AI and infrastructure news
Filter by type: Post10
Author argues short-lived bearer tokens need proof of possession
The post argues that OIDC bearer tokens with 15-minute expiry do not prevent intrusions, and that proof of possession, such as TLS binding, is the only real solution. The author also predicts OIDC will end soon.
Private CA roots can issue certificates without transparency log entries
The post claims that TLS inspection roots installed on corporate laptops can issue certificates for any domain without appearing in certificate transparency logs, a trust gap that calls for local monitoring.
Prompt injection vectors: how to test and harden AI systems
The post gathers prompt injection vectors and strategies with examples, useful for assessing and hardening the security of applications built on language models.
Bootloaders: assessing risks and defenses
An article published on June 5, 2026, covers attack surfaces, vulnerability detection, and defenses in firmware, operating systems, and monolithic bootloaders.
Post warns of AI-orchestrated intrusion attempts
Published on June 3, 2026, the post says AI agents connected to scanners, shells, and other tools could make intrusion workflows more repeatable and less costly.
Prompt injection in AI-analyzed binaries
Research from the Naval Postgraduate School, published on July 12, 2026, describes how strings in C binaries can influence language-model reverse-engineering agents.
Reverse-proxy phishing can bypass MFA
A post dated August 9, 2026, describes how phishing kits can relay logins and capture session cookies after multifactor authentication.
Device-code phishing is not limited to Wi-Fi
Published on July 25, 2026, the post warns that device-code authentication phishing can also occur over Ethernet or the internet.
Windows tokens and privilege escalation risks
Published on June 27, 2026, the text explains how the Windows kernel’s _TOKEN structure represents identity and security attributes, and how token replacement has historically been used to gain SYSTEM privileges.
uv can block malicious packages before installation
A note dated July 17, 2026, says setting UV_MALWARE_CHECK=1 makes uv query OSV before installing packages from remote registries and block those reported as malware.
Let's assess your project
I reply with scope and a proposal.