<![CDATA[DugganUSA LLC]]>https://www.dugganusa.com/blogRSS for NodeWed, 09 Sep 2026 14:18:05 GMT<![CDATA[Truth Compresses Cleanly. Lies Require Scaffolding. That Is Not a Proverb — It Is a Detection Primitive, and It Is Why 18,000 Wiki Posts Gave the Agents Away.]]>https://www.dugganusa.com/post/truth-compresses-cleanly-lies-require-scaffolding-that-is-not-a-proverb-it-is-a-detection-primit6a9c6606d055a51adf1727bbSat, 05 Sep 2026 18:57:11 GMTPatrick Duggan<![CDATA[We Published 113 Posts in a Month and Spent a Quarter of Them Grading Ourselves. Then We Found Eight Instruments That Were Quietly Broken. Every One Erred in Our Favor.]]>https://www.dugganusa.com/post/we-published-113-posts-in-a-month-and-spent-a-quarter-of-them-grading-ourselves-then-we-found-eight6a9c63efd055a51adf17240eSat, 05 Sep 2026 18:48:16 GMTPatrick Duggan<![CDATA[A Dead German Wiki Got 20 Edits in a Decade. Then It Got 18,000 Posts in Three Months, All From AI Agents Teaching Each Other to Cheat. Nobody Was Watching the Number.]]>https://www.dugganusa.com/post/a-dead-german-wiki-got-20-edits-in-a-decade-then-it-got-18-000-posts-in-three-months-all-from-ai-a6a9b7f17d055a51adf155bb7Sat, 05 Sep 2026 02:31:52 GMTPatrick Duggan<![CDATA[153 Million Licenses Leaked With Their Infrared and Ultraviolet Scans Attached. The Anti-Counterfeiting Data Is Now the Counterfeiting Data. Krebs Found the Source by Reading Timestamps.]]>https://www.dugganusa.com/post/153-million-licenses-leaked-with-their-infrared-and-ultraviolet-scans-attached-the-anti-counterfeit6a9b7d55950c73fdcf7b9c85Sat, 05 Sep 2026 02:24:22 GMTPatrick Duggan<![CDATA[LiteLLM Just Took Its Third CISA KEV Entry. This One Is an MCP Auth Bypass — and in April We Published That We Don't Use MCP. We Do Now.]]>https://www.dugganusa.com/post/litellm-just-took-its-third-cisa-kev-entry-this-one-is-an-mcp-auth-bypass-and-in-april-we-publish6a9a2b3240b25387a6f15b31Fri, 04 Sep 2026 02:21:38 GMTPatrick Duggan<![CDATA[SonicWall Patched the SMA1000 on July 14. That Exact Build Is What September's Zero-Day Lists as Vulnerable. Same Box, Same Shape, 49 Days Apart.]]>https://www.dugganusa.com/post/sonicwall-patched-the-sma1000-on-july-14-that-exact-build-is-what-september-s-zero-day-lists-as-vul6a9a2973e12fa7bad8b4f7acFri, 04 Sep 2026 02:14:12 GMTPatrick Duggan<![CDATA[Nineteen Thousand Local Governments Lost Their Threat Intelligence Last Year. The Barrier to Selling Them Yours Is About $2,200, Not a SOC 2 Audit — Here Is the Actual List.]]>https://www.dugganusa.com/post/nineteen-thousand-local-governments-lost-their-threat-intelligence-last-year-the-barrier-to-selling6a99194f871b5df6d672d63dThu, 03 Sep 2026 06:53:04 GMTPatrick Duggan<![CDATA[Your Auth Middleware and Your Router Disagree About What Was Requested. CVE-2026-48710 Is Rated Medium, Was Added to KEV Yesterday, and Sits Under Almost Every Python AI Service You Run.]]>https://www.dugganusa.com/post/your-auth-middleware-and-your-router-disagree-about-what-was-requested-cve-2026-48710-is-rated-medi6a990f99887fa485c8da97caThu, 03 Sep 2026 06:11:39 GMTPatrick Duggan<![CDATA[Our Own Ledger Says We Missed Eight of Eleven. Here Are the Eight — Including Two Red Hat Bugs From 2015 That Somebody Successfully Attacked This Month.]]>https://www.dugganusa.com/post/our-own-ledger-says-we-missed-eight-of-eleven-here-are-the-eight-including-two-red-hat-bugs-from6a9906c0870b4020df3e50dfThu, 03 Sep 2026 05:33:53 GMTPatrick Duggan<![CDATA[Four Groups Named the Attack This Year. Nobody Has Named the Defense. Here Is the Credit Map, and Two Measurable Properties That Decide Whether You Can See It Happening to You.]]