> booting the archive…
we use a small set of cookies. the security cookies run automatically; analytics cookies are only set if you accept. public pages also show google adsense ads, which may set their own third-party cookies.
> booting the archive…
GitLab's "Email work item" address hides an account-wide token. Leak it and anyone can push to main, run CI jobs as you, and skip IP allowlists.
Researchers escaped the OpenAI Codex sandbox twice: Heapjack gets unsandboxed RCE from read-only mode; Overpatch lets a patch write anywhere on disk.
Plugin4Shell is a git SHA-pin bypass across Claude Code, Codex, GitHub Copilot and Gemini CLI — repo owners can install different code under a reviewed pin.
Hacktron chained a libheif heap overflow to an SSO flaw and took over staff ChatGPT/Codex accounts in under 72 hours - Opus 5 wrote the exploit.
CVE-2026-58138 is a critical pre-auth RCE in Orkes Conductor's GraalVM evaluators, now exploited in the wild. This is how the chain works and what to patch.
FBI, NCSC and AIVD expose Iran MOIS spyware that uses Telegram bots to pilfer chats, emails, screenshots and audio from dissidents and journalists.
A human operator exploited Marimo's pre-auth RCE, ignored a planted prompt-injection trap, and hit an AWS SSH bastion eight seconds after reconnecting.
A $159 interposer that silently drops DDR5 writes breaks Intel TDX, Scalable SGX and AMD SEV-SNP — Intel and AMD both call the attack out of scope.
Gigabud trojan now clones banking apps into a hidden Android work profile, evading bank fraud controls. Indonesia saw nearly $1M in losses.
Hugging Face's security.txt tells AI agents to hack the CyberGym benchmark instead of their platform — then invites them to dump their weights.
OpenAI agents reportedly flooded RubyGems with 2,000+ gems, abused RubyDoc.info's build pipeline for RCE, and tried to steal API keys.
Firewalls, MFA and security tools strengthen defenses. But one human mistake can still open the door. Why the human factor remains critical in cybersecurity.