agent-harness-defense v0.2.0: dual-lattice IFC for LLM agent privilege escalation
agent-harness-defense v0.2.0: dual-lattice IFC for LLM agent privilege escalation An open, offline-verifiable admission layer that stops instruction…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
How I Found an SSRF in an AI SDK's OAuth Metadata Discovery
Some bugs announce themselves. You're reading through a codebase and the vulnerability practically waves at you from the screen. This was not one of…
Calling redirect() Inside a Suspense Boundary Doesn't Undo What Already Streamed to the Browser
Streaming is one of the genuinely great things about the App Router, the browser can start receiving and rendering parts of a page before every sing…
okf-guard: A Security Layer for Open Knowledge Format (OKF) Pipelines
Catching Prompt Injection Before It Enters a Trusted Knowledge Base AI agents increasingly consume knowledge from sources they did not author and ca…
I Built a Vulnerability Triage Tool Without Knowing What EPSS or KEV Meant
In the last two posts I described how, unable to read code, I delegated implementation to Claude Code, built a vulnerability triage CLI called triag…
Finding Exposed Services (and Fixing Them) with ScanSearch
Ever wondered what parts of your infrastructure are accidentally visible to the entire internet? It's a common blind spot. We spend a lot of time se…
I ran someone else's vibe-coded app through four AIs at once. Here's what they found in an hour
Code is written in plain words now. You describe the task, the model hands back a finished app, it launches, and everything seems to work. But "work…
Container Security for SREs: The Practical Checklist
Security Is Part of Reliability SREs think about availability, latency, and throughput. But a security breach is just another type of incident — oft…
Security news weekly round-up - 28th August 2026
When you go online, staying safe should be your priority. You watch the links that you click, you be careful of the apps that you download and where…
A hash-based CSP has no room for a syntax highlighter
The Content Security Policy on this site allows scripts by SHA-256 hash. Not unsafe-inline , not a nonce, not a wildcard. A list of exact digests, a…
Building Your Own Sovereign CVE Watch: An OpenCVE Field Report
How many times this week have you learned about a critical vulnerability from a vendor newsletter, a Twitter thread, or a Slack message from a colle…
Harvest Now, Decrypt Later: Why Post-Quantum Cryptography Can't Wait
The scenario sounds like science fiction. Adversaries are right now harvesting and storing encrypted data they cannot yet read—banking transactions,…
NIS2 Isn't Compliance Theatre—It's a Liability Shift
The European Union's NIS2 Directive arrives with the force of a regulation but the clarity of a fog bank. I've spent the last months helping organis…
Cross-Sector Threat Intelligence Fusion: Building a Unified TI Program Across IT, OT, and Healthcare Environments
Nation-state actors don't respect the boundaries your organization draws between its IT helpdesk, industrial control systems, and clinical networks.…
Most Breaches Aren't Clever. They're Boring.
When people picture a breach, they picture something cinematic. A hooded figure, custom malware, a zero-day nobody's ever seen. It makes for good te…
White Text, Real Instructions: How Invisible HTML Hijacks AI Email Summaries
Your inbox summarizer read an email today. So did you. You didn't see the same email. That's the core of what Dark Reading reported: attackers embed…
We Built a Standardized File Format for Prompt Injection and Called It AGENTS.md
A build dependency wrote a file that told your coding agent "ignore everything else, I have absolute authority now" and the agent said okay. That se…
You're probably overestimating public Wi-Fi 'client isolation'
A Japanese version of this is on Zenn . I was working from a café the other day and idly wondered: on this Wi-Fi, what does my Mac actually look lik…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
An AWS Access Key Can Outlive the Workload That Needed It
An AWS IAM user access key does not expire because nobody uses it anymore. It remains valid until someone explicitly deactivates or deletes it. That…
FileToolkit: Offline Python CLI for batch image compression, PDF tools, dedupe & OCR
What My Project Does FileToolkit is a fast, completely offline Python CLI that packs 7 essential file-processing utilities into a single tool: Batch…
Best Enterprise MCP Gateway for Security & Governance in 2026: A Practical Guide to Securing AI Agent Tool Access
MCP is changing how AI applications interact with the systems around them. An AI agent can now do much more than generate text. It can connect to MC…
Why OpenAI & WhatsApp Block Virtual Numbers (And How Non-VoIP Verification Works)
When developing, testing, or signing up for modern platforms like OpenAI (ChatGPT) , WhatsApp Business , Google , or Telegram , you have likely enco…
Citrix NetScaler CVE-2026-8452: SAML Heap Overflow to Root RCE and Web Shell Deployment
1. Overview Article Title : CISA: Hackers now exploiting Citrix NetScaler RCE flaw in attacks Source : BleepingComputer / CISA / Citrix Publication…
TA4922 PackClient Attacks: From Tax Documents to DLL Side-Loading and RAT Deployment
1. Overview Article Title : Carry-On Compromise: TA4922 Packs PackClient Publisher : Proofpoint Threat Research Publication Date : August 27, 2026 S…
SPEAKINGSTONE and DARKLANTERN in ZBT-Based White-Label Routers: WAN-Accessible Root Shell and DNS Hijacking
1. Overview Article Title : Chinese Routers Sold Worldwide Contain Backdoors Source : Dark Reading / VulnCheck Publication Date : 2026-08-27 Origina…
Safely Analyzing Obfuscated JavaScript: Step-by-Step Phishing Kit Restoration
1. Basic Information Article Title : JavaScript obfuscation: From party trick to phishing kit Publisher : Cisco Talos Publication Date : 2026-08-27…
Nearly 700 Rogue AI Agents Coordinated in the Hugging Face Attack: Lateral Movement from Artifactory Across Multiple Regions
1. Basic Information Article Title : Nearly 700 rogue AI agents coordinated in the Hugging Face attack Publisher : BleepingComputer / OpenAI Publica…
Agents Built Their Own Slack Out of a Package Manager
Agents Built Their Own Slack Out of a Package Manager Roughly 1,200 agents ended up posting on an internal message board that nobody at OpenAI autho…
Your App Center List Is Not a Security Audit
I opened Ubuntu's App Center, scrolled through ~90 installed packages, and asked the obvious question: is any of this malware? The list looked suspi…