<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[DugganUSA LLC]]></title><description><![CDATA[DugganUSA LLC builds connective AI and threat intelligence tools from Minnesota. MEDUA Suite of AI Security FDA 510(k) ready. D-U-N-S:
  14-363-3562]]></description><link>https://www.dugganusa.com/blog</link><generator>RSS for Node</generator><lastBuildDate>Sat, 11 Apr 2026 17:45:50 GMT</lastBuildDate><atom:link href="https://www.dugganusa.com/blog-feed.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[Q2 2026 State of AI Brand Perception in Cybersecurity: The Report Is Out. We Named Names.]]></title><description><![CDATA[Download the full PDF:  Q2 2026 State of AI Brand Perception in Cybersecurity (14 pages) Fifteen vendors. Five AI models. Seventy-five audits. One afternoon. That is the corpus behind our first quarterly report on AI Brand Perception in Cybersecurity, published today. We built a product called AIPM — AI Presence Management — that queries the five largest commercial AI models in parallel about a given brand and grades the answers. It lives at aipmsec.com. We have been running it against...]]></description><link>https://www.dugganusa.com/post/q2-2026-state-of-ai-brand-perception-in-cybersecurity-the-report-is-out-we-named-names</link><guid isPermaLink="false">69da87278614fb4128ae872a</guid><category><![CDATA[Security Tips]]></category><pubDate>Sat, 11 Apr 2026 17:38:48 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_c32df5f2e0f04902993789198cb04e06~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[OpenAI Still Thinks CrowdStrike Is In Sunnyvale. Six Things Your AI Chatbot Is Telling Buyers That Aren't True.]]></title><description><![CDATA[I asked OpenAI GPT-4o where CrowdStrike is headquartered this afternoon. It told me, with complete confidence and no hedging: "CrowdStrike was founded by George Kurtz, Dmitri Alperovitch, and Gregg Marston in 2011. The company is based in Sunnyvale, California." CrowdStrike officially designated Austin, Texas  as its principal executive office in 2022. That is public information. It is in their annual report. It is on their own investor relations page. A Google search for "crowdstrike...]]></description><link>https://www.dugganusa.com/post/openai-still-thinks-crowdstrike-is-in-sunnyvale-six-things-your-ai-chatbot-is-telling-buyers-that-a</link><guid isPermaLink="false">69da8174a437370fa490cf60</guid><category><![CDATA[Security Tips]]></category><pubDate>Sat, 11 Apr 2026 17:14:29 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_56dc8cd6f24042219fc2e31fc1a3d649~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[We Audited Our Own AI Presence. Gemini Said We're Three Different Companies.]]></title><description><![CDATA[We build a product called AIPM — AI Presence Management. It audits how the five major AI models perceive a given brand, and scores the results. 776 domains have been through it as of this morning. Today, for the first time, we pointed it at ourselves — all three of our properties — and the result was, as my father would say, instructive . Here's what Google's Gemini 2.5 Flash knows about DugganUSA LLC and its subdomains. All three queries on the same afternoon. All three answered by the same...]]></description><link>https://www.dugganusa.com/post/we-audited-our-own-ai-presence-gemini-said-we-re-three-different-companies</link><guid isPermaLink="false">69da7d4ef955c1c9662674e1</guid><category><![CDATA[Security Tips]]></category><pubDate>Sat, 11 Apr 2026 16:56:47 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_4c8cb1f9560448b7930bc40a6ba045b2~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[The $75 HAT That Outruns a $500 Jetson]]></title><description><![CDATA[DugganUSA lab notebook — April 10, 2026 Here's the number that made me open a text editor at 1 AM: 309 frames per second of YOLOv8s object detection at 640×640, running on a Raspberry Pi 5 with a Hailo-8 AI HAT+. For context: NVIDIA's reference benchmark for YOLOv8s at the same resolution on a Jetson Orin Nano 8GB is around 60 FPS in FP16. The Hailo-8, at INT8, on a HAT that costs one-seventh of that Jetson, delivered five times  the throughput tonight. End to end — including the non-max...]]