Posts from 2026
Doing the TWCA certificate replacement yourself: find the key, build the chain, install, confirm
The TWCA notice zip holds only the new certificate and needs the original key. How to find the server and key, merge with TWCA's tool or openssl, then install.
Where ‘2.1 million unpatched servers’ came from: CVE-2026-98432 scans and patch streams
Trace the CVE-2026-98432 scan figures to their source, check RHEL and Ubuntu patch streams, and assess the limits of mitigation and exploitation evidence.
Is your TV box, or your car's head unit, safe? XCPE and the backdoor that outlives the takedown
In its November 2026 report, Google says XCPE enrolled more than 1.3 million set-top boxes. The takedown left implants on sold devices.
Reading Binance's initial report: the intrusion path and the EIP-7702 authorisations
Binance's initial report links compromised work computers to EIP-7702 authorisations. The intrusion path and deployment token still need independent review.
Linux TCP flaw CVE-2026-98432: patch status and what to check
Check Linux CVE-2026-98432 patch availability, AWS service actions and running kernels, with the limits of MPTCP and IPv4 packet filtering explained.
What should an exchange publish so outsiders can keep checking assets, liabilities and delivery?
Proof of reserves covers one snapshot. Here is what an exchange should publish so outsiders can keep checking assets, liabilities and withdrawals.
What Background Agent Status Summaries Cost: Attributing Model Calls by query_source
One report puts Claude Code summaries at 16.4% of estimated cost. Grouping api_request events shows why workload and denominators matter.