Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIShipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development
AI-powered development tools are enabling teams to produce 10-50 times more code, creating a critical bottleneck for security teams that still operate at human speed. The challenge has shifted from simply identifying vulnerabilities to preventing security from slowing deployment velocity while maintaining control over what reaches production.
AICryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Security firm Coinspect has traced $5.7 million in cryptocurrency wallet drains to a weak random number generator in CryptoJS that has existed for 12 years. The vulnerable CryptoJS.lib.WordArray.random() function provided insufficient entropy for generating recovery phrases in five affected crypto wallet applications, enabling attackers to compromise wallets in two major sweeps since late May.
AICritical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has patched a critical Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) that allows unauthenticated attackers to read arbitrary files from application servers through malicious image uploads. The flaw can expose sensitive data including secret keys, database passwords, and cloud storage credentials, posing significant security risks to Rails applications.
AIRoute public traffic to private applications with Cloudflare
Cloudflare is launching Application Services for Private Origins in closed beta, enabling enterprise customers to route public internet traffic to private applications without exposing them publicly. This capability extends Cloudflare's security, performance, and programmability services (WAF, bot management, rate limiting, caching, Workers) to private origins using existing private network connec
AIThe Hardest Fork
The Mythos vulnerability represents a significant security threat that goes beyond typical code vulnerabilities, involving novel chains of dozens of existing issues that SAST scanners identify but don't flag as critical when combined. Despite industry skepticism dismissing it as marketing hype, the findings reveal sophisticated attack vectors created through creative exploitation of multiple seemi
AIAI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
A security startup's autonomous AI agent discovered 21 zero-day vulnerabilities in FFmpeg, a widely-used media library embedded in countless video applications. This AI-driven discovery coincided with Google's Chrome 149 release, which patched a record 429 security bugs—though notably, only the FFmpeg vulnerabilities were identified through AI methods.