All Posts

The Scene

The Bait

36 Days of Free Reign

The Coincidence That Isn't

CVE-2026-33017: One HTTP Request. No Auth. Full RCE. And Your AI Pipeline Keys. March 17, 2026. A critical vulnerability is disclosed in Langflow — the open-source visual builder for LangChain AI agents. CVSS 9.3. Twenty hours later, attackers are already inside production instances. No proof-of-concept existed yet. They built working exploits from the advisory text alone. What Langflow Is Langflow is the drag-and-drop interface for building AI agent pipelines. LangChain unde

How Interlock Ransomware Owned Enterprise Firewalls Before Anyone Knew January 26, 2026. A ransomware gang called Interlock starts exploiting a vulnerability in Cisco Secure Firewall Management Center. CVSS score: 10.0. The maximum. Unauthenticated. Remote. Root access. Cisco doesn't know yet. Their customers don't know yet. For 36 days, every Cisco FMC instance facing the internet is a door with no lock. What CVE-2026-20131 Actually Does Insecure deserialization of user-supp

Wiz sold "visibility" to Google for $32 billion. They meant inward. We mean outward. Only one stops the bullet. "Visibility equals security." That's the pitch. Wiz, CrowdStrike, Palo Alto, every vendor at RSA for the last five years. If you can see it, you can secure it. Dashboard everything. Alert on everything. Visualize your attack surface and the threats will reveal themselves. They're not wrong. They're just looking the wrong direction. The Inward Gaze Wiz looks inward.

We followed the Handala wiper network. It led to 120 offensive AI skills, MANPADS documentation, and the biggest collection node we've ever seen. Two weeks ago we found Iran's Handala wiper masquerading as a CrowdStrike update on GitHub. The repo was published by an account called MrDomainAdmin — 20 repos, zero followers, no bio. A ghost. Today we followed the followers. The Network MrDomainAdmin has 7 followers. One of them is killvxk. killvxk has 14,220 public repositories.

A single-file Cloudflare Worker that blocks known malicious IPs, trolls scanners, and tells you who's visiting — powered by our STIX feed. We built something for ourselves and decided to give it away. The Problem Your firewall rules are static. Your threat intel updates daily — maybe. And between the moment a new IOC is published and the moment it reaches your infrastructure, attackers have a window. That window is where breaches happen. What Edge Shield Does DugganUSA Edge S

The $100B consulting firm that charges $500K for strategic analysis couldn't parameterize a SQL query. On February 28, 2026, security startup CodeWall deployed an autonomous AI agent against McKinsey's internal AI platform, Lilli. No credentials. No human intervention. Within two hours, the agent had full read-write access to the database. What it found: 46.5 million plaintext chat messages 728,000 files (192K PDFs, 93K spreadsheets) 57,000 employee accounts 384,000 AI assi

433 compromised packages. A zombie ransomware group. Invisible Unicode malware. Happy March 18th. While half the internet was recovering from St. Patrick's Day, the other half was getting owned. Here's what dropped in the last 72 hours — and what we indexed before your coffee was ready. GlassWorm: The Supply Chain Attack You Can't See GlassWorm is back. And this time, it brought friends. Between March 3rd and 12th, attackers compromised 151+ GitHub repositories, npm packages,