Web Security is Too Hard

Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet'

Supply chain attack on arrayref

Broadcom Pledges to Lock Down Open Source Python, Java Libraries

What's in a tag name? JavaScript, apparently

Bypassing Android Hardware Attestation from the Analyst's Chair

Deadbugz: Currently Active MCP Supply-Chain Campaign

I found a KVM guest-to-host heap corruption bug and someone else got there first

Tl;dv: Over 180k meetings left wide open

21,000 MCP servers exposed: the protocol reaches a security inflection point