ChatGPT share-link account takeover: the postMessage bug, and how to secure your own listeners
How a ChatGPT share link ran code as chatgpt.com through MathLive's postMessage listener, and the listener, iframe and CSP fixes for your own app.
System architecture
Data models, migrations and the decisions that are expensive to reverse.
System architecture articles
Northflank breach: what to rotate first, and how to check whether your AI keys were abused
Northflank says assume every environment variable was decrypted. What to rotate first, how to spot abused AI keys in CloudTrail, and how to scope the next one.
Binance $6.3B hack explained: how EIP-7702 delegation emptied a hot wallet, and how to guard your signer
How 50 pre-signed EIP-7702 authorizations emptied a Binance hot wallet, what Binance has said, and the signer checks that would have refused them.
KV cache leak on Cloudflare Workers AI: how an SGLang bug served other users' data, and how to check your stack
How a KV pool smaller than GLM-5.3's context and an SGLang bug leaked users' data on Workers AI, and how to harden PD serving.
Android SMS of Death: how one WAP Push text crashes the phone process, and the patch Google calls won't fix
How the SMS of Death WAP Push bug crashes com.android.phone, why it loops for days, what the AOSP fix changes, and how to check your patch level.
Stalwart 1.0 mail server: what's new, the benchmarks, and how to upgrade from 0.16
Stalwart 1.0 is out: what's new, how its benchmarks against Postfix and Dovecot hold up, and how to migrate from 0.16 with stalwart-migrate.
OpenSSL 4.1.0 released: DTLS 1.3, GREASE, and what breaks when you upgrade
OpenSSL 4.1.0 adds DTLS 1.3 and GREASE and drops the CN fallback in host-name checks. What breaks, how to test it, and which version to run.
eMudhra's weak CA keys: why emSign ECC Root CA - G3 is distrusted, and how to replace affected certificates
eMudhra's CA keys were numbers below 256. Why that breaks P-384, what the emSign ECC G3 distrust breaks, and how to replace affected certificates.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): which PHP servers are exposed and how to patch today
PHP2Shell is two pre-auth RCE bugs in PHP itself. Which versions fix them, which servers are most exposed, and what to set if you cannot update today.
OpenCode Console breach: which API keys were exposed, and how to rotate them without an outage
What the OpenCode Console breach exposed, who is affected, and a safe order for rotating OpenAI, Anthropic and Google API keys.
NIST P-256 seed origin solved: how lrand48 and a 1997 timestamp made the ECDSA curves, and what it means for you
The NIST P-256 seed came from lrand48 and a 1997 timestamp. Rebuild it in Python and C, and see what it means for the ECDSA keys you use.
Microsoft's record October 2026 Patch Tuesday: how to triage 1,400 CVEs with exploit status, risk cohorts and VEX
October's Patch Tuesday fixed about 1,400 CVEs. A triage order, what risk cohorts miss, VEX, and a script that sorts the release.
Supermarket fridge hack: how exposed Danfoss controllers were pushed to 50°C, and how to find yours
How the French supermarket fridge attack reached Danfoss controllers, what the known CVEs allow, and how to find and close the same exposure.