Bogdan Deac

newsletter

PEAKS No 67: Patch PHP Now, Compromised eMudhra CAs and Kimi K3.1 Pro

Hi there! 🛡️ Security & Privacy * PHP critical RCE fix: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated RCE bugs (CVSS 9.2); update immediately, as no mitigation is complete. More · More * eMudhra CA compromise: Eight eMudhra intermediate CA keys were

newsletter

PEAKS No 66: Gemini 4 Argon, Muse Spark Open and Ledger’s Spy Chips

Hi there! 🛡️ Security & Privacy * Scott Helme rebuts the “passkeys are a trap” claim: synced passkeys send no attestation, and falling back to TOTP leaves you phishable. More * Android auto-verifies and links your phone number to every signed-in Google account by default; disable “Verify phone numbers automatically” and

newsletter

PEAKS No 65: AI Math Breakthroughs, Open Source Crisis & Security Updates

Hi there! 🛡️ Security & Privacy * Google suspends open-source bug bounty program after AI-generated vulnerability reports flood submissions with low-quality spam. More * OpenAI introduces EU text provenance compliance with opt-in watermarking for API customers and limited detector access for approved researchers. More * X.Org server patches 12

newsletter

PEAKS No 64: Gemini 4 Argon, OpenAI Dots and the GLM-5.3 Cyber Wake-Up Call

Hi there! 🛡️ Security & Privacy * Security in the LLM age presentation. 🛸 Tech * Parrot OS 7.4 ships Linux kernel 7.1, systemd-based AnonSurf 6.0, new Discovery setup app, optimized amd64v3/arm64v8.2 ISOs and refreshed pentest tools. More * Nuvacore, founded by ex-Apple and Nuvia architects, designs its

newsletter

PEAKS No 63: Spymarks, KVM Escapes & the Agentic Chip Race

Hi there! 🛡️ Security & Privacy * A Microsoft authentication flaw let attackers expose sensitive account records; patched but a reminder that identity layers remain a top attack surface. More * Researchers found that file notification systems on Windows, Linux, and Android can leak details about user activity to other local apps. More

newsletter

PEAKS No 62: Siri Gets a Brain Transplant, OpenAI's Private Chats Aren't So Private, and Cloudflare Saves 100TB with Math

Hi there! 🛡️ Security & Privacy * 404 Media reveals OpenAI's "Project Lily": hundreds of contractors read real ChatGPT conversations, sometimes containing sensitive personal data. More * Apple unveils Reference Image, a new iPhone camera mode that cryptographically verifies photos are real using Private Cloud Compute and quantum-safe

newsletter

PEAKS No 61: Always Listening, Always Learning: AI's Privacy Paradox This Week

Hi there! 🛡️ Security & Privacy * Modern connected cars quietly log driving behavior and location, feeding data brokers and insurers with little owner visibility or control. More * Signal is reportedly building a paid "Signal Login" option using zero-knowledge proofs to let users register without a phone number. More

newsletter

PEAKS No 60: GPT-6 Astra Debuts and a Critical Chrome Zero-Day

Hi there! 🛡️ Security & Privacy * Google rushed out Chrome 152.0.7977.82 to patch CVE-2026-85046, an actively exploited V8 type-confusion zero-day (CVSS 8.8) now on CISA's must-patch list by Sept 18. More * A researcher found Omarchy Linux's default Docker

newsletter

PEAKS No 59: AI Model Wars Heat Up, Nvidia Eyes Hugging Face, and Apple Patches Its Privacy Prompts

Hi there! 🛡️ Security & Privacy * Android 17 rolls out Encrypted Client Hello to hide the websites you visit from network snoops, forces apps to ask permission before scanning your home Wi-Fi, enables Certificate Transparency by default, and lets carriers auto-disable 2G to block SMS-blaster scams. More * Apple

newsletter

PEAKS No 58: AI Agents Go to War, a Coin-Sized Hack Threatens a 737, and China's Open Models Get Scary Good

Hi there! 🛡️ Security & Privacy * Researchers built a sub-$100, coin-sized device that plugs into an unlocked external port on a Boeing 737 and can spoof flight-computer data, take over autopilot inputs, or send commands over in-flight Wi-Fi. More * A researcher released "ShieldBreak," a

newsletter

PEAKS No 57: Astra's Math Wins & Cyber Risk, Cloudflare's Agent Browser, and the Website That's 99% Bots

Hi there! 🛡️ Security & Privacy * A DEF CON researcher's noRecognition project uses AI-trained adversarial patterns printed on clothing and vehicles to defeat license-plate readers like Flock and facial-recognition tools like Clearview AI. More * A Black Hat talk revealed the full timeline of how OpenAI'

newsletter

PEAKS No 56: Node.js Patches, Chat Control Pushback, and Kimi K3's Massive Open-Weight Debut

