Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIAgentic Browsers Rewind Web Security by 20 years
A new class of vulnerabilities called 'PleaseFix' has been discovered in agentic browsers that makes them susceptible to social engineering attacks. These flaws expose critical weaknesses in how AI-powered browsers handle cross-origin requests, potentially reversing two decades of web security progress as autonomous agents interact with web applications without proper security controls.
AIDriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks
DriveSurge, a large-scale initial access broker (IAB) operation, is leveraging a malicious traffic distribution system (TDS) to compromise thousands of legitimate websites. The campaign redirects unsuspecting visitors from trusted sites to malicious destinations that deploy ClickFix and FakeUpdate malware attacks, representing a significant supply chain security threat.