The Decade-Old Bug Is Now a One-Week Find
AI vulnerability discovery is turning years-old bugs in PHP and Linux into week-long finds. What old code you expose, who owns it, and a checklist.
Writing · Tag
Posts tagged AI startups
32 posts on AI startups, page 1 of 3. Or browse the full writing index →
Posts tagged AI startups
php2shell: What to Do if Your Servers Run PHP
Two critical PHP flaws, php2shell, got fixed on