RSS Parrot

AI has made every target worth attacking

https://fenko.nz/blog/ai-made-every-target-worth-attacking/

Published: November 4, 2026 20:00

Every security budget we have ever reviewed rests on the same bet: attacking is expensive.

CVE-2026-98432: What to Do While Kernel Patches Arrive

https://fenko.nz/blog/cve-2026-98432-tcp-kernel/

Published: October 29, 2026 11:00

Sooner or later, CVE-2026-98432 will hit your timeline. If you run Linux systems that accept IPv4 TCP connections, check your patch status now.

eMudhra's CA Private Keys Were Single Bytes. One of Them Was 4

https://fenko.nz/blog/emudhra-ca-compromise/

Published: October 19, 2026 11:00

Updated 21 October 2026. The first version of this post, published a day earlier, said nobody had explained the compromise. Mozilla’s incident bug has since been opened to the public, eMudhra has given a preliminary account, and we have reproduced the key…

The last bug you found is the next bug you'll look for

https://fenko.nz/blog/last-bug-next-bug/

Published: October 8, 2026 11:00

When I ran a red team, I had a line I used in one-on-ones that nobody liked hearing: the less you know about security, the better you get at this job. It’s a half-truth, but it’s the useful half.

Low-Privilege Account Takeover Through Leantime's JSON-RPC API

https://fenko.nz/blog/leantime-json-rpc-account-takeover/

Published: September 19, 2026 12:00

Two unguarded onboarding methods in Leantime’s JSON-RPC API let a low-privilege authenticated user overwrite another user’s password and role, activate the modified account, and take control of the instance owner.

State of Agentic Security: Governing the AI Workforce

https://fenko.nz/blog/state-of-agentic-security/

Published: September 5, 2026 12:00

When an organisation says that its AI agents have human oversight, a great deal remains unexplained. The supervisor might approve the task before it starts, inspect selected outputs afterwards, or simply receive a summary of what happened. Those…

Does a multi-model pipeline make AI-generated code more secure?

https://fenko.nz/blog/multi-model-ai-code-security/

Published: August 30, 2026 12:00

Generating the same thing with several models and comparing the results is a real practice, and it’s well documented. Addy Osmani’s 2026 workflow post suggests trying “two or more LLMs in parallel to cross-check how they might approach the same problem…

Fenko Vault: what it is, how it works, and what's left before 1.0

https://fenko.nz/blog/fenko-vault-road-to-1-0/

Published: August 4, 2026 12:00

Fenko Vault is past 15,000 installs across Chrome, Firefox and Google Play, and the Chrome Web Store has picked up the listing as Featured. That is more people than we expected to be running a tool we originally wrote for ourselves, and a good moment to…

One Colon to Rule Them All: HTTP Request Smuggling in Eclipse Grizzly

https://fenko.nz/blog/grizzly-http-request-smuggling/

Published: July 27, 2026 12:00

Most request smuggling bugs are about disagreement. A front-end proxy reads a request one way, the backend reads it another, and the gap between those two readings is where you live. The interesting ones usually hinge on some baroque interaction between…

The rise of qualitative measurement

https://fenko.nz/blog/the-rise-of-qualitative-measurement/

Published: June 26, 2026 21:00

I have a pet peeve that has followed me through every security job I’ve held, and it gets worse the more senior the room. We measure quality with numbers, and the numbers keep lying to us. Not because someone faked them. Because the thing we care about was…

Tax the chips, before the models

https://fenko.nz/blog/tax-the-chips-before-the-models/

Published: June 3, 2026 12:00

In 1930, with the world sliding into the Depression, John Maynard Keynes sat down and wrote something wildly optimistic. The essay was called Economic Possibilities for our Grandchildren, and the bet at the center of it was simple: machines were getting…

Harness the Power of the Harness

https://fenko.nz/blog/harness-the-power-of-the-harness/

Published: May 25, 2026 12:00

Microsoft topped a cybersecurity benchmark last week and the headlines all read “Microsoft beat Anthropic.” That’s the wrong story. Read the numbers again.

Hours, Not Days

https://fenko.nz/blog/hours-not-days-patching-urgency/

Published: May 10, 2026 12:00

I’ve been banging on about mean time to exploit for a while. Recent events make it worth saying again.

pip install malware: Why Python and JavaScript Package Ecosystems Are [almost] Unfixable

https://fenko.nz/blog/pip-install-malware/

Published: April 8, 2026 12:00

pip, npm, and many other package managers are fundamentally broken from a security perspective. Not broken as in “needs patches.” Broken as in the core design makes the problem almost unsolvable.

To Catch a Rising (AI) Star

https://fenko.nz/blog/to-catch-a-rising-ai-star/

Published: April 2, 2025 11:00

If your day-to-day life is primarily behind your monitor and keyboard, this article is for you. AI is coming fast for our jobs, and most of us are not as alarmed as we should be, nor know what to do about it. I’ve spent the last 12 months digging deeper…