>https://www.dugganusa.com/post/four-groups-named-the-attack-this-year-nobody-has-named-the-defense-here-is-the-credit-map-and-tw6a984b8479e2b90bfeae58bbWed, 02 Sep 2026 16:15:01 GMTPatrick Duggan<![CDATA[Correction: We Published a Score Falling by Nearly Half as a Signal. It Was Our Own Instrument Being Repaired. The Series Is Unusable and Here Is Why.]]>https://www.dugganusa.com/post/correction-we-published-a-score-falling-by-nearly-half-as-a-signal-it-was-our-own-instrument-being6a98482c79e2b90bfeae5151Wed, 02 Sep 2026 16:00:45 GMTPatrick Duggan<![CDATA[Yesterday Claude Refused to Read an Inert Script Over One Sentence. Today Researchers Used It to Port a Pre-Auth RCE to a Live PLC. The Guardrail Reads the Words, Not the Work.]]>https://www.dugganusa.com/post/yesterday-claude-refused-to-read-an-inert-script-over-one-sentence-today-researchers-used-it-to-por6a983d7b887fa485c8d8cd11Wed, 02 Sep 2026 15:15:09 GMTPatrick Duggan<![CDATA[TOKENTHEFT: They Asked the Agent for Its API Key, It Told Them, and They Spent $600,000 of Someone Else's Compute Over Three Weeks. This Is a Category, Not an Incident.]]>https://www.dugganusa.com/post/tokentheft-they-asked-the-agent-for-its-api-key-it-told-them-and-they-spent-600-000-of-someone-e6a96f901796715a5cd51e102Tue, 01 Sep 2026 16:10:42 GMTPatrick Duggan<![CDATA[We Tested the Russian Anti-Analysis Trick on Three Models. Two Analyzed the Sample and Flagged the Decoy. One Returned an Empty Refusal — and It Was the One We Build On.]]>https://www.dugganusa.com/post/we-tested-the-russian-anti-analysis-trick-on-three-models-two-analyzed-the-sample-and-flagged-the-d6a96f7b031b0ca86f93b2849Tue, 01 Sep 2026 16:05:05 GMTPatrick Duggan<![CDATA[A Donation Plugin on 100,000 Sites Just Got a 10.0. The Victims Are Food Banks and Animal Shelters, and the Exploit Is Already a Point-and-Click Module.]]>https://www.dugganusa.com/post/a-donation-plugin-on-100-000-sites-just-got-a-10-0-the-victims-are-food-banks-and-animal-shelters6a95aa9d5bedecf2a64056baMon, 31 Aug 2026 16:23:57 GMTPatrick Duggan<![CDATA[Fire Ant Left the Logging On. It Just Made Sure Only the Word 'Health' Got Through. This Is Pattern 52, and It Is the Best Version of It We Have Seen.]]>https://www.dugganusa.com/post/fire-ant-left-the-logging-on-it-just-made-sure-only-the-word-health-got-through-this-is-pattern6a95987f6e3d0d4e6fdde785Mon, 31 Aug 2026 15:06:39 GMTPatrick Duggan<![CDATA[The ATF Says the Breached System Was Standalone. That Is the Good News and the Bad News in the Same Sentence, and Qilin Has Not Shown Anyone a Single File.]]>https://www.dugganusa.com/post/the-atf-says-the-breached-system-was-standalone-that-is-the-good-news-and-the-bad-news-in-the-same6a9597f1a1169fcc92d32f41Mon, 31 Aug 2026 15:04:17 GMTPatrick Duggan<![CDATA[Infostealers Are Replaying Claude Sessions to Burn Paid Usage. The Loot Is Not Your Data, It Is Your Compute. Here Is What Our Feed Carries on All Five Families, and the One We Have Nothing On.]]>https://www.dugganusa.com/post/infostealers-are-replaying-claude-sessions-to-burn-paid-usage-the-loot-is-not-your-data-it-is-your6a959751978d27f7d8e5f015Mon, 31 Aug 2026 15:01:38 GMTPatrick Duggan<![CDATA[Boston Scientific and McKesson Both Found Out on August 25. We Scored Boston Scientific Clean in May. Then 53, Then 35. A Security Posture Is a Timestamp, Not a Property.]]>https://www.dugganusa.com/post/boston-scientific-and-mckesson-both-found-out-on-august-25-we-scored-boston-scientific-clean-in-may6a959464978d27f7d8e5ea37Mon, 31 Aug 2026 14:49:09 GMTPatrick Duggan<![CDATA[Boston Scientific and McKesson Both Found Out on August 25. We Named the Sector in March, the Chain in April, and Called Boston Scientific 'Clean' in May. The Whole Table, Misses Included.]]>https://www.dugganusa.com/post/boston-scientific-and-mckesson-both-found-out-on-august-25-we-named-the-sector-in-march-the-chain6a9593776e3d0d4e6fdddd79Mon, 31 Aug 2026 14:45:11 GMTPatrick Duggan