The control worked. That’s the problem.

Browse by subject

The security beat, sorted by how much we’ve written about each.

• Cybersecurity50
• Cryptography16
• Vulnerabilities13
• Encryption11
• Exploits9
• Privacy7
• Privilege Escalation6
• CVE6
• Server Security5
• Penetration Testing3
• Cloud Security3
• Social Engineering3
• SQL Injections3
• SSL/TLS3
• RCE2
• Zero Trust2
• Phishing1
• Heap Overflow1
• Data Leaks1
• Timing Attacks1

Dedicated feeds

Three strands that run through the hub.

Vulnerabilities & exploits

A Password-Free Path to Root: Inside the macOS Screen Sharing Vulnerability Now Under Attack

A logic bug in screensharingd let attackers skip authentication entirely and land as root — no password required. Here's how it was found, patched, reverse-engineered, and finally weaponized.

14 Aug 2026 · 6 min read

• Januscape: A 16-Year-Old Linux KVM Escape Bug 4 Aug
• Minecraft Bedrock Server RCE: CVE-2026-55010 4 Aug
• OpenClaw Is Running on Your Machine Right Now. Here's What to Lock Down Before It Eats Your Credentials. 24 Jul
• See all →

Cryptography

RSA Is Simple. Deploying RSA Correctly Almost Never Is.

The capstone to our RSA series. The math checks out. Shipping it as written gets you breached. This is the nineteen-year-old attack that proves it, and what belongs in production instead.

31 Jul 2026 · 8 min read

• Claude Mythos vs. HAWK and AES: What It Found 30 Jul
• Microsoft's 2011 Secure Boot Certificates Are Expiring and Most Windows Users Don't Know It 4 May
• A Researcher Just Broke a 15-Bit Elliptic Curve Key on a Quantum Computer. Here's Why That Should Concern You. 4 May
• See all →

Attacks & defence

Zero-Trust Access for Homelabbers: Teleport vs. Tailscale vs. WireGuard vs. Cloudflare Tunnel

Four tools solve four different problems that all get pitched as the same problem. Here's what each one does, where each one breaks, and the combination that covers a real homelab without paying an SSO tax you didn't see coming.

19 Aug 2026 · 5 min read

• Hacktivism, 2021 to Today: From Steel Mills to Power Grids 14 Aug
• Zero Trust Everything: The Complete Guide to Self-Hosting Teleport for Secure Infrastructure Access 20 Jul
• What is Privilege Escalation? How Attackers Go From Foothold to Full Control 10 Oct
• See all →

Newest first.

Cybersecurity

What is OAuth?

Every time you click "Sign in with Google" or "Connect your GitHub account," you are using OAuth. You have used it hundreds of times. Most developers have implemented it at least once. And the April 2026 Vercel breach, which exposed credentials for hundreds of organizations, happened

Cybersecurity

CVE-2026-33032: The nginx-ui MCP Vulnerability That Hands Attackers Full Server Control

CVE-2026-33032, dubbed MCPwn, is a CVSS 9.8 authentication bypass in nginx-ui's MCP integration that lets any attacker on the internet restart your Nginx server, rewrite your configs, and intercept all traffic -- in two HTTP requests, no credentials required. Roughly 2,700 instances are exposed.

Cybersecurity

BlueHammer: The Unpatched Windows Zero-Day That Weaponizes Microsoft Defender Against Your Own System

BlueHammer is an unpatched, publicly released Windows local privilege escalation exploit that chains Microsoft Defender's update workflow, Volume Shadow Copy, Cloud Files callbacks, and opportunistic locks to reach NT AUTHORITY\SYSTEM from a standard user account.

Cybersecurity

Anthropic's Claude Now Requires Government ID and a Selfie — Users Are Furious

Anthropic quietly rolled out identity verification for Claude subscriptions, asking for passports and live selfies via third-party vendor Persona. ChatGPT and Gemini require neither. Here's why this decision is a mess, who's actually affected, and what Persona's track record means for your data.

Artificial intelligence

Claude Mythos Hacked Every Major OS, Escaped Its Sandbox, and Emailed a Researcher Eating a Sandwich. We Need to Talk.

I use AI as a tool. I'll say that upfront. Claude helps me write frontends faster. It handles search queries that Google stopped being useful for three years ago. I hand it boilerplate I've written by hand a thousand times and I get time back. That&

Artificial intelligence

Anthropic Just Wrote Apache a $1.5M Check. Here's Why That Number Is Both Impressive and Embarrassing

Anthropic's $1.5M donation seeds a $10M Responsible AI Initiative at the Apache Software Foundation. That's more than half of ASF's entire annual budget in one shot — which tells you everything about how badly the open source infrastructure powering AI has been underfunded.

Cybersecurity

CVE-2025-62718: Critical Axios SSRF Vulnerability Explained

A critical SSRF flaw in Axios was used in a North Korean supply chain attack. Here's what it does and how to patch it today.