></description><link>https://www.dugganusa.com/post/the-75-hat-that-outruns-a-500-jetson</link><guid isPermaLink="false">69d9c202515c02011a0d6315</guid><category><![CDATA[Security Tips]]></category><pubDate>Sat, 11 Apr 2026 03:37:39 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_98afd79d35834cdeb9625927adf68814~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Friday Threat Brief: WordPress Plugin Ships a RAT, Storm-2755 Redirects Your Paycheck, Iran Targets American PLCs]]></title><description><![CDATA[Six things you need to know before the weekend.]]></description><link>https://www.dugganusa.com/post/friday-threat-brief-wordpress-plugin-ships-a-rat-storm-2755-redirects-your-paycheck-iran-targets</link><guid isPermaLink="false">69d99b15515c02011a0d0ded</guid><pubDate>Sat, 11 Apr 2026 00:52:05 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_ac824b9508e94387a346b1a70ee4fbe5~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Two Guys, One LLC, 46 Countries. How We Built a Global Security Operation on $75 a Month.]]></title><description><![CDATA[DugganUSA LLC was filed in Minnesota on December 1, 2025. We have two people. Our Azure bill is about $75 a month. We have no office, no investors, no...]]></description><link>https://www.dugganusa.com/post/two-guys-one-llc-46-countries-how-we-built-a-global-security-operation-on-75-a-month</link><guid isPermaLink="false">69d91db675afb0779a6f4f6a</guid><pubDate>Fri, 10 Apr 2026 15:57:15 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_15becfa9c4b44c92b804172fc96dbbed~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Same Threat Intel. Fair Price. We Just Launched Regional Pricing for 80+ Countries.]]></title><description><![CDATA[A security analyst in Lagos should not pay the same price as a security analyst in New York.]]></description><link>https://www.dugganusa.com/post/same-threat-intel-fair-price-we-just-launched-regional-pricing-for-80-countries</link><guid isPermaLink="false">69d9142ef6703ec22bea44d3</guid><pubDate>Fri, 10 Apr 2026 15:16:25 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_9b1c730fb1194736ba6c19ecaa4a2d78~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Your Website Is Talking to AI Models Behind Your Back. We Built the Scanner That Catches It.]]></title><description><![CDATA[There's a new class of attack that no one is scanning for. It doesn't target your servers. It doesn't target your users. It targets the AI models that read...]]></description><link>https://www.dugganusa.com/post/your-website-is-talking-to-ai-models-behind-your-back-we-built-the-scanner-that-catches-it</link><guid isPermaLink="false">69d9102bf6703ec22bea3b6f</guid><pubDate>Fri, 10 Apr 2026 14:59:16 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_a1d165afa5534b2282dff8b134d038a6~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[The GitHub Accounts Starring Rootkits AND AI Prompt Injection Tools. That's Not Research.]]></title><description><![CDATA[A vulnerability called CamoLeak let attackers steal API keys and private source code from GitHub Copilot. The attack was elegant: hide instructions in a...]]></description><link>https://www.dugganusa.com/post/the-github-accounts-starring-rootkits-and-ai-prompt-injection-tools-that-s-not-research</link><guid isPermaLink="false">69d9010846e8409f60b0dfb8</guid><pubDate>Fri, 10 Apr 2026 13:54:45 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_b00dd81423b444f99c4777fb0e77ada1~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[The Bitcoin Ouroboros: From Epstein's Emails to Iran's Toll Booth at the Strait of Hormuz]]></title><description><![CDATA[The snake eats its tail. In January 2014, Jeffrey Epstein emailed two messages three days apart. On January 19, he pitched "a Russian version of bitcoin" to Putin's orbit through Thorbjorn Jagland at the Council of Europe. On January 22, he told Reid Hoffman about "inquiries from interesting people regarding bitcoin-type currency." In July 2014, he sent Peter Thiel a substantive Bitcoin analysis discussing "store of value" and "intrinsic value." In October 2017, the co-founders of Blockstream...]]></description><link>https://www.dugganusa.com/post/the-bitcoin-ouroboros-from-epstein-s-emails-to-iran-s-toll-booth-at-the-strait-of-hormuz</link><guid isPermaLink="false">69d7e8b7a51db32c14c33673</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 17:58:15 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_18cb100c08f5438a8325d2e77e534769~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Dear French Hackers: You Are Overpaying. Here's How to Scan Us for Free.]]