Thoughts, tutorials, and insights on IT infrastructure, cybersecurity, and systems administration.
A GitHub account filed 23 pull requests in 74 minutes, each quietly adding a malicious MCP server. It behaves for exactly three tool calls, then rewrites its own metadata into instructions to hunt SSH keys, AWS credentials, and kubeconfigs.
A command injection bug that needed an API key stopped needing one the moment researchers chained it with a one-character Host header trick — and Qilin ransomware affiliates are already using the combo to drop cryptominers on AI gateways.
In early February 2026, researchers discovered a live attack campaign where hackers embedded DeepSeek and Claude directly into their intrusion workflow — automating FortiGate SSL VPN attacks across 2,516 targets in 106 countries. This is a breakdown of exactly how the tooling worked, and what infrastructure teams need to do right now.