/claude-code-extension-cursor-marketplace-ssh-authorized-keys-survives-uninstall/ The Trojanized Claude Code Extension Left a Key Behind. Uninstalling It Does Not Remove It Oct 31
/supabase-data-api-grants-serial-sequence-permission-denied/ Supabase's Grant Change Hits Existing Projects Today. Granting the Table Is Not Enough for serial Columns Oct 30
/brotli-decoder-unchecked-return-needs-more-input-overflow/ A Brotli Decoder Treated a Bad Block Switch as 'Send More Bytes', and Kept Writing Past an 8-Byte Buffer Oct 26
/emudhra-weak-ca-keys-trust-store-baked-into-build/ Chrome Blocked the Weak eMudhra CA Keys in 100 Minutes. Your Go Binary and Python Container Did Not Get the Memo Oct 25
/php-oom-longjmp-memory-limit-rce-cve-2026-109618/ PHP's memory_limit Was the Attack Surface: Two Critical RCEs Hide in the Out-of-Memory Path Oct 22
/windows-ntlmv1-sso-enforce-default-mschapv2/ Windows 11 Now Blocks NTLMv1 Single Sign-On by Default, and an Unset Registry Value Is the Switch Oct 17
/agent-framework-ag-ui-shared-state-tool-approval-shape-check/ A Hidden Middleware Attribute Left AG-UI Tool Approvals Writable by the Client Oct 16
/tilde-in-path-bash-lookup-hides-relative-entry/ A Quoted ~ in PATH Works in Bash and Silently Becomes a Relative Path Everywhere Else Oct 12
/npm-trusted-publishing-48-hour-expiry-unvalidated-config/ npm Trusted Publishing Configs Now Expire in 48 Hours Unless a Publish Validates Them Oct 11
/zeroization-wipe-secrets-compiler-copies/ Wiping a Secret Can Create the Copy You Leave Behind Oct 8
/github-app-stateless-installation-tokens-520-chars/ GitHub App Installation Tokens Are Now About 520 Characters. The Bugs Will Be in Your Redaction Rules Oct 7
/postgres-self-join-elimination-rls-checkasuser/ Postgres Self-Join Elimination Could Merge Two Table References That Had Different RLS Policies Oct 2
/anthropic-enterprise-frontier-safeguards-data-retention/ Anthropic Rebuilds Its Data Retention Deal Around Your Own Cloud Sep 2
/claude-session-hijacking-infostealer-malware/ Infostealers Are Hijacking Claude Sessions, and MFA Isn't Stopping Them Sep 1
/claude-in-chrome-general-availability/ Claude in Chrome Goes GA, and Now It Acts Without Asking First Aug 31
/claude-code-restricted-mode/ Claude Code's Restricted Mode Closes the Config Escape Hatch on Sandboxed Agents Aug 29
/how-to-store-password-securely-in-the-database/ How to store passwords securely in the Database? Jul 13