Practical security from someone who's been responsible for keeping production systems safe. Threat analysis, authentication, post-quantum risk, and the attacks developers need to understand.
Artificial intelligence
Anthropic's $1.5M donation seeds a $10M Responsible AI Initiative at the Apache Software Foundation. That's more than half of ASF's entire annual budget in one shot — which tells you everything about how badly the open source infrastructure powering AI has been underfunded.
Cybersecurity
A critical SSRF flaw in Axios was used in a North Korean supply chain attack. Here's what it does and how to patch it today.
Cryptography
A deep-dive into the full cryptographic stack powering every HTTPS connection — RSA-OAEP, AES-GCM, ECDHE key exchange, and a working TLS 1.3 handshake simulation, all built in pure Python from first principles.
Artificial intelligence
On March 31, 2026, Anthropic published version 2.1.88 of Claude Code to the npm registry. Bundled inside was a 59.8 MB JavaScript source map file — a debug artifact that reconstructs the complete original TypeScript source from the minified production bundle. By 4:23 AM ET, it was
Cybersecurity
Infostealers are commodity malware that silently harvest credentials, session tokens, and crypto wallets from infected machines. The Lumma Stealer infection that triggered the Vercel breach started with one. Here is how they work and why they are so effective.
Cybersecurity
RSA-2048 can be broken with fewer than 100,000 qubits. What that means for TLS, certificate infrastructure, and the post-quantum transition already underway.
Cybersecurity
SSRF tricks your server into making requests to internal systems — cloud metadata services, internal APIs, AWS credentials endpoints. It turned a WAF misconfiguration into 100 million stolen Capital One records
Cybersecurity
Your application is only as secure as every package it depends on. In September 2025, attackers compromised 27 npm packages with 2.6 billion weekly downloads by phishing one maintainer.
Cybersecurity
An attacker starts with a low-privileged shell or user account and escalates to root or Administrator using misconfigurations, SUID binaries, kernel exploits, and Active Directory attacks. Here's every technique, the tools professionals use, and how to harden against it.
Cybersecurity
Phishing, vishing, pretexting, physical infiltration — here's how every technique works, how attackers use them in production breaches, and how to actually defend against them.
Cybersecurity
Penetration testing is authorized, structured hacking — finding vulnerabilities in systems, networks, and applications before real attackers do. Here's the full methodology, every phase of a real engagement, the tools professionals use, and how to build a career in it.
Cybersecurity
XSS injects malicious JavaScript into web pages served to other users — stealing sessions, redirecting to phishing pages, or silently exfiltrating data. It's been in the OWASP Top 10 since 2003. Here's every type, how each one works, and how to actually fix them.