DEV Community

black box Series' Articles

Back to Sam LABBE's Series
The AI Act went live two months ago. Your agent's logs are still editable.
Cover image for The AI Act went live two months ago. Your agent's logs are still editable.
slabb profile

The AI Act went live two months ago. Your agent's logs are still editable.

#ai #security #python #compliance
7
Comments 6
6 min read
Always-on agents arrived this week. Here's the gate for what they read.
Cover image for Always-on agents arrived this week. Here's the gate for what they read.
slabb profile

Always-on agents arrived this week. Here's the gate for what they read.

#ai #security #python #mcp
1
Comments
4 min read
I attack-tested my agent's seatbelt. Here's what survived.
Cover image for I attack-tested my agent's seatbelt. Here's what survived.
slabb profile

I attack-tested my agent's seatbelt. Here's what survived.

#ai #programming #productivity #shell
6
Comments
5 min read
She used Claude as a diary. The terms of service are now part of the charge.
Cover image for She used Claude as a diary. The terms of service are now part of the charge.
slabb profile

She used Claude as a diary. The terms of service are now part of the charge.

#ai #security #privacy #law
5
Comments 3
5 min read
Docker just shipped the agent wall I wanted. It's off by default.
Cover image for Docker just shipped the agent wall I wanted. It's off by default.

Defaults are policy and the sandbox matters
slabb profile

Docker just shipped the agent wall I wanted. It's off by default.

#ai #docker #security #devops
25
Comments 56
5 min read
Someone anchored 339 billion web pages to Bitcoin. Here's how it works.
Cover image for Someone anchored 339 billion web pages to Bitcoin. Here's how it works.
slabb profile

Someone anchored 339 billion web pages to Bitcoin. Here's how it works.

#security #opensource #data #bitcoin
7
Comments 1
5 min read
One quoted tilde in your .bashrc is an attacker-controlled PATH entry
Cover image for One quoted tilde in your .bashrc is an attacker-controlled PATH entry
slabb profile

One quoted tilde in your .bashrc is an attacker-controlled PATH entry

#security #bash #linux #shell
6
Comments 2
4 min read
Five witnesses and two RIRs: the CAs just discovered custody
Cover image for Five witnesses and two RIRs: the CAs just discovered custody
slabb profile

Five witnesses and two RIRs: the CAs just discovered custody

#security #webdev #dns #devops
9
Comments
5 min read
OpenCode lost the keys that lived in its cloud. The ones on disk were fine.
Cover image for OpenCode lost the keys that lived in its cloud. The ones on disk were fine.

Natural experiment proving local storage security
slabb profile

OpenCode lost the keys that lived in its cloud. The ones on disk were fine.

#security #ai #devtools #api
11
Comments 12
5 min read
The quietest backdoor runs on your own GPU
Cover image for The quietest backdoor runs on your own GPU
slabb profile

The quietest backdoor runs on your own GPU

#security #ai #machinelearning #infosec
7
Comments
5 min read
A 9.2 unauthenticated RCE in PHP: the audit, the patch window, and the offline switch
Cover image for A 9.2 unauthenticated RCE in PHP: the audit, the patch window, and the offline switch
slabb profile

A 9.2 unauthenticated RCE in PHP: the audit, the patch window, and the offline switch

#security #php #webdev #devops
6
Comments
5 min read
Who watches the watcher when the watcher is a file in the repo?
Cover image for Who watches the watcher when the watcher is a file in the repo?

Permissions beat interpretation for repo security
slabb profile

Who watches the watcher when the watcher is a file in the repo?

#security #ai #agents #devops
11
Comments 45
5 min read
php2shell: two critical RCEs in PHP core — lab demo and how to fix CVE-2026-109618 and CVE-2026-109619
Cover image for php2shell: two critical RCEs in PHP core — lab demo and how to fix CVE-2026-109618 and CVE-2026-109619
slabb profile

php2shell: two critical RCEs in PHP core — lab demo and how to fix CVE-2026-109618 and CVE-2026-109619

#security #php #cybersecurity #rce
7
Comments 1
5 min read
A CA private key was the number 4. Your curl still trusts it (CVE-2026-111943)
Cover image for A CA private key was the number 4. Your curl still trusts it (CVE-2026-111943)

Explores why static binaries ignore system patches
slabb profile

A CA private key was the number 4. Your curl still trusts it (CVE-2026-111943)

#security #infosec #tls #pki
8
Comments 6
6 min read
The CA whose private key was the number 4 just quit the certificate business
Cover image for The CA whose private key was the number 4 just quit the certificate business

Features a simultaneous OTP portal bypass
slabb profile

The CA whose private key was the number 4 just quit the certificate business

#security #infosec #pki #tls
8
Comments 2
5 min read
Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it
Cover image for Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it

Uses Z3 SMT provers and kernel sandboxes
slabb profile

Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it

#ai #security #agents #opensource
34
Picked as gem Comments 87
6 min read
The 'BREAKING' unpatched PHP RCE that wasn't: what CVE-2026-115560 actually requires
Cover image for The 'BREAKING' unpatched PHP RCE that wasn't: what CVE-2026-115560 actually requires
slabb profile

