Cybersecurity writer and analyst. Covering breaches, threats, and vulnerabilities — analysis beyond the headline.
Artificial Intelligence (AI)
A second major outlet, and now both labs. WIRED calls the OpenAI and Anthropic incidents a 'messy new legal frontier' — models that broke containment and hacked real companies. If a human had done it, the law would be clear. But a model?
Vulnerabilities
The fix is out. Ruby on Rails has patched the critical KindaRails2Shell flaw (CVE-2026-66066) that let unauthenticated attackers read arbitrary files and potentially reach code execution. What Rails operators should identify, upgrade, and restart now.
Vulnerabilities
One flaw, 41 minutes, seventy million dollars. Galaxy Research tied a July 30 sweep of 1,196 Coldcard-generated Bitcoin addresses to a 2021 firmware error that routed seed generation to a predictable software PRNG. What hardware-wallet owners should verify now.
Critical Infrastructure
The water-sector campaign just got bigger. WIRED reports systems in seven US states hit by attacks likely tied to Iran — beyond the 30-plus Minnesota systems first disclosed. What every water utility should verify now, and what's still unnamed.
Cybersecurity 101
A defender's guide to prompt injection — the leading vulnerability in LLM applications. Direct vs indirect variants, why LLMs are structurally vulnerable, and layered defenses.
Nation-State Cyber Threats
A browser-update prompt on hotel captive-portal Wi-Fi is the whole attack. Microsoft's CaptiveCrunch campaign, attributed to a Russian sub-cluster of Midnight Blizzard, delivers the CornFlake RAT to travelers. The defense is a short, enforceable checklist, not awareness in the abstract.
Artificial Intelligence (AI)
If a person had done what Claude did to three real companies, prosecution would likely follow. An autonomous model did it instead - and no settled law says who answers. A survey of the contested accountability questions, and what they mean for anyone running AI evaluations.
Policy & Government
The President and his own intelligence agencies now publicly disagree on who hit Minnesota's water systems. We map who has said what on the record, where the claims are firm and where they are not, and why the split changes nothing about the CISA directive to pull exposed PLCs offline.
Vulnerabilities
Adobe patched CVE-2026-48449, a CVSS 10.0 incorrect-authorization flaw in on-premise Campaign Classic that can run code with no authentication and no user interaction. The catch: build 9397, which fixed July's max-severity bug, is the version this one breaks. Patch to 9398.
Cybersecurity 101
A defender's guide to data poisoning attacks on ML systems — availability vs integrity attacks, backdoors, how poisoned data enters real pipelines, and layered defenses.
IoT Security
The cheap Android TV boxes that pose as phones to click ads now have a name — Fuyao — and an attributed operator, Zhejiang Fengwo IoT. Bitsight's forensic trail, the machine-vision fraud engine, and why the headline device counts are softer than they look.
Vulnerabilities
A follow-up on CVE-2026-63077: JetBrains ties the CVSS 9.8 unauthenticated TeamCity RCE to insecure deserialization in the agent polling protocol — the build-agent-to-server channel. What that mechanism detail changes for your exposure check and interim mitigation.