Browsing Tag

AI vulnerability research

4 posts

Your AI Answer in a Stranger’s Session: Cloudflare’s KV Cache Leak and the AI Spam Drowning Bug Hunters

A wall of white post office boxes in a bright hall; a blank sheet of paper slides out of one open box into its neighbour
Cloudflare’s hosted GLM-5.3 model returned 155 responses containing other customers’ data after a memory-pool misconfiguration met an SGLang bug. Meanwhile, AI-written bug reports flood security teams: Firedancer now charges 1 SOL per report. What happened, what a KV cache is, what the reports leave open, and what companies and users should do.
View Post

CVEs Are Going to the Moon: What the Data Shows About AI, Bug Hunters and the Patch Gap

A steep white staircase of server blades rising toward a pale full moon in a bright blue daytime sky
New CVE records have tripled: 13,934 from 1 to 25 October 2026 versus 4,389 in all of October 2025. I pulled the raw NVD, CVE.org and CISA data: the curve is steep but not parabolic, most of the flood comes from defenders, and only 1.4% of records credit an AI lab. The real risk is the patch gap. Plus the lockpicks debate, OpenAI’s containment post, and what companies and users should do.
View Post

Broccoli2Shell: One Compression Bug Reaches Node.js, Python and Beyond. What to Patch, Restart and Check

A fresh broccoli floret resting on a white network server in a bright data center, turquoise cables plugged in behind it
A flaw in Google’s Brotli decoder (CVE-2026-111497, CVSS 9.2) reaches Node.js, Python’s Brotli packages, Bun, Envoy, .NET and dozens of bundled copies. The fix sat unreleased for 236 days. Fixed versions, how exploitable it really is, what OpenAI’s agent red-teaming had to do with it, the separate DreamHost password resets, and what companies and users should do now.
View Post

The 22-Year Road to PHP2Shell: How AI-Assisted Review Finished an Old Story

Comic illustration: a researcher in a white hoodie stands beside a server rack and a faceted geometric blue elephant, while a glowing turquoise thread runs from an old archive box to a small turquoise shield
PHP2Shell was fixed on October 21, 2026, but the story starts with a 2004 advisory about unsafe interruptions. An illustrated retelling, inspired by Calif’s php2shell comic: how Calif, OpenAI and Wiz used frontier AI models to finish a 22-year-old line of research, what half-built data and stale state mean, who contributed what, and what AI changed and did not change.
View Post