Inside the $285M Drift Protocol Heist: Six Months of Trust, 12 Minutes to Start the Drain
The $285M Drift Protocol heist began with six months of trust-building. See the verified attack chain, conflicting figures, and controls that could have stopped it.
TRM’s Co-Case Agent Turns a Crypto Investigation Into a Reviewable Workflow—Not an Autonomous Verdict
TRM’s Co-Case Agent speeds crypto case preparation with tracing, graph audits, and audit logs. See the human-review workflow that turns AI assistance into defensible investigation work.
Four npm Compromises in 77 Days: A Build-Sandbox Blueprint for Self-Hosted PaaS
Axios, node-ipc, Red Hat, and Mastra expose why lockfiles alone fail—and how isolated builds, denied egress, script policy, and SBOMs contain poisoned dependencies.
AMD SEV-SNP Comes to Bare Metal: What Hardware Memory Encryption Buys a Multi-Tenant Fleet That Namespaces Never Could
OVHcloud's Scale 2026 bare metal and AWS Dedicated Hosts both shipped AMD SEV-SNP in 2026, at very different prices. Here's what hardware memory encryption actually closes that container namespaces can't, what it costs in dollars and throughput, and who genuinely needs it.
Cordyceps: How a Free GitHub Account Hijacked CI/CD at Microsoft, Google, and Cloudflare
A researcher with a free GitHub account and no org access could hijack CI/CD at Microsoft, Google, Cloudflare, Apache, and the Python Software Foundation. Here's what the Cordyceps vulnerability class actually does, and the audit checklist to run against your own build pipeline.
Your Node Buildpack's --ignore-scripts Flag Didn't Stop Phantom Gyp
A June 2026 npm worm called Phantom Gyp bypassed --ignore-scripts entirely by hiding in binding.gyp instead of a lifecycle script — here's the exact mechanism, why it worked, and what a git-push buildpack needs to do instead of trusting one flag.
CloudNativePG's First CVE Is a 9.4: How Scraping Metrics Handed Out Postgres Superuser
CloudNativePG's first-ever CVE let a low-privileged database user escalate to PostgreSQL superuser and OS command execution through the default metrics exporter — the exploit chain, the fix, and the unrelated failover bug that shipped in the same release.
Three JavaScript Quirks, One CVSS 10.0 RCE: What n8n's Sandbox-Escape Chain Means for Every Agent Tool Wired to Your Cluster
Three individually-harmless gaps in n8n's JavaScript sandbox chained into a CVSS 10.0 RCE that reached every stored credential and, on shared instances, the Kubernetes cluster underneath. Here's the exploit chain and what it means for any tool that hands an agent a general-purpose sandbox.
npm v12 Turns Off 16 Years of Automatic Code Execution: The Exact Packages You Need to Re-Approve Before Your Build Breaks
npm v12 flipped install scripts, Git dependencies, and remote tarballs to off by default after a year of worm-driven supply chain attacks — here's the exact audit of which packages need re-approving and what it means for a git-push PaaS's Node buildpack.