News
Dispatches from Cybernuke: flaws in code that runs everything.
- Seal broke, theft waved throughEvery night cron tidied cache and logged success. Last night, midway, it also shipped Bitcoin wallet to stranger — nothing left out of place: file present, log clean, one copy of the key astray. By morning, every coin gone.
- Distros chasing vulnerabilitiesThe stretch between “upstream fixed it” and “your machine has it” was tolerable: the attacker was behind, slower than you.
- The other end of the wireFor a decade the nightmare of a memory leak was a server bleeding its secrets to the open internet. This time it is the client that bleeds — the quiet end nobody thought to guard — and the key it loses buys impersonation.
- Nobody reads the labelIETF says servers must be identified. Seven widely-used stacks don’t enforce — four comply. Nobody owns the name and no examiner checks the claim, so a stack can wear “TLS 1.3” while skipping the very check that stops a server being impersonated.
- Access all areasThe con was never forgery — real uniform on the wrong person — waved through a gate that confirms it’s genuine, never asking whether it’s yours.
- Forward secrecy mandatory — seven TLS libraries missed the memoFor eight years IETF merely suggested TLS rotate its keys. Now it has made a stand — rotation mandatory — seven widely-used libraries still don’t.
- Patched, and still openA security fix is public: it says what was wrong, and where. Patch a flaw, miss its twin, and the fix becomes a map — the door you just closed, and the identical one you left open — handed to the intruder.
- It looks fixedVisa open-sourced an AI pipeline that reads your code, finds the flaw, writes the patch, and grades its own repair a pass — without compiling, building, or running a line of it. Their own write-up openly said it is not enough.
- Gym footageBenchmarks that measure AI hacking are gyms — controlled, scored, and quietly built to be winnable — they tell you the punch is getting faster, nothing about whether it lands.
- Prove itBug-bounty platform ships plugin that tells hunters no.
- A second opinionVisa and Capital One open-sourced AI bug-finders five weeks apart. Both taught the machine to argue against its own findings. Neither ran the code.