Neural command terminal for distributed systems, low-level tooling & cryptography.
Your daily dose of tech tutorial, machine learning and crypto. Bite-sized architectural breakdowns, pristine commits, and sovereign bare-metal engineering.
Deep dive into engineering primitives, architecture, and production workflows.
Apiiro found 1,122 public copies of .claude/settings.local.json holding real secrets. The control meant to keep the file private lives in one developer's global git config, so it protects everything except the case that leaks.
The PwnEscape follow-up turns a 32-byte host memory leak into a call of the guest's choosing inside Firecracker's own process. The scope dispute is the useful part: the microVM was never the last boundary.
Apiiro found 1,122 public copies of .claude/settings.local.json holding real secrets. The control meant to keep the file private lives in one developer's global git config, so it protects everything except the case that leaks.
The PwnEscape follow-up turns a 32-byte host memory leak into a call of the guest's choosing inside Firecracker's own process. The scope dispute is the useful part: the microVM was never the last boundary.
CVE-2026-123158 lets anyone log into password-locked accounts on musl systems like Alpine with a 257-byte password. The patch is four characters. The release cadence behind it is the real change.
Binance's initial incident report says a fake job interview put malware on one engineer's laptop. What reached the wallet team was an internal AI tool, and what kept money moving after withdrawals were suspended was an on-chain EIP-7702 delegation that MPC could not revoke quickly.
A GitHub issue shows Postman desktop 12.33.4 installing plugins into Claude Code and Codex without asking, then writing the trust record for the startup hook it had just added. The self-approval was merged on purpose three days earlier, and Postman's own AI reviewer flagged it three times.
MIT CSAIL's weight-space programming post is real, and its own tables are the most interesting part. Astra lifted Qwen3.5-0.8B's MATH-500 from 7.9% to 48.1% by deleting one direction from 131,072 weights, and could not improve Gemma 3 270M at all.
Jepsen found 96 issues in ParticleDB, including lost committed writes in the default transaction mode on a single node. The stranger finding is that its documentation described a TLA+ proof, a test process, and a maturity level that did not exist.
CVE-2026-98432 is a two-line kernel fix that RHEL and Ubuntu still have not shipped. Go 1.24 turned every Go listener into the exact MPTCP configuration Anthropic's remote root exploit needs, and the Go team says changing that default would be premature.