Breaking the open web won't stop the bad bots

Policymakers should resist treating anonymity as something wrong in and of itself, argue Lila Bailey and Tess Vartanian.

Anthropic may not secure investment-grade rating after IPO, Blackstone says

Bunny CDN Security Incident

bunny.net's Status Page - Security update regarding one of our infrastructure providers.

Archive of our own (AO3) hacked

Welcome to Organization for Transformative Works's home for real-time and historical data on system performance.

Jules Verne's Lost Novel

Jules Verne’s lost novel got the machines of 1960 right. He never imagined that Paris would keep its poets

My favourite PowerMac is a Nintendo Wii

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …

The federated code forge

Northflank Breached

Northflank Status

Show HN: A working Nintendo in ~1GB of Qwen weights

An NES CPU compiled into the weights of a stock Qwen3.5 model - dbreunig/nesformer

Florilegium: Procedural Flowers in LaTeX

Procedurally generated Delft-blue floral page margins for LuaLaTeX, drawn in Lua - kevinraymond/florilegium

The oldest ice disappears and the Stone Age emerges from it

'We have been at the edge of the ice. We have seen it happening. And we are witnesses to a rapidly changing archaeological landscape,' write the glacial archaeologists. Finds from the Viking Age are becoming scarce, while 6,000-year-old arrowheads are now emerging from the melting ice.

Azure's Weakest Link – Five Full Cross-Tenant Compromises

In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back with some more vulnerabilities in this system, each giving the same primitives to the attacker. In total, the vulnerabilities here netted me a cool $200,000. I also held a talk detailing this at Blue Hat Asia 2026, and when the recordings are out, I will add a link here. TL;DR API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend. This includes cross-tenant com

Tree-mounted machines connect to web app to let users knock on wood remotely

knock on wood is an internet-connected device that lets users perform the superstition remotely when no wood is nearby.

AI isn't replacing SREs, it's deskilling them

When AI handles 95% of your incident response, do you get worse at handling the 5% that actually matters?

An Arrogant Way of Killing (2016)

A journey to understand how a real-estate agent in the Philippines became the target of a criminal mastermind.

Infinite Mac: BeOS

A Pickpocket's Guide to New York

Preparing to play a petty thief in a new movie, John Turturro learned the moves—“reefing the kick” among them—from Apollo Robbins, and observed how much stealing has in common with acting. Michael Schulman reports.

Building an AI-native engineering org

Building an AI-native engineering org

Through Captain Jean-Luc Picard, Patrick Stewart taught us the measure of a man

Patrick Stewart's most famous character showed a generation of youth a complex character who strived to do what was right.