Vulnerabilities

Real vulnerabilities, how they happen, how to fix them.

Brass dial of an old safe on a weathered wooden door

Vulnerabilities2 Sept 2026 · 4 min read

29 million secrets on GitHub: what AI changes about leaked keys

GitGuardian's annual report counts 28.65 million secrets exposed on public GitHub in 2025, +81% for AI keys, and Claude Code-assisted commits leaking at twice the average rate. How a key ends up in a bundle, and how to stop it.

Close-up of a star-shaped crack in a pane of glass against a blurred background

Vulnerabilities8 Aug 2026 · 6 min read

React2Shell: how a deserialization flaw took React Server Components to a 10/10

CVE-2025-55182 let anyone run code on any Next.js 15 or 16 App Router server, unauthenticated, even with not a single Server Function declared. Anatomy of the Flight protocol, of the flaw, and of what still needs checking eight months later.

Close-up of a rusty chain above a metal grate

Vulnerabilities5 Aug 2026 · 5 min read

ChainDrop: an npm worm shipped 444 poisoned packages with valid signatures

On August 4, a self-propagating worm infected more than 400 npm packages downloaded around 2 billion times a month, through their maintainer's own CI pipeline. The signatures were valid. That's exactly the problem.

Vulnerabilities28 Jul 2026 · 5 min read

Axios, three hours compromised: what the post-mortem teaches every JavaScript project

On March 31, two poisoned versions of axios (100 million weekly downloads) stayed live for about three hours. The malicious dependency had been staged the day before so it wouldn't look brand new.