Security covers vulnerabilities and the software supply chain, checked against the advisory or the incident report that records what failed.
Security
A permission shortcut saves the exact command you approved, password included, into a project file that often gets committed. The bigger lesson is that AI coding agents have created new places for secrets to hide, and the usual scanners are not looking there.
Security
An AI pipeline found, proved and drafted fixes for 948 kernel bugs at about $1,279 each. Finding them was the cheap part. The bigger lesson is who now has to fix them, and how fast.
Security
A fake captcha got one employee to paste a command into their own terminal, and that opened the door to 2 Senate departments. The attack is a warning about a social engineering trick that is spreading. The bigger lesson is what Berlin did after it noticed.
Security
CVE-2026–98432 is a 10 year old Linux TCP flaw that an AI model turned into a remote root exploit. Volunteer led distributions shipped the fix fast. Canonical, which sells security subscriptions, finally responded on 3 November, with a patch that sits in a testing channel and needs manual steps to apply. The delay is one problem. The shape of the response is another.
Security
In October 2026 a major security firm posted 6 Linux kernel vulnerabilities, 2 of them rated 9.0, straight to the public mailing list with no fixes attached. The maintainers were furious. The real story is that responsible disclosure may be breaking down for open source, and AI is the reason.
Security
Playwright bundles its own Chromium that lags Chrome stable, and it launches with the sandbox off by default. For a human running tests that is a small risk. For an AI coding agent browsing the open web on your laptop, it is a bigger one. The fix takes 2 settings.
Security
CVE-2026–98432 is a use after free flaw in the Linux kernel’s TCP code, rated 9.8 out of 10, that can hand a remote attacker root on a server running multipath TCP. What makes it different from the usual critical CVE is who found it. An unreleased internal AI model at Anthropic spotted the bug, then built a working root exploit in about 53 minutes. I went through what the flaw is, who is patched, and why the AI part changes the math for defenders.
Security
Proton, the encrypted email company that sells itself on taking security seriously, had its CEO tell an employee that asking for a few days of security testing before shipping AI written code was “bullshit and loser thinking,” according to 404 Media. The CTO says about 90% of Proton’s code is now written by AI. I think the story matters less for what Proton did and more for the exact contradiction it exposes.
Security
On 29 October 2026 attackers drained roughly $6.3 billion from Binance hot wallets in about 20 minutes, 4 times the size of the previous record. The way in was a compromised engineer’s laptop, and the clever part was a new Ethereum feature called EIP-7702 that let them turn a hot wallet into an automatic sweeper. I went through how it happened, how much got frozen, and why this did not break crypto the way it would have a few years ago.
Security
In October 2026 Microsoft quietly killed the last easy way to set up Windows 11 without a Microsoft account, after spending 2025 blocking the rest. I went through exactly which bypasses are gone, what still works, and why a new feature called the Windows age API, that reports whether you are a child, a teen, or an adult, is the piece that ties it all together. None of this requires a conspiracy to explain, the mechanism is on the record.