#security
3 posts
-
PHP2Shell, Node.js and GitLab: the week software security became a race against time
A series of critical vulnerabilities in PHP, Node.js and GitLab raises a question: as AI accelerates vulnerability discovery, can teams patch systems just as quickly?
-
MCP got two advisories in one week and neither is a code bug
On September 28th and 30th, two MCP security issues landed: one in the official Python SDK, one in the next dev MCP endpoint. Both are trust boundary failures, not implementation bugs. I had written about MCP in production days earlier, so I read both advisories in full.
-
Gemini “hacked” 3 companies in a test. The real failure was weak passwords and exposed secrets
During an Irregular CTF in May, a test environment let Gemini reach the internet and the model ended up accessing three real companies. The least futuristic detail: one password was guessed and two sets of credentials were exposed in public repositories.