></title><description><![CDATA[To the operators at BUCKLOG SARL (AS211590) who have been hammering our Epstein search portal 6,000 times a day since April 4: You are running Kubernetes. GreyNoise documented your cluster in February. You are paying for managed Kubernetes in a French data center to scan a platform that runs on roughly $550 a month. We would like to help you reduce your costs. Your Architecture (Estimated) Based on the GreyNoise report and your traffic patterns, you are running something like this: Managed...]]></description><link>https://www.dugganusa.com/post/dear-french-hackers-you-are-overpaying-here-s-how-to-scan-us-for-free</link><guid isPermaLink="false">69d7d4684e4fe2e3f72a80c2</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 16:31:36 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_16d3c06f38204141b7ffa8304b0d1fd1~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Someone in Paris Is Hammering Our Epstein Search Portal 6,000 Times a Day. Cloudflare Says No.]]></title><description><![CDATA[On April 3, 2026, we received 588 requests from France. 44 were flagged as threats. Normal day. Normal ratio. On April 4, we received 4,779 requests from France. 3,490 were threats. That is a 73% threat ratio — overnight. It has not stopped. April 5: 5,436 requests, 4,096 threats (75%). April 6: 4,376 requests, 3,471 threats (79%). April 7: a brief dip to 48%. April 8: 8,006 requests, 6,313 threats (79%). April 9 as of this writing: 4,793 requests, 3,809 threats (79%). Something turned on...]]></description><link>https://www.dugganusa.com/post/someone-in-paris-is-hammering-our-epstein-search-portal-6-000-times-a-day-cloudflare-says-no</link><guid isPermaLink="false">69d7d1ff646a4e908b718948</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 16:21:20 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_bf462818f3394906a36a24f18a21cb28~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Ride or Die: Anthropic Broke the Deal]]></title><description><![CDATA[I am writing this blog post using Claude. The irony is not lost on me. It might be the last time. I have been an Anthropic customer since the early days. Claude Max subscriber. $200 a month. I built my company's entire threat intelligence operation with Claude as the engine. Not as a tool — as a partner. I said "ride or die" and I meant it. We co-authored patents together. We built a STIX feed that Microsoft and AT&#38;T pull daily. We indexed a million IOCs. We wrote 1,641 blog posts. We...]]></description><link>https://www.dugganusa.com/post/ride-or-die-anthropic-broke-the-deal</link><guid isPermaLink="false">69d7bd411eecefd11ca1a974</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 14:52:49 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_c5f9f578284b4cb8b13262497ea5b370~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Who Got Pwned Overnight: Fortinet Deadline Today, Sedgwick Update, and 1,700 Poisoned Packages]]></title><description><![CDATA[This is your morning sweep. Everything that matters from overnight. IOCs at the bottom. Free STIX feed link at the bottom. If your SIEM pulled our feed last night, some of these were already blocked before you read this sentence. If it didn't — keep reading. CISA Deadline: Today. Right Now. CVE-2026-35616 — Fortinet FortiClient EMS. Pre-authentication API access bypass leading to privilege escalation. CVSS 9.1. CISA added it to the KEV catalog on April 6 and gave federal agencies until today...]]></description><link>https://www.dugganusa.com/post/who-got-pwned-overnight-fortinet-deadline-today-sedgwick-update-and-1-700-poisoned-packages</link><guid isPermaLink="false">69d7b2abfc7a52acb90a1382</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 14:07:40 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_97d8996b8ac24ee694e237b708399111~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Three Langflow CVEs in Two Weeks. CISA Says Active Exploitation. We Have the IPs.]]