#security

Chrome made SameSite=Lax the default and most CSRF vulnerabilities quietly stopped working. That is real protection nobody implemented, and it leaves three specific gaps, one of which turns on the fact that SameSite was never about origins in the first place.

The Capital One breach was 100 million records from one server-side request. The reason the obvious fix fails is subtler than a bad blocklist: you check a hostname, then you resolve it again to make the request, and DNS is free to answer differently the second time.

Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonised over has collapsed: authorization code plus PKCE, for every client type, no exceptions.

JWTs are the default choice for new apps and usually the wrong one. The reason is revocation: there is no row to delete. And the standard fix, a server-side denylist, reintroduces the database lookup that was the entire point of going stateless.

Every guide to sandboxing AI agents compares Firecracker to gVisor to containers. Useful, and not where the one documented escape of 2026 happened. That agent was in an environment with no internet access. It got out through the thing the sandbox had to trust in order to install a dependency.

Most MCP tutorials stop at hello-world. Then you try to run one on the open internet with real auth, real load, and real attackers, and every assumption breaks. Here are the five design decisions that actually decide whether your server survives production.

MCP took off faster than anyone's threat model. We wired arbitrary third-party tools straight into models that can't tell an instruction from data, then acted surprised when tool poisoning hit 72.8 percent and Anthropic's own Inspector shipped a CVSS 9.4 RCE. Here's the real attack surface, and what governance is finally starting to look like.

Rust just cracked the TIOBE top 10 and has been the most admired language for nine straight years. But only about 26% of Rust users write it professionally, and there were roughly 606 open Rust jobs globally in early 2026. The loudest language is not the winning one. Here's the honest read on where it actually lands.

DNS is the internet's phonebook, but that analogy hides the interesting part: a global lookup system, distributed across millions of servers, that resolves a name in tens of milliseconds and quietly holds the whole web together.

The feds picked a side. As of January 1, 2026, CISA and the FBI call shipping a C or C++ product without a published memory-safety roadmap a documented bad practice that elevates risk to national security. If you're writing new C++ in 2026, you're fighting the tide.

The deadlines are set, the standards are final, and 91% of businesses still have no roadmap. The uncomfortable truth is that you can't migrate what you can't see, so the first task isn't picking an algorithm, it's building an inventory of every place you use crypto.

Your AI agent is a user with production credentials, and most teams treat it like a feature. Nearly 80% of organizations say their agents have already acted beyond their intended scope. Here's how to govern a non-human user like you'd govern a human one: scoped identity, least privilege, quotas, and an audit trail back to a human sponsor.

Change Healthcare's Citrix portal had no MFA. Equifax had a free patch sitting on its own internal listserv for two months before attackers walked in. Companies don't fix vulnerabilities because the expected-value math, run honestly, genuinely points at inaction, and every breach press release that reads the same is what that math actually produces.

Walk through every OWASP API Security Top 10 vulnerability with real attack examples and code-level mitigations you can ship this week.

A practical guide to shifting security left: SAST, DAST, container scanning, secrets detection, IaC analysis, and GitHub Actions hardening.

A professional guide to open-source intelligence gathering: passive recon, threat actor profiling, and integrating OSINT into your security program.

Zero trust is less of a product you buy and more of an architectural posture you build over time. Here's a prioritized checklist that gets you to meaningful security improvements without paralyzing the engineering team.

reCAPTCHA v3 dropped the checkbox and the traffic-light puzzles in favor of a silent score from 0 to 1. That is a real usability win and a real set of tradeoffs. Here is what you actually sign up for.