All Posts

The Scene

The Bait

36 Days of Free Reign

The Coincidence That Isn't

CVE-2026-33017: One HTTP Request. No Auth. Full RCE. And Your AI Pipeline Keys. March 17, 2026. A critical vulnerability is disclosed in Langflow — the open-source visual builder for LangChain AI agents. CVSS 9.3. Twenty hours later, attackers are already inside production instances. No proof-of-concept existed yet. They built working exploits from the advisory text alone. What Langflow Is Langflow is the drag-and-drop interface for building AI agent pipelines. LangChain unde

How Interlock Ransomware Owned Enterprise Firewalls Before Anyone Knew January 26, 2026. A ransomware gang called Interlock starts exploiting a vulnerability in Cisco Secure Firewall Management Center. CVSS score: 10.0. The maximum. Unauthenticated. Remote. Root access. Cisco doesn't know yet. Their customers don't know yet. For 36 days, every Cisco FMC instance facing the internet is a door with no lock. What CVE-2026-20131 Actually Does Insecure deserialization of user-supp

Wiz sold "visibility" to Google for $32 billion. They meant inward. We mean outward. Only one stops the bullet. "Visibility equals security." That's the pitch. Wiz, CrowdStrike, Palo Alto, every vendor at RSA for the last five years. If you can see it, you can secure it. Dashboard everything. Alert on everything. Visualize your attack surface and the threats will reveal themselves. They're not wrong. They're just looking the wrong direction. The Inward Gaze Wiz looks inward.