Thoughts, tutorials, and insights on IT infrastructure, cybersecurity, and systems administration.
Microsoft quietly fixed a CVSS 10.0 flaw in Azure AI Language Authoring that needed zero credentials to tamper with deployed language models — no patch to install, no PoC, barely a paragraph of explanation. Here's what the advisory says, and what it doesn't.
DPRK-linked STARDUST CHOLLIMA hijacked a dormant Mastra maintainer account and mass-published a poisoned dependency across 131+ npm packages in 88 minutes, stealing credentials from AI developers before they ran a single line of their own code.
A BBC reporter's laptop was compromised without a single click — through an AI coding platform called Orchids. No malicious download, no phishing link, no user error. This is what happens when AI agents get deep system access before anyone secures them properly.
In early February 2026, researchers discovered a live attack campaign where hackers embedded DeepSeek and Claude directly into their intrusion workflow — automating FortiGate SSL VPN attacks across 2,516 targets in 106 countries. This is a breakdown of exactly how the tooling worked, and what infrastructure teams need to do right now.