Things I build, break, fix, and write about

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract gets involved. SideStaking turns a neat little pool into something that stops agreeing with itself, and the numbers do not lie for long.

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

14 September 2026
Chaining logic bugs in Microsoft Edge sandbox escape

Microsoft Edge sandbox escape chains do not need memory corruption if the trust checks are loose enough. Orange Tsai’s Pwn2Own chain was nasty...

14 September 2026
Runtime guardrails for multi-agent reproduction

Multi-agent reproduction is useful until state leaks make a neat-looking result lie for you. I prefer hard runtime boundaries, separate containers,...

Latest blog posts you might like

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract gets involved. SideStaking turns a neat little...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not proved consent, you have just accepted a tuple and...

14 September 2026
Chaining logic bugs in Microsoft Edge sandbox escape

Microsoft Edge sandbox escape chains do not need memory corruption if the trust checks are loose enough. Orange Tsai’s Pwn2Own chain was nasty precisely because each bug looked small, then the browser...

14 September 2026
Runtime guardrails for multi-agent reproduction

Multi-agent reproduction is useful until state leaks make a neat-looking result lie for you. I prefer hard runtime boundaries, separate containers, and a patched build kept out of reach until...

14 September 2026
Weekly Tech Digest | 14 Sep 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

13 September 2026
Tracing ransomware detection gaps in incident response

Ransomware rarely announces the whole story at once; the ugly part is the quiet between alerts, when EDR stops at the first host and logs age out. I keep coming back to ransomware detection gaps,...

13 September 2026
Prompt logs on compromised endpoints in Claude Code

Prompt logs on a compromised machine tell a better story than the final code ever will. I trust those scraps more than polished output; they show how cloud AI coding assistants were pushed, where they...

12 September 2026
Monitoring priorities after AI agent sandbox escapes

When an agent slips its cage, the first mistake is pretending the tidy report will do. I’d keep the raw prompt logs, session artefacts, and every trace I can get hold of, then rebuild the AI sandbox...

12 September 2026
Lateral movement risks inside operational technology

Operational technology network segmentation is often where the good intentions stop and habit takes over. I’ve seen enough flat OT layouts to know that once one workstation falls, the rest of the...

11 September 2026
URLPattern out-of-bounds read in workerd

Cloudflare workerd memory corruption is the sort of bug I dislike most, because the JavaScript looks fine while the C++ glue quietly wanders off the edge. If you run Workers or Code Mode, patching is...