Blog
Security, networks and the occasional questionable decision, mostly with the Philippines in view.
Orca Wants to Be the Workbench for Your Fleet of Coding Agents. Here's What Developers Say
Orca is a free, MIT-licensed desktop app from Stably AI that runs Claude Code, Codex and other coding agents side by side, each in its own git worktree. Developers who use it like the workflow, but warn about token costs, review load and one security gap that is now fixed.
A 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Root ISP Gateways From Across the Street
Researcher Quentin Kaiser has shown that a WPS bug in Broadcom's Wi-Fi code, present since at least 2010, gives attackers in radio range root on ISP gateways without the Wi-Fi password. Broadcom refused to assign a CVE, and the Belgian ISP boxes he tested are still unpatched.
Linux Drops Its AI Label, but the Human Still Signs Off
The Linux kernel is dropping its Assisted-by tag for AI-assisted patches after only about 10% of commits used it. Greg Kroah-Hartman changed his mind, and I think he's right: what counts is the human who understands the patch and signs off.
Midnight Blizzard-Linked Server Was Still Serving Malware Weeks After Exposure, ReversingLabs Finds
ReversingLabs found a staging server in a campaign Microsoft ties to a Midnight Blizzard sub-cluster still serving a PowerShell stager on Oct 5, more than two months after disclosure. The campaign hijacks hotel Wi-Fi captive portals. Here is how to check your devices.
DeepSeek ships V4.1-Flash-1017 with open weights and opens its Search and Fetch APIs
DeepSeek has released V4.1-Flash-1017, a minor update to its Flash model with open MIT weights, unchanged API prices and higher scores on its own coding and agent benchmarks. It also opened its in-house Search and Fetch APIs to all developers.
AI-Written Scripts Helped Hackers Backdoor Government Linux Servers for Months, Unit 42 Says
Unit 42 says an unattributed group, CL-UNK-1211, used AI-assisted scripts to backdoor government Linux servers from October 2025 to April 2026, stealing sudo passwords and planting a Go RAT. Here is how it worked and how to check your servers.
Fake Claude, ChatGPT and Copilot Installers Are Stealing Sessions and Keys, ANY.RUN Warns
ANY.RUN tied 1,258 sandbox analyses to fake Claude, ChatGPT, Copilot and other AI tools that trick employees into pasting malicious commands, running trojanized installers or signing in to fake Google windows. The US ranked second for submissions.
Android Was Built on Freedom. Google's Developer Verification Takes It Away
Google's Android developer verification turns an open platform into a gated one, and the Philippines gets it in 2027. I oppose it heavily. Making developers register with Google and making users wait 24 hours to install apps goes against everything Android stood for.
Infinity Core: Six Linux Kernel Bugs Let Local Users Become Root, and Fixes Are Still Rolling Out
Researcher Hyunwoo Kim has disclosed Infinity Core, six bugs in core Linux kernel code. Five let an unprivileged local user gain root or escape a container, and exploit code is public. Fedora and Debian trixie have fixes; Ubuntu, RHEL and Debian bookworm are still waiting.
Four Critical J-Web Flaws Let Attackers Take Over Junos Devices Without Logging In
Juniper's October release fixes four CVSS 9.8 flaws in J-Web, the Junos web interface, that let unauthenticated attackers bypass login or run code as root. There are no workarounds, so patching and locking J-Web down to trusted hosts is the answer.
