2020
view article2017
view article2015
view article2014
view article2011
view article2003
view article2002
view article2000
view article1999
view article1999
view article1998
view article1996
view article1994
view article1984
view article1973
view article1968
view article1968
view article1963
view article1961
view article1956
view article1956
view article1943
view article1941
view article1940
view article1938
view article1924
view article1923
view article1918
view article1913
view article1907
view article1903
view article1895
view article1863
view article1837
view article1822
view article1812
view article1702
view article1517
view article932
view article802
view articleIn my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back with some more vulnerabilities in this system, each giving the same primitives to the attacker. In total, the vulnerabilities here netted me a cool $200,000. I also held a talk detailing this at Blue Hat Asia 2026, and when the recordings are out, I will add a link here. TL;DR API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend. This includes cross-tenant com
Policymakers should resist treating anonymity as something wrong in and of itself, argue Lila Bailey and Tess Vartanian.
bunny.net's Status Page - Security update regarding one of our infrastructure providers.
Jules Verne’s lost novel got the machines of 1960 right. He never imagined that Paris would keep its poets
Welcome to Organization for Transformative Works's home for real-time and historical data on system performance.
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
Procedurally generated Delft-blue floral page margins for LuaLaTeX, drawn in Lua - kevinraymond/florilegium
An NES CPU compiled into the weights of a stock Qwen3.5 model - dbreunig/nesformer
knock on wood is an internet-connected device that lets users perform the superstition remotely when no wood is nearby.
When AI handles 95% of your incident response, do you get worse at handling the 5% that actually matters?
'We have been at the edge of the ice. We have seen it happening. And we are witnesses to a rapidly changing archaeological landscape,' write the glacial archaeologists. Finds from the Viking Age are becoming scarce, while 6,000-year-old arrowheads are now emerging from the melting ice.
A journey to understand how a real-estate agent in the Philippines became the target of a criminal mastermind.
Preparing to play a petty thief in a new movie, John Turturro learned the moves—“reefing the kick” among them—from Apollo Robbins, and observed how much stealing has in common with acting. Michael Schulman reports.
Building an AI-native engineering org
Patrick Stewart's most famous character showed a generation of youth a complex character who strived to do what was right.