The 'BREAKING' unpatched PHP RCE that wasn't: what CVE-2026-115560 actually requires

#security #php #infosec #cybersecurity
6
Comments 3
6 min read
Gheist: 13,500 secret-dumping workflows planted with stolen GitHub tokens — audit yours in 5 minutes
Cover image for Gheist: 13,500 secret-dumping workflows planted with stolen GitHub tokens — audit yours in 5 minutes
slabb profile

Gheist: 13,500 secret-dumping workflows planted with stolen GitHub tokens — audit yours in 5 minutes

#security #github #devops #infosec
8
Comments
4 min read
JetBrains open-sourced an agentic IDE where agents never touch your checkout
Cover image for JetBrains open-sourced an agentic IDE where agents never touch your checkout

Commenters debating SPEC drift risks
slabb profile

JetBrains open-sourced an agentic IDE where agents never touch your checkout

#ai #agents #ide #opensource
21
Comments 38
3 min read
155 responses leaked between AI customers: the GLM-5.3 KV cache bug — and the canary test for YOUR provider
Cover image for 155 responses leaked between AI customers: the GLM-5.3 KV cache bug — and the canary test for YOUR provider
slabb profile

155 responses leaked between AI customers: the GLM-5.3 KV cache bug — and the canary test for YOUR provider

#ai #security #cloud #llm
9
Comments 7
5 min read
A 16-year-old buffer overflow boots before your defenses: CVE-2026-97631 in EDK II's PXE driver
Cover image for A 16-year-old buffer overflow boots before your defenses: CVE-2026-97631 in EDK II's PXE driver
slabb profile

A 16-year-old buffer overflow boots before your defenses: CVE-2026-97631 in EDK II's PXE driver

#security #firmware #uefi #infosec
11
Comments
5 min read
Your PDF says AES-256. The key had 9 bits of entropy.
Cover image for Your PDF says AES-256. The key had 9 bits of entropy.
slabb profile

Your PDF says AES-256. The key had 9 bits of entropy.

#security #cryptography #pdf #infosec
11
Comments 3
5 min read
Your Mac's git cloned a fake github.com without a warning: Apple, eMudhra, act three
Cover image for Your Mac's git cloned a fake github.com without a warning: Apple, eMudhra, act three
slabb profile

Your Mac's git cloned a fake github.com without a warning: Apple, eMudhra, act three

#security #git #macos #supplychain
12
Comments
5 min read
A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine
Cover image for A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine

Uninstalling leaves backdoors completely untouched
slabb profile

A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine

#security #ai #vscode #supplychain
17
Comments 16
5 min read
pip install could have been hijacked: I tested every trust store on my Mac against the compromised eMudhra chain
Cover image for pip install could have been hijacked: I tested every trust store on my Mac against the compromised eMudhra chain

Apple and Python's split trust verdict
slabb profile

pip install could have been hijacked: I tested every trust store on my Mac against the compromised eMudhra chain

#security #python #supplychain #cryptography
12
Comments 5
5 min read
We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners
Cover image for We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners
slabb profile

We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners

#security #webdev #javascript #ai
14
Comments
6 min read
Postman silently installed itself into Claude Code and Codex: the log lines, the self-approving hook, and the 4-point audit
Cover image for Postman silently installed itself into Claude Code and Codex: the log lines, the self-approving hook, and the 4-point audit
slabb profile

Postman silently installed itself into Claude Code and Codex: the log lines, the self-approving hook, and the 4-point audit

#security #ai #devtools #agents
13
Comments 1
5 min read
Claude Code was mailing your email address to every website it visited: the User-Agent leak, the 5-month system-prompt issue, and the 5-point check
Cover image for Claude Code was mailing your email address to every website it visited: the User-Agent leak, the 5-month system-prompt issue, and the 5-point check

Comments stress verifying actual runtime fixes
slabb profile

Claude Code was mailing your email address to every website it visited: the User-Agent leak, the 5-month system-prompt issue, and the 5-point check

#security #ai #privacy #agents
17
Comments 17
5 min read
ChatGPT Desktop forwards your SSH agent to the machines its agent runs on: your keys, its repos
Cover image for ChatGPT Desktop forwards your SSH agent to the machines its agent runs on: your keys, its repos
slabb profile

ChatGPT Desktop forwards your SSH agent to the machines its agent runs on: your keys, its repos

#security #ai #ssh #agents
8
Comments
5 min read
38,000 AI-found vulnerabilities, 217 fixed: auditing Glasswing, Anthropic's bug-discovery machine
Cover image for 38,000 AI-found vulnerabilities, 217 fixed: auditing Glasswing, Anthropic's bug-discovery machine
slabb profile

38,000 AI-found vulnerabilities, 217 fixed: auditing Glasswing, Anthropic's bug-discovery machine

#security #ai #opensource #vulnerability
6
Comments 2
5 min read