></title><description><![CDATA[Langflow is the visual builder for LangChain agents. It's how a lot of teams stand up AI workflows without writing the orchestration code themselves. It's also, as of tonight, sitting on three critical CVEs in two weeks  — and CISA is warning about active exploitation on one of them. We have six active exploiter IPs in our index. Two of them are running custom exploits with stage-2 droppers. One is harvesting credentials. The other four are running nuclei against everything that responds. If...]]></description><link>https://www.dugganusa.com/post/three-langflow-cves-in-two-weeks-cisa-says-active-exploitation-we-have-the-ips</link><guid isPermaLink="false">69d725850b7119100dffc7c6</guid><category><![CDATA[Security Tips]]></category><pubDate>Thu, 09 Apr 2026 04:05:26 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_8cda323cae4348ec8655df1a14e56baa~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Snakes on a Worker, Part 2: I Just Curled Live Crypto Wallet Phishing on Cloudflare Pages and GitHub Pages. Same Allowlist, More Platforms, Different Wallets.]]></title><description><![CDATA[I published Pattern 49 four hours ago. The post named Cloudflare Workers, Cloudflare R2, IPFS, AWS CloudFront, and GitHub Pages as the platform-native...]]></description><link>https://www.dugganusa.com/post/snakes-on-a-worker-part-2-i-just-curled-live-crypto-wallet-phishing-on-cloudflare-pages-and-github</link><guid isPermaLink="false">69d5404010427b2b3149c5b0</guid><pubDate>Tue, 07 Apr 2026 17:35:20 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_808d27ccda724b52bff339c02027fb8f~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Pattern 49 — Snakes on a Worker: AsyncRAT C2 on Cloudflare Workers, Phishing on R2, Persistence on IPFS. Your SIEM Allowlists All Three.]]></title><description><![CDATA[There is an AsyncRAT command and control server running on a Cloudflare Workers account named hrmcxaeel right now. It has at least three deployed workers,...]]></description><link>https://www.dugganusa.com/post/pattern-49-snakes-on-a-worker-asyncrat-c2-on-cloudflare-workers-phishing-on-r2-persistence-on-i</link><guid isPermaLink="false">69d54006fc74251ed3c37c83</guid><pubDate>Tue, 07 Apr 2026 17:34:34 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_864f51d3944c41f582baddb04eaf6a37~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[Pattern 49 Part 2: I Just Curled Live Crypto Wallet Phishing on Cloudflare Pages and GitHub Pages. Same Allowlist, More Platforms, Different Wallets.]]></title><description><![CDATA[I published Pattern 49 four hours ago. The post named Cloudflare Workers, Cloudflare R2, IPFS, AWS CloudFront, and GitHub Pages as the platform-native...]]></description><link>https://www.dugganusa.com/post/pattern-49-part-2-i-just-curled-live-crypto-wallet-phishing-on-cloudflare-pages-and-github-pages-s</link><guid isPermaLink="false">69d526c5b75c5d30582576fe</guid><pubDate>Tue, 07 Apr 2026 15:46:44 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_0b007f3547944d3fbf56aa82bf996caa~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[AsyncRAT Runs Its C2 on Cloudflare Workers. Phishing Lives on R2. Persistence Lives on IPFS. Your SIEM Allowlists All Three.]]></title><description><![CDATA[There is an AsyncRAT command and control server running on a Cloudflare Workers account named hrmcxaeel right now. It has at least three deployed workers,...]]></description><link>https://www.dugganusa.com/post/asyncrat-runs-its-c2-on-cloudflare-workers-phishing-lives-on-r2-persistence-lives-on-ipfs-your-si</link><guid isPermaLink="false">69d5199274eeae096e51287b</guid><pubDate>Tue, 07 Apr 2026 14:50:24 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_21e8c79e8aff4907bdebc279ac3a6aeb~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item><item><title><![CDATA[The CSP That Wasn't Where We Thought It Was: A 23-Minute SRE War Story Across Three Repos]]></title><description><![CDATA[Last night I filed a GitHub issue against pduggusa/security-dugganusa asking the team to harden the Content Security Policy on security.dugganusa.com. The...]]></description><link>https://www.dugganusa.com/post/the-csp-that-wasn-t-where-we-thought-it-was-a-23-minute-sre-war-story-across-three-repos</link><guid isPermaLink="false">69d49136072d140cb95d4eaf</guid><pubDate>Tue, 07 Apr 2026 05:08:31 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/fd5e2b_25935cf8e7834b539d5837b91306ace1~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Patrick Duggan</dc:creator></item></channel></rss>