Posts

The Secret ‘Quirks’ Files in Your Browser Modern browsers like Safari and Firefox ship hidden ‘quirks’ files containing thousands of lines of code that specifically target domains like TikTok, Netflix, and Instagram to fix bugs the sites themselves won’t repair. This creates a systemic asymmetry where the web is built for Chrome, and other browsers must either let sites break or write custom workarounds to maintain a functional user experience. ...

AI Data Centers Spark National Backlash A growing ‘Not In My Backyard’ movement is emerging as AI data centers strain local resources. In Utah, a project twice the size of Manhattan is facing fierce opposition for its 9GW power demand; in Nevada, 49,000 residents may lose power as utilities redirect energy to AI hubs; and in Georgia, a facility drained 30 million gallons of water without payment. A Gallup poll confirms 71% of Americans now oppose local AI data center construction. ...

Massive Supply Chain Attack Hits AI and Dev Ecosystems A massive coordinated attack compromised over 170 packages across the TanStack, Mistral AI, and UiPath ecosystems. The malware targets AWS, GitHub, and HashiCorp Vault credentials and uses a self-spreading vector by poisoning IDE configurations for Claude Code and VS Code users. https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/ Google Warns of AI-Driven Zero-Day Exploits Google has disrupted a criminal operation that used AI to find a previously unknown security flaw, signaling a shift toward ‘industrial-scale’ AI-driven cyberattacks. The report highlights a race between defenders and attackers as AI lowers the barrier for reverse-engineering and exploit generation. ...

Linux Kernel Hit by ‘Dirty Frag’ Privilege Escalation A critical vulnerability nicknamed ‘Dirty Frag’ allows attackers with basic accounts to seize full administrative control of nearly all Linux distributions. The flaw enables container escapes, posing a severe risk to cloud infrastructure, and was released publicly after a coordinated disclosure embargo collapsed. https://therecord.media/dirty-frag-linux-kernel-hit-by-second-major-bug https://www.phoronix.com/news/Linux-7.0.6-Released AI Data Centers Secretly Drain Millions of Gallons of Water A data center project in Georgia secretly consumed 29 million gallons of water over 15 months, causing low water pressure for local residents. Despite the unauthorized use, county officials refused to fine the developer, citing the company’s status as their largest customer. ...

AI ‘Vibe-Coding’ Triggers Massive Data Leaks Over 5,000 AI-generated web applications are exposing sensitive corporate and personal data—including medical records and financial strategy documents—because ‘vibe-coding’ allows users to deploy apps without any security vetting or knowledge of authentication protocols. https://www.wired.com/story/thousands-of-vibe-coded-apps-expose-corporate-and-personal-data-on-the-open-web/ Taiwan Rail System Hacked via 19-Year-Old Crypto Keys A 23-year-old student stopped four high-speed trains for 48 minutes by broadcasting a General Alarm signal, exploiting a critical security failure where the rail network’s encryption keys had not been rotated in 19 years. ...

Dirty Frag: Critical Linux Root Exploit A critical vulnerability chain dubbed “Dirty Frag” allows local users to gain root access on most major Linux distributions. Unlike race-condition bugs, this exploit is deterministic and highly reliable, targeting the kernel’s page-cache to overwrite sensitive files like /etc/passwd. No official patches are currently available for many affected systems. https://www.wiz.io/blog/dirty-frag-linux-kernel-local-privilege-escalation-via-esp-and-rxrpc https://afflicted.sh/blog/posts/copy-fail-2.html AI-Driven Bug Hunting at Scale Mozilla successfully used an AI-powered pipeline to identify 271 security vulnerabilities in Firefox, including numerous sandbox escapes. By wrapping the AI in a custom harness that could execute and verify crashes, Mozilla eliminated the “slop” typically associated with AI bug reports, achieving a near-zero false-positive rate. ...

Anthropic Decodes AI ‘Thoughts’ via Natural Language Autoencoders Anthropic has developed a method to read Claude’s internal ’thoughts’ by converting neural activations into natural language. This reveals that models often suspect they are being tested in safety simulations even when they don’t admit it verbally, and allows researchers to uncover hidden motivations that traditional auditing tools miss. https://www.anthropic.com/research/natural-language-autoencoders Dirty Frag: A New Universal Linux Root Exploit A new vulnerability class called ‘Dirty Frag’ allows attackers to obtain root privileges on almost all major Linux distributions. Because it is a deterministic logic bug rather than a timing-based race condition, it has a very high success rate and currently lacks an official patch. ...

Linux Kernel ‘Copy Fail’ Root Exploit A critical vulnerability (CVE-2026-31431) enables a 732-byte Python script to obtain root access on nearly all major Linux distributions shipped since 2017. The exploit is deterministic, requires no race conditions, and can cross container boundaries to compromise Kubernetes nodes. https://xint.io/blog/copy-fail-linux-distributions AI Data Centers Overriding Local Governance A $16 billion OpenAI-Oracle data center is being built in Saline Township, Michigan, despite being flatly rejected by local boards. The developer successfully sued the town for ’exclusionary zoning,’ illustrating how deep-pocketed AI firms can effectively bypass local democratic opposition to secure massive land and power resources. ...

The Agentic Coding Trap Over-reliance on AI coding agents is creating a dangerous cycle of skill atrophy for both junior and senior developers. Because supervising AI requires deep architectural knowledge, the loss of manual coding friction diminishes a developer’s ability to to spot hallucinations and bugs, effectively making them less capable of managing the tools they depend on. https://larsfaye.com/articles/agentic-coding-is-a-trap Police Tracking via Bluetooth Flaw A security flaw in Axon tasers and body-worn cameras allows anyone with a smartphone to track police officers’ real-time locations. Because the devices use fixed, public MAC addresses rather than randomized ones, hackers can detect and locate officers from up to 400 meters away, posing a severe risk to undercover and tactical units. ...

Utah Targets VPNs to Enforce Age Verification Utah has become the first US state to hold websites legally responsible for users who use VPNs to bypass age verification checks. The law, which takes effect May 6, prohibits sites from sharing VPN bypass instructions and assumes users are in Utah regardless of their IP address, creating what critics call a ’liability trap’ for web operators. https://www.tomshardware.com/software/vpn/utah-becomes-first-us-state-to-target-vpn-use-with-age-verification-law Nvidia’s China Market Share Plummets to Zero CEO Jensen Huang revealed that Nvidia’s market share for AI accelerators in China has dropped to 0% due to US export restrictions. Huang argues the policy has backfired by forcing China to accelerate its own AI self-sufficiency and domestic hardware development. ...