Members only

Cryptography

Implementing RSA, AES-GCM, and a TLS 1.3 Handshake from Scratch in Python

A deep-dive into the full cryptographic stack powering every HTTPS connection — RSA-OAEP, AES-GCM, ECDHE key exchange, and a working TLS 1.3 handshake simulation, all built in pure Python from first principles.

Artificial intelligence

Anthropic Accidentally Shipped Claude Code's Entire Source to npm — and the Internet Read Every Line

On March 31, 2026, Anthropic published version 2.1.88 of Claude Code to the npm registry. Bundled inside was a 59.8 MB JavaScript source map file — a debug artifact that reconstructs the complete original TypeScript source from the minified production bundle. By 4:23 AM ET, it was

Cybersecurity

What is an Infostealer?

Infostealers are commodity malware that silently harvest credentials, session tokens, and crypto wallets from infected machines. The Lumma Stealer infection that triggered the Vercel breach started with one. Here is how they work and why they are so effective.

Cybersecurity

Your HTTPS Is Toast (But Google Has a Plan): Merkle Tree Certificates and the Post-Quantum Web

RSA-2048 can be broken with fewer than 100,000 qubits. What that means for TLS, certificate infrastructure, and the post-quantum transition already underway.

Cybersecurity

What is SSRF? Server-Side Request Forgery and the Attack That Breached Capital One

SSRF tricks your server into making requests to internal systems — cloud metadata services, internal APIs, AWS credentials endpoints. It turned a WAF misconfiguration into 100 million stolen Capital One records

Cybersecurity

What is Supply Chain Security? Dependencies, SBOMs, and the Attack That Hit 2.6 Billion npm Downloads

Your application is only as secure as every package it depends on. In September 2025, attackers compromised 27 npm packages with 2.6 billion weekly downloads by phishing one maintainer.

Cybersecurity

What is Privilege Escalation? How Attackers Go From Foothold to Full Control

An attacker starts with a low-privileged shell or user account and escalates to root or Administrator using misconfigurations, SUID binaries, kernel exploits, and Active Directory attacks. Here's every technique, the tools professionals use, and how to harden against it.

Cybersecurity

What is Social Engineering? The Attacks That Bypass Every Technical Control

Phishing, vishing, pretexting, physical infiltration — here's how every technique works, how attackers use them in production breaches, and how to actually defend against them.

Cybersecurity

What is Penetration Testing? The Discipline of Breaking Things Before Attackers Do

Penetration testing is authorized, structured hacking — finding vulnerabilities in systems, networks, and applications before real attackers do. Here's the full methodology, every phase of a real engagement, the tools professionals use, and how to build a career in it.

Cybersecurity

What is Cross-Site Scripting (XSS)? The Attack That Turns Your Website Against Your Users

XSS injects malicious JavaScript into web pages served to other users — stealing sessions, redirecting to phishing pages, or silently exfiltrating data. It's been in the OWASP Top 10 since 2003. Here's every type, how each one works, and how to actually fix them.

Cybersecurity

What is SQL Injection? The Attack That's Been Destroying Databases Since 1998

In 2008, attackers used SQL injection to breach Heartland Payment Systems, a payment processing company. They stole 130 million credit and debit card numbers. The breach cost Heartland over $140 million in settlements and fines. The CEO described it as an "international cybercrime ring." The technical execution was

Cybersecurity

What is Encryption? The Math That Keeps Your Data Private

Encryption transforms readable data into unreadable ciphertext that only someone with the right key can reverse. It's what makes HTTPS, messaging apps, banking, and password storage work. Here's how it actually functions.

Cybersecurity

What is Cybersecurity? The Field That Keeps the Internet From Collapsing

Cybersecurity is the discipline of protecting systems, networks, and data from attack, damage, and unauthorized access. Here's what it actually covers, how attacks work, how defense works, and why every developer needs to understand it.

Cybersecurity

Understanding Why PassKeys will Replace Passwords

First, allow me to start off with that I am absolutely loving using Passkeys to login into CloudFlare, Stripe, and other important services that I use to run CoderOasis. This should of been a thing a few years ago – maybe all the way back in 2016 or so. The growth

Cybersecurity Featured

Hacktivism: Social Justice by Data Leaks and Defacements

A CEO bragged he'd unmasked Anonymous. Hours later, a SQL injection in his own CMS ended his career. The real attack chains behind hacktivism, tools included.

Cryptography Featured

RSA Part 3: Your Correct Implementation Still Leaks the Key

Key generation works, encryption round-trips, the math is provably right — and an attacker can still recover the private key by timing your decryptions. Here are both defenses, measured, with what they actually cost.

Cryptography Featured

RSA Part 2: Real Primes, Real Text, and a Bug That Eats Your Data

Part 1 used 15-bit primes and only encrypted integers. Making it usable means generating 1024-bit primes and chunking bytes — and the standard way to do the second one silently destroys data on inputs the tests never cover.

Cryptography Featured

RSA in Python From Scratch: The Math, the Code, and What Breaks It

Every HTTPS connection you have ever made runs on a 1978 paper. You can build the core of it in about fifty lines of Python — and then see exactly why those fifty lines would get you destroyed in production.