MCP (Model Context Protocol) has 77k+ stars and is becoming the standard way AI agents connect to tools. We audited both official SDKs (TypeScript and Python) at the source code level and found three classes of boundary-crossing vulnerabilities.<p>All three confirmed with live PoC exploits using the...
The IETF has specs for IP-over-HTTP/3 (MASQUE CONNECT-IP, RFC 9484)
and Multipath QUIC, but no open-source implementation combines both.
I implemented MASQUE CONNECT-IP on XQUIC (which already had Multipath QUIC),
and wrote a new multipath scheduler designed for QUIC Datagrams, then built a V...
Diesel Vortex: Inside the Russian cybercrime group targeting US and EU freight
(haveibeensquatted.com)
Hi HN,<p>I built VVMList for cybersecurity learners to easily find specific techniques used on specific machines.<p>A few years ago, I originally created VVMList to track the machines I completed and the techniques I used to solve them. After some time, I semi-abandoned the project.<p>At the end of ...
We built tork-scan, a free open-source CLI that checks AI agent skills (MCP tools) for 19 security risk patterns — reverse shells, credential harvesting, base64 payloads, eval(), C2 domains, and more.<p>We pointed it at 500 ClawHub skills. Results:<p>- 200 (40%) SAFE (90-100)
- 150 (30%) CAUTION (70...
Slides: https://fosdem.org/2026/events/attachments/ETMLM8-signed_sealed_stolen_how_we_patched_critical_vulnerabilities_under_fire/slides/267683/slides-ex_msapjhv.pdf