Bogdan Deac

Hi there! 🛡️ Security & Privacy * Researchers built a sub-$100, coin-sized device that plugs into an unlocked external port on a Boeing 737 and can spoof flight-computer data, take over autopilot inputs, or send commands over in-flight Wi-Fi. More * A researcher released "ShieldBreak," a

Hi there! 🛡️ Security & Privacy * A DEF CON researcher's noRecognition project uses AI-trained adversarial patterns printed on clothing and vehicles to defeat license-plate readers like Flock and facial-recognition tools like Clearview AI. More * A Black Hat talk revealed the full timeline of how OpenAI'

Hi there! 🛡️ Security & Privacy * Node.js patched 11 vulnerabilities across the 22.x, 24.x, and 26.x branches, including two high-severity HTTP/2 flaws and a Permission Model bypass letting unauthorized filesystem access. More * Arch Linux temporarily disabled AUR package adoption after a fresh malware wave compromised

Hi there! Besides the best links that I find each week I will start to share the new concepts that I learned at the end of each month. Most probably they will be programming/tech oriented, but who knows how it will evolve in the future. Let’s start small:

Hi there! Last week I finished reading “A Philosophy of Software Design” by John K. Ousterhout. It’s packed with great insights on how to manage software complexity and easy to read. I hope I will come back with some detailed notes about it. Meanwhile, I started to read “Linux

Hi there! I found a great books deal during a sustained, intentional and desired doomscrolling session: Linux: All The Things from O’Reilly via Humble Bundle. Link here. You can get up to 15 titles, including: “Learning Kali Linux”, “Linux System Programming” and “Linux Observability with BPF”. And to take

Hi there! Last week I started reading “A Philosophy of Software Design” by John Ousterhout. It feels like the right book at the right moment. The main subject is how to deal with complexity in code: how to identify, track and fix it. Some principles sound like common sense, but

Hi there! “So Good They Can't Ignore You” by Cal Newport is the best career book that I’ve ever read. I just finished it last week, and I believe it’s even more relevant in the AI-hype era than it was 14 years ago, when it

Hi there! 🛡️ Security & Privacy * Microsoft details an exploit chain in AutoGen Studio's pre-release builds, letting a malicious web page hijack a local AI agent for remote code execution. More * A new BootROM exploit, "usbliter8," permanently compromises Apple's A12 and A13 chips via

Hi there! As agent usage increased in my daily workflow I’ve decided to deepen my knowledge in this subject. This decision is backed by three important factors: better understanding leads to better usage, new agents can be created based on my specific needs, being aware of agents’ internals means

Hi there! 🛡️ Security & Privacy * Meta's Instagram AI support chatbot turned out to be a zero-auth account takeover machine — attackers only needed a username, a VPN, and the patience to ask nicely. The AI would reset passwords to an arbitrary attacker-controlled email with no verification, bypassing

Hi there! 🛡️ Security & Privacy * Inaudible sounds hidden in podcasts and videos can silently hijack AI voice chatbots, injecting malicious commands below the threshold of human hearing — a new class of adversarial prompt injection that works in the real world without the victim noticing anything. More * Microsoft Copilot Cowork is

Hi there! 🛡️ Security & Privacy * Mini Shai-Hulud strikes again: A compromised npm maintainer account published 637 malicious versions across 317 packages — including echarts-for-react (3.8M dl/mo) and size-sensor (4.2M dl/mo) — in a 22-minute automated burst. The payload harvests AWS keys, GitHub tokens,

Hi there! 🛡️ Security & Privacy * TanStack supply chain taken down by chained GitHub Actions exploit: An attacker combined a pull_request_target Pwn Request, GitHub Actions cache poisoning across fork/base trust boundaries, and in-memory OIDC token extraction to silently publish 84 malicious versions across 42 @tanstack/* npm packages

Hi there! 🛡️ Security & Privacy * Double Linux LPE week — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — Back-to-back kernel privilege escalation exploits hit in a single week. Copy Fail targets a page-cache write flaw and can be partially mitigated by rootless

Hi there! 🛡️ Security & Privacy * Notepad++ CVE-2026-3008: a %s format specifier in nativeLang.xml triggers a string injection in FindInFiles, enabling DoS crashes and memory address leaks that can bypass ASLR. Patched in v8.9.4; update immediately. More * GitHub RCE CVE-2026-3854 (CVSS 8.7): Wiz

Hi there! 🛡️ Security & Privacy * 🚨 Bitwarden CLI 2026.4.0 compromised in supply chain attack — Attackers abused a GitHub Action in Bitwarden's CI/CD pipeline as part of the ongoing Checkmarx campaign; update immediately and rotate credentials. More * Pack2TheRoot (CVE-2026-41651): cross-distro Linux privilege escalation — CVSS

Hi there! 🛡️ Security & Privacy * Vertex AI vulnerability allowed malicious agents to exfiltrate Google Cloud data and access private Artifact Registry images — exploiting excessive default permissions in the P4SA service agent. Patch by enforcing least privilege and using BYOSA. More * axios supply chain attack: a hijacked npm maintainer account published

Hi there! 🛡️ Security & Privacy * GrapheneOS reaffirms its no-ID, no-account policy, pledging to remain globally accessible to anyone without collecting personal information — even if device sales become restricted in certain regions. More * Sysdig launches runtime security purpose-built for AI coding agents, extending its cloud-native protection platform

Hi there! 🛡️ Security & Privacy * Glassworm Returns with Unicode Attacks - Invisible PUA Unicode characters exploiting 150+ GitHub repositories, npm packages & VS Code extensions simultaneously using AI-crafted commits. More * DarkSword iOS Exploit in Infostealer Campaign - New vulnerability targeting iPhones via malicious apps stealing credentials and sensitive data at scale.

Hi there! 🛡️ Security & Privacy * Multiple critical AppArmor vulnerabilities enable kernel exploitation, privilege escalation, memory disclosure affecting Ubuntu, Debian systems. More * Glassworm malware returns with invisible Unicode code injection attacking 150+ GitHub repositories, npm packages spreading across ecosystems silently. More * Canada's Bill C-22 mandates metadata retention for

Hi there! 🛡️ Security & Privacy * Clinejection is a chilling supply chain attack: a crafted GitHub issue title triggered an AI triage bot to install a malicious npm package, stealing tokens and silently deploying OpenClaw on ~4,000 developer machines. Prompt injection + confused deputy = full supply chain compromise. More * Coruna, a

Hi there! Anthropic refused to enable mass domestic surveillance. It refused to power fully autonomous weapons. And when the Department of War threatened to label them a national security risk — a designation historically reserved for US adversaries, never before applied to an American company — Anthropic said they'd see