far: confirm before any change, and deletes removed from the tool list entirely. Financial Cents launched…
Meta says it paused a Muse feature that lets you share conversations with the AI assistant after researchers found the URLs publicly available on the web, as reported by Ars Technica . In a report published this week , researchers at the security firm Claroc say they found more…
If you know for sure that a website flagged as suspicious is actually safe, you can mark it as such. | Image: Google Google is launching a new browser safety feature for Chrome that aims to keep you better informed about how malicious a website might be before you open it. The…
An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub…
TL;DR On September 10, 2026, Anthropic published "Detecting and countering misuse of AI: September 2026," its fourth threat-intelligence report, covering operations its team disrupted between December 2025 and August 2026 across seven harm areas, with a downloadable IOC set. The…
CogniPrep generates PDF reports with @react-pdf/renderer . I have written before about where those documents are allowed to break across pages and about the 469KB chunk that only arrives when you click Download . This post is about the failure mode underneath both of them: the…
Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported Monday. In response to questions from Ars about the behavior, Meta said it's suspending the sharing feature while the company…
Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates. The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back…
Book: Observability for LLM Applications Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com |…
You found ifrmewrk.exe in Task Manager or your startup list and want to know whether it's safe. Short answer: yes — it's Intel's, it's legitimate, and on most modern PCs you can disable it without losing anything. What is ifrmewrk.exe? ifrmewrk.exe is the Intel PROSet/Wireless…
The UK public sector has reached a cyber resilience inflection point. A new Prime Minister has taken office, and significant machinery-of-government changes have already been announced, including the scrapping of DSIT, the department that had become the center of government…
AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI . Originally published on Basis Desk . Researchers demonstrated that intercepting six network header values let attackers reconstruct private keys…
Blackwall has raised $100M at a $2.2B valuation to continue building security and filtering tools that help websites grapple with growing bot and AI traffic.
When people search for a private photo vault for Android, “offline” often sounds simple. But in practice, it can mean several different things. An app may work without an internet connection while still depending on an account, cloud backup, remote recovery, analytics, or…
Row Level Security (RLS) is one of Supabase's most powerful features—and one of the most misunderstood. The same RLS misconfigurations appear repeatedly across projects. They're not exotic vulnerabilities; they're predictable gaps that happen when developers treat RLS as a…
Flash Loan Attack Vector Analysis: Robinhood Target Protocol : Robinhood (TVL: $14733.7M) Robinhood – Flash‑Loan Attack Vector Analysis Technical Security & Audit Report Prepared by: [Your Name], Senior DeFi Security Researcher Date: 20 Oct 2026 1. Executive Summary Robinhood is…
Many old Android phones in drawers today are 3G phones. Some are 4G phones that have been set to 3G or 2G years ago and never changed back. If you want to use one as a shop or home camera with a SIM card for mobile data, the network letters at the top of the screen tell you most…
Building a Repeatable Public-Sector Exposure Baseline Everything useful about external exposure work reduces to repeatability. A one-off measurement answers a question once; a documented baseline answers it every month, and the comparison is where the value sits. Estonia’s…
Most eval papers give you a table and a PDF. LSCBench gives you the runs. LSCBench is a secure-code benchmark out of NUS and the Qwen team: 150 real vulnerabilities cut into 450 tasks across seven languages, at three granularities (fill in a function, write a whole file, rebuild…
You've probably seen headlines: "Millions of API keys leaked in mobile apps." The reality is less dramatic but more pervasive—hardcoded secrets ship in production apps every day, often in plain sight. I've spent years building tooling around this problem. Here's what works for…
The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order [PDF] is broad, as it requires agencies to ditch "all DeepSeek…
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the…
Why Developers Need to Care About PQC Right Now Transitioning foundational security algorithms across distributed systems, APIs, and databases takes years. If you wait until a fault-tolerant quantum computer scales to break RSA and ECC, your migration window will already have…
A judge ordered Abdulrahman Alfozan to remain in custody, likening the Saudi government’s offer to secure the former OpenAI engineer’s release to a “blank check.”
Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said. Plex fixed four vulnerabilities at the start of last month. Three weeks…
Transitive Behavioral Couplings: Why Downstream LLM Fine-Tuning Silently Unlocks Critical Attack Vectors When deploying domain-adapted Large Language Models (LLMs) in autonomous production swarms, standard verification usually checks two things: task performance on downstream…
Building an SMS OTP Verification Workflow: A Practical Guide for Developers Phone number verification is a common feature in modern web applications. From account registration to login security, One-Time Passwords (OTPs) help applications verify that a user can access a…
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
In my last post , I showed how OPA and Conftest block over-privileged IAM roles before anything gets deployed. I ended with a warning: there's a case where the check passes when it shouldn't. This is that case. It's worse than a missed wildcard, because nothing tells you it…
TL;DR Ivanti Connect Secure is a VPN and remote-access appliance that a company runs at its own network edge, and CVE-2026-104935 is the identifier Ivanti assigned to an authentication bypass and a code-execution flaw in it. An attacker chained that bypass with a file write and…
We follow Alice, a developer at Acme Corp, to demonstrate how missing any of these layers leads to multi-platform integration headaches and expensive $18,000 security flaws. 🧠 WHAT YOU'LL LEARN: Why AI tools act as the "hands" that allow models to produce structured intent and…