Code anatomy
OpenSSH’s three-line equality loop and the limits of timing safety
An analysis of what a comparison accumulator proves, what compilation can change, and which assumptions its caller must preserve.
Cybersecurity, decoded.
AI-assisted analysis. Primary sources. Practical defenses.
Field notes
Field notes: LiteLLM startup compromise, crypto-bigint timing risks, and VeloCloud SQL injection
Three separate reports inform a practical examination of execution boundaries, evidence quality, and response decisions.
Incident anatomy
When test data became a build step.
An exact fragment of the compromised XZ release macro, an inspectable byte-level model, and the boundary where build data became instructions.
Incident anatomy
The flag that outlived the data.
Three lines from Dirty Pipe’s original exploit PoC drain a pipe. A live bit-level model shows why security-relevant state can survive—and how initialization breaks the chain.
Code & binaries
Why Linux hides a number from its compiler.
Three lines connect compiler proofs, transient execution, and a security assumption ordinary bounds checks cannot express. Read the mask—and the limits of the mask.
AI security
When a security verdict needs a third value.
A five-line Microsoft PyRIT helper preserves “undetermined.” The hard part is keeping that meaning intact all the way to a release decision.
Code & binaries
The same loader. A different authority.
Inside a public NIST/NSA training case, the loader call barely changes. The security decision lives upstream—in who gets to choose the code.
Rust & systems
Memory safe. Boundary broken.
Three innocent lines in a Rust archive library explain why memory safety is only the beginning of a security argument.
AI security
Your AI found a bug. Where is the witness?
Google’s PageBreak puts the spotlight on a less glamorous breakthrough: a finding has to survive a test outside the model.
AI security
The prompt is not the permission slip.
Why an agent reading a webpage should not inherit that page’s ambitions—and how to put the boundary in code.
Rust & systems
The request that never finishes.
A Rust HTTP/2 lesson in resource exhaustion: memory can be safe while the CPU is very busy doing nothing useful.
Rust & systems
Two parsers. One very bad assumption.
Rust’s Windows batch-file advisory shows why “passed as an argument” is not a universal property of a string.
Code & binaries
The bit that fell off.
From an eight-bit sum to a C allocation: how arithmetic quietly changes the size of a security boundary.
Blockchain security
Bybit: three signatures, one shared blind spot
A multisignature wallet can distribute keys while concentrating the meaning of a transaction in one compromised screen.
Blockchain security
Nomad: when “never seen” became “already trusted”
The dangerous value was not an exotic opcode. It was the default value returned when a proof was missing.
Blockchain security
Sushi RouteProcessor2: an approval outlived its purpose
A router’s authority comes from yesterday’s token approvals as well as today’s route. That changes both exploit impact and emergency response.