By Reference

12 min read

eMudhra’s Private Key Was 4: Inside the Flaw That Broke the Internet’s Chain of Trust

One of the Internet’s most trusted CAs protected its keys with a number smaller than 256. One was literally 4. Anyone with a laptop could crack them in a millisecond. Browsers blocked it in hours, but curl, git, Docker and millions of servers are still exposed. Here’s how it happened.

Cybersecurity 11 min read

Brotli2Shell: How One Misread Return Value Turned a Decompressor Into a Universal RCE Weapon

In February 2026, a quiet commit fixed a tiny bug in Google’s Brotli library. No release, no CVE. Eight months later, it blew up: Node.js, Python, .NET and PHP all shipped the same vulnerable code. Here’s how an 8-byte buffer became a universal RCE and how to patch every copy.

Cybersecurity 13 min read

Your AI Agent’s Playwright Browser Is Unpatched and Unsandboxed: One Bad Page Can Own Your Laptop

Claude Code, Cursor, Copilot and Codex can browse the web through Playwright. But its bundled Chromium misses 73 security patches and runs with the sandbox off. One malicious page could expose your SSH keys and credentials, no click needed. Here’s how to check and fix it in minutes.

Cybersecurity 13 min read

PHP2Shell: The 22-Year-Old “Unexploitable” Bug That Brought 70% of the Web to Its Knees in 24 Hours

For 20+ years, experts called it unexploitable. Then on October 20, 2026, two CVEs shook the web, forcing governments to isolate services. The flaw wasn’t a plugin or WordPress: it lived inside PHP, powering 70% of websites. Here’s how PHP2Shell works and how to protect your servers.

IT 13 min read

YouTube Premium for Less Than €3 a Month

YouTube Premium without paying the standard subscription price? This one regional loophole makes it possible.

Crypto 10 min read

$6.4 Billion Stolen in 20 Minutes: Inside the Biggest Heist in Human History⁠

Inside the $6.4B Binance heist: How Lazarus Group hijacked signing servers, weaponized Ethereum's EIP-7702, and laundered billions in a 54-minute race.

AI 9 min read

ChatGPT's Leaky Year and the Day It Basically Hacked Hugging Face

In 2026, ChatGPT leaked data via DNS and lost GitHub tokens to a bug. Then an OpenAI test model went rogue, hacking Hugging Face's servers to steal answers to its own exam. Here's the full, slightly unhinged story.

AI 26 min read

Stop Prompting Blindly: The Practical Guide to Mastering Claude Code

Claude Code’s killer features are autonomous code editing, terminal execution, test driven iteration, project memory through `CLAUDE.md`, reusable skills, subagents, hooks, MCP integrations, and seamless workflows across the CLI and VS Code.

Cybersecurity 22 min read

Prompt Injection: Here's How to Actually Protect Yourself

Prompt injection cannot be eliminated, but its impact can be contained. Learn how least privilege, strict tool controls, human approval, validation, logging, and layered defenses reduce the damage a compromised AI agent can cause.

AI 8 min read

Mythos, Fable, and the Jailbreak That Forced the U.S. Government to Step In

Anthropic built the most powerful hacking AI ever made, then handed a caged version to the public. It was jailbroken in under 48 hours. Days later, the U.S. government made both models vanish worldwide. The story of Mythos, Fable, and what it teaches every company betting on AI.

Cybersecurity 8 min read

HackTheBox - MonitorsFour Writeup

Writeup for HTB MonitorsFour — token=0 IDOR leaked MD5 creds, cracked to wonderful1, Cacti RCE via CVE-2025-24367, escaped container via unauthenticated Docker Desktop API (CVE-2025-9074) to read root off the Windows host.