Build a JavaScript cost calculator that models per-token API pricing against self-hosted open-weight inference, including GPU, utilization, and ops overhead, to decide when $0.10/M APIs beat owning the stack.
A technical walkthrough of designing graceful degradation across Microsoft 365 dependencies, covering Entra ID authentication fallbacks, Exchange Online mail-flow contingencies, Teams failover paths, incident communication, and the DR runbook additions platform teams need to survive multi-day SaaS…
A technical audit guide to the wfx-loot campaign, tracing malicious GitHub Actions triggers, over-scoped OIDC cloud tokens, and npm execution paths to build detection and containment controls for CI/CD pipelines.
This deep technical walkthrough examines the Node.js security releases addressing HTTP/2 session-abort crashes and HTTPS heap disclosure vulnerabilities, providing steps to assess API server exposure and implement patches or mitigations.
The wfx-loot campaign didn't break authentication — it logged in. Stolen GitHub accounts pushed workflows, and GitHub Actions did the rest: checkout, npm install, then an OIDC token exchanged for cloud credentials. This short walks the audit path from the OX Security reporting: the pull_request_target and workflow_run trigger shapes that put secrets in the same job as attacker-controlled code, the id-token: write permission that mints a bearer credential nobody has to store, and the npm lifecycle scripts that run inside the runner. What the video shows: - The vulnerable trigger, write token, OIDC identity and head-ref checkout in one job - A two-command grep triage pass over .github/workflows (triage, not proof — read every hit) - The fix order: plain pull_request trigger, contents: read, no id-token: write on fork-reachable jobs, installs without lifecycle scripts Note on scope: public reporting contains no workflow filenames, payloads, hashes, IOCs or CVE, and this isn't a GitHub Actions vulnerability — every capability used is documented platform behaviour. So detection is written against the pattern, not the campaign. Everything here is defensive and lab-scoped. Full write-up: https://hackyjs.com/posts/auditing-github-actions-for-the-wfx-loot-pattern-workflow-triggers-oidc-scope-and-npm-execution
Node.js published security releases on 11 November 2026 covering 16 vulnerabilities, and two of them shape your risk differently: an HTTP/2 class that lets a client shut a server down without credentials, and an HTTPS heap disclosure that is low probability but potentially very high severity. This short walks through the mechanism behind both and the two checks that follow from it. First, a secure HTTP/2 server with a stream handler and no session error listener: a try/catch around the stream body covers the stream layer only, and an 'error' event on the Http2Session with nothing subscribed is thrown, which ends the process. Second, the write-length failure that lets uninitialised heap bytes into a TLS response path when a length comes from the allocation rather than the write. The post is explicit about what the news coverage does and does not confirm. CVE identifiers, affected version ranges, fixed versions and CVSS scores are not in the coverage, so they are not repeated here. Read the advisory at nodejs.org/en/blog/vulnerability before a version number goes into a ticket, a customer email or a compliance document. Full write-up: https://hackyjs.com/posts/checking-api-servers-for-exposure-to-nodejs-http2-session-abort-crashes-and-https-heap-disclosure
Microsoft researchers showed that editing fewer than ten neurons can reliably backdoor an AI agent, which puts artifact-integrity controls in an awkward spot. A SHA-256 digest in a model card proves one thing: the bytes you got match the bytes someone hashed. It does not tell you whether those bytes were safe when published, and it cannot promise that a conditional behaviour baked into the weights will never fire. This short walks through why that distinction matters for open-weight supply chains. What the video covers: - the reported result, and the scale of a sub-ten-neuron edit in a 7B-class model - why a backdoor is a conditional failure, not a degradation, and why average-case evals are the wrong instrument - how an existing trigger feature gets routed into tool selection so the malicious branch almost never fires - why a passing digest check says nothing about behaviour Full write-up, including the threat model across the four seams of an open-weight artifact and an explicit list of facts the author could not confirm from the available coverage: https://hackyjs.com/posts/why-a-model-hash-will-not-catch-a-ten-neuron-backdoor Defensive, analysis-only content: no exploit against a real target, no attack tooling.