From the blog
Notes, experiments and behind-the-scenes from the studio.
sshhole (CVE-2026-123158): The OpenSSH Bug That Logs Into Alpine Without a Password, and How to Fix It
A musl quirk makes OpenSSH accept a too-long password for passwordless accounts on Alpine Linux and many Docker images. Ubuntu and Debian are safe. Who is affected, a 10-second check, and the two-command fix.
Read more →
The $6.3B Binance Hack Started With One Laptop: Fake AI Tool, Fake Job Interview and One Token
According to Binance's initial findings, the largest crypto hack on record began five months earlier with a developer searching for an AI coding tool. The attack path step by step, and five lessons for every developer.
Read more →
CVE-2026-98432: A Single Packet, No Login: The 9.8 Linux Kernel TCP Bug and How to Protect Your Server
A use-after-free in the Linux kernel's TCP connection setup can be reached by a crafted packet before any login. What it is, why Ubuntu's fix isn't out yet, and the stopgaps you can apply today.
Read more →
The GitLab 10/10 Flaw (CVE-2026-97229, GitLab2Shell): Why Updating GitLab Might Not Be Enough
One crafted regular expression in a CI/CD config can run code on a self-hosted GitLab server, no login needed. Alpine Linux updated and was still vulnerable. How to check, upgrade and verify.
Read more →
PHP2Shell + Fragnesia: Patched Linux Servers That Are Still Vulnerable to Root (CVE-2026-46300)
Attackers chain PHP2Shell (into your website) with Fragnesia (a Linux kernel bug) to get root. The kernel fix came out in May, yet servers still get hit, because the fix is installed but never running.
Read more →
HTTP2Shell: How the Node.js Brotli Bug Spread to Python, Bun, Envoy and More
Node2Shell grew into HTTP2Shell: the same Brotli decoder bug (CVE-2026-111497) reaches Python HTTP clients, Bun, Envoy, Istio and curl. Who is exposed, how to check in one minute, and the fixed versions.
Read more →