A technical walkthrough for benchmarking Baseten's 2B joey-1 decision model at $0.01 per 1M tokens against general LLMs, covering throughput, retry behavior, and total cost before production model swaps.
Mistral's release of Mistral Large 4 weights under terms that still require hosting providers to obtain a license complicates the 'open' label, so this walkthrough breaks down what self-hosting, redistribution, and commercial API builders can actually do.
A deep technical walkthrough of how attackers abused GitHub issues across 61 repositories in under an hour through automation and social engineering, and how maintainers can audit permissions, workflows, and CI triggers to harden issue-driven pipelines.
A deep technical audit of the ChainDrop npm worm that compromised 400+ packages with valid provenance, mapping token scope, publish automation, OIDC configuration, and postinstall execution gaps and practical CI defenses.
A 57-second walkthrough of the reproducibility audit for Apex-35B-V1.0, a Qwen3.6-based model reported to be built with AI research agents. What the announcement actually states, the three different things "built with AI agents" can mean, where an agentic training loop breaks reproducibility, and how to separate model changes from harness changes. Includes counting parameters from a safetensors index instead of trusting the model card, and why a loop that can edit its own eval set is measuring its own editing. Everything about Apex-35B here traces back to the single public report; the rest is mechanism and tooling you can run yourself. This is a defensive audit exercise, not a claim of wrongdoing. Full write-up: https://hackyjs.com/posts/auditing-reproducibility-in-apex-35b-an-agent-built-qwen36-model
WordPress 7.1.4 is reported to fix 22 flaws, including an unauthenticated RCE, but the public record does not name the vulnerable component, affected versions, preconditions, or whether exploitation has been seen. This short walks through the defensive work you can still do: snapshot the database and files, verify core checksums before and after the update, freeze plugin auto-updates, audit plugin status, and treat unknown reachability as reachable. Patch core first, verify it, then update plugins. Full write-up: https://hackyjs.com/posts/verifying-wordpress-714-core-and-plugin-updates-against-the-unauthenticated-rce
A 55-second defensive walkthrough of the detection model for PHP2Shell: a web shell on a PHP host that becomes root through a Linux kernel exploit, and the telemetry that exposes each step. In this video: - Why the access log's path, status and byte-count triple beats any User-Agent or keyword rule, and how a 41-byte probe becomes a 2 MB dump on the same PHP URL. - php-fpm's request slow log: a five-second timeout turns a blocked enumeration request into a stack trace naming system() and eval() inside an uploads directory. - File integrity beyond mtime: attackers can copy a file's modified time, but the change time records when utimes() was called, so an old mtime next to a fresh ctime is a triage filter, not a verdict. - Process ancestry: on a well-built PHP fleet the web user almost never executes anything, which makes execve accounting for uid 33 a low-volume, high-value feed rather than a firehose. - The choke points to ship first, and why kernel patch cadence, not WAF rules or disable_functions, is the control that decides whether a web shell stays an annoyance or becomes a root compromise. On sourcing: this is a detection model built for the shape of the attack, not a reconstruction of a specific incident. The public reporting (CyberSecurityNews, 29 October 2026; The Hacker News, 28 October 2026) establishes a chain referred to as PHP2Shell plus Linux kernel exploits, root on 25 servers, and one U.S. government-affiliated network. It does not give a CVE identifier, affected kernel ranges, the vulnerable PHP component, dwell time or indicators of compromise, so none of that is invented here. Commands and log output were collected on a reproduction host with a deliberately planted dispatcher; all addresses and paths are documentation placeholders. All content is defensive and lab-scoped: detect the shell, scope the process ancestry, close the escalation path. Full write-up: https://hackyjs.com/posts/detecting-php2shell-telemetry-and-choke-points-from-web-shell-to-root