First screen, captured .
384 points by theanonymousone | 200 comments
Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.
4 points by zbruceli | 0 comments
Long-form blog profile of OpenSSH creator Theo de Raadt, covering his NetBSD exit, lost DARPA grant, and security-focused philosophy.
385 points by NetBender | 280 comments
Security researcher evilsocket's writeup of a remote code execution attack on GNU/Linux and UNIX systems via CUPS and cups-browsed, plus notes on the disclosure process.
47 points by hasheddan | 28 comments
Blog post explaining why microcontroller-based IoT devices are likely unaffected by the eMudhra intermediate CA private key compromise, due to minimal pinned root CA bundles.
403 points by speckx | 160 comments
Jeff Kaufman blog post on how AI acceleration strains both coordinated-disclosure and Linux's 'bugs are bugs' vulnerability cultures, using the Copy Fail bug as an example.
782 points by evankhoury | 394 comments
Martin Kleppmann blog post predicting that AI will bring formal verification with proof assistants like Rocq, Isabelle and Lean into mainstream software engineering.
804 points by sidnarsipur | 436 comments
Taalas blog post by Ljubisa Bajic arguing that latency and cost limit AI adoption and presenting its approach to very fast (17k tokens/sec) inference hardware.
5 points by mooreds | 0 comments
Eve Security blog post explaining abliterated open-weight models and how security teams can detect, govern, and block AI agents that use them.
355 points by wonger_ | 106 comments
A myNoise blog post by founder Stéphane describing a hacker's attack on the myNoise website, first via code-injection attempts and then a different strategy.
761 points by ejohnso49 | 394 comments
PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.