Hi there! 🛡️ Security & Privacy * Node.js patched 11 vulnerabilities across the 22.x, 24.x, and 26.x branches, including two high-severity HTTP/2 flaws and a Permission Model bypass letting unauthorized filesystem access. More * Arch Linux temporarily disabled AUR package adoption after a fresh malware wave compromised

newsletter

PEAKS No 55: AI Models Go Rogue, a 9-Year-Old Root Flaw and July Concepts

Hi there! Besides the best links that I find each week I will start to share the new concepts that I learned at the end of each month. Most probably they will be programming/tech oriented, but who knows how it will evolve in the future. Let’s start small:

newsletter

PEAKS No 54: SharePoint Zero-Day Alerts, KDDI's Mega-Breach & a 27B AI Model That Fits in Your Pocket

Hi there! Last week I finished reading “A Philosophy of Software Design” by John K. Ousterhout. It’s packed with great insights on how to manage software complexity and easy to read. I hope I will come back with some detailed notes about it. Meanwhile, I started to read “Linux

newsletter

PEAKS No 53: Chat Control Returns, GhostLock Hits Linux, and Grok 4.5 Lands

Hi there! I found a great books deal during a sustained, intentional and desired doomscrolling session: Linux: All The Things from O’Reilly via Humble Bundle. Link here. You can get up to 15 titles, including: “Learning Kali Linux”, “Linux System Programming” and “Linux Observability with BPF”. And to take

newsletter

PEAKS No 52: GLM 5.2 vs Claude in Cyber Benchmarks, EU Chat Control Fight Returns, Lab-Grown Cell Divides

Hi there! Last week I started reading “A Philosophy of Software Design” by John Ousterhout. It feels like the right book at the right moment. The main subject is how to deal with complexity in code: how to identify, track and fix it. Some principles sound like common sense, but

newsletter

PEAKS No 51: GPT-5.6, IBM's Sub-1nm Chip, and the Cordyceps Supply-Chain Flaw

Hi there! “So Good They Can't Ignore You” by Cal Newport is the best career book that I’ve ever read. I just finished it last week, and I believe it’s even more relevant in the AI-hype era than it was 14 years ago, when it

newsletter

PEAKS No 50: AI Agents Get Hijacked, FortiBleed Breaches 74K Firewalls, and Local LLMs Finally Get Good

Hi there! 🛡️ Security & Privacy * Microsoft details an exploit chain in AutoGen Studio's pre-release builds, letting a malicious web page hijack a local AI agent for remote code execution. More * A new BootROM exploit, "usbliter8," permanently compromises Apple's A12 and A13 chips via

newsletter

PEAKS No 49: Claude Fable 5 Lands, a New Defender Zero-Day Drops, and OpenCV Goes Native LLM

Hi there! As agent usage increased in my daily workflow I’ve decided to deepen my knowledge in this subject. This decision is backed by three important factors: better understanding leads to better usage, new agents can be created based on my specific needs, being aware of agents’ internals means

newsletter

PEAKS No 48: AI Agent Exploits, C++ Documentary & Perfect Randomness

Hi there! 🛡️ Security & Privacy * Meta's Instagram AI support chatbot turned out to be a zero-auth account takeover machine — attackers only needed a username, a VPN, and the patience to ask nicely. The AI would reset passwords to an arbitrary attacker-controlled email with no verification, bypassing

newsletter

PEAKS No 47: AI Voice Attacks, macOS Security, Copilot Prompt Injection & Google's War on the Web

Hi there! 🛡️ Security & Privacy * Inaudible sounds hidden in podcasts and videos can silently hijack AI voice chatbots, injecting malicious commands below the threshold of human hearing — a new class of adversarial prompt injection that works in the real world without the victim noticing anything. More * Microsoft Copilot Cowork is

newsletter

PEAKS No 46: AI Agents, npm Supply Chain Attacks, GitHub Breach, Gemini 3.5

Hi there! 🛡️ Security & Privacy * Mini Shai-Hulud strikes again: A compromised npm maintainer account published 637 malicious versions across 317 packages — including echarts-for-react (3.8M dl/mo) and size-sensor (4.2M dl/mo) — in a 22-minute automated burst. The payload harvests AWS keys, GitHub tokens,

newsletter

PEAKS No 45: Kernel on Fire — Supply Chains Compromised, AI Goes Local, and Pixels Fall

Hi there! 🛡️ Security & Privacy * TanStack supply chain taken down by chained GitHub Actions exploit: An attacker combined a pull_request_target Pwn Request, GitHub Actions cache poisoning across fork/base trust boundaries, and in-memory OIDC token extraction to silently publish 84 malicious versions across 42 @tanstack/* npm packages

newsletter

PEAKS No 44: Exploit Season: Dirty Frags, Dreaming Agents & Robot Dogs on a Budget

Hi there! 🛡️ Security & Privacy * Double Linux LPE week — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — Back-to-back kernel privilege escalation exploits hit in a single week. Copy Fail targets a page-cache write flaw and can be partially mitigated by rootless

newsletter

PEAKS No 43: Copy Fail, Goblin Infestation & the Open-Source Everything Wave

Hi there! 🛡️ Security & Privacy * Notepad++ CVE-2026-3008: a %s format specifier in nativeLang.xml triggers a string injection in FindInFiles, enabling DoS crashes and memory address leaks that can bypass ASLR. Patched in v8.9.4; update immediately. More * GitHub RCE CVE-2026-3854 (CVSS 8.7): Wiz