Published Soursen pieces tagged security, with the standfirst, the beat and the day the piece went up. Every fact is checked against the source.
Security
A fake captcha got one employee to paste a command into their own terminal, and that opened the door to 2 Senate departments. The attack is a warning about a social engineering trick that is spreading. The bigger lesson is what Berlin did after it noticed.
Security
CVE-2026–98432 is a 10 year old Linux TCP flaw that an AI model turned into a remote root exploit. Volunteer led distributions shipped the fix fast. Canonical, which sells security subscriptions, finally responded on 3 November, with a patch that sits in a testing channel and needs manual steps to apply. The delay is one problem. The shape of the response is another.
Security
In October 2026 a major security firm posted 6 Linux kernel vulnerabilities, 2 of them rated 9.0, straight to the public mailing list with no fixes attached. The maintainers were furious. The real story is that responsible disclosure may be breaking down for open source, and AI is the reason.
Security
CVE-2026–98432 is a use after free flaw in the Linux kernel’s TCP code, rated 9.8 out of 10, that can hand a remote attacker root on a server running multipath TCP. What makes it different from the usual critical CVE is who found it. An unreleased internal AI model at Anthropic spotted the bug, then built a working root exploit in about 53 minutes. I went through what the flaw is, who is patched, and why the AI part changes the math for defenders.
Security
On 13 October 2026 an account mass uploaded a pile of packages to the Arch User Repository that looked like the popular helper yay and ran code the attacker controlled as root the moment you installed them. It was the fourth malware wave on the AUR in about 15 months. I went through what actually happened, how the trick worked at the file level, and why the obvious fix is the one thing that would stop the AUR from being the AUR.
Security
In October 2026, Mozilla and Google confirmed that 8 intermediate signing keys from eMudhra, 1 of the few Indian certificate authorities trusted globally, had private keys a laptop can guess in under a second, including 1 that was literally the integer 4. I went through how a secret that should be 116 digits long collapsed to single digits, how browsers shut it down in under 3 hours, why your backend servers may still be exposed, and why, for a certificate authority, the incident is survivable but the response decides everything.
Linux & open source
The phone in your hand depends on a time zone file one UCLA lecturer updates in his spare time, a compression library written by the man who ran a Mars rover, and a shell whose entire public history is 1 person’s commits. I went through the real names, dates, and funding numbers behind the software holding up modern computing, because the gap between how much we lean on these projects and how little we pay for them is worse than the famous cartoon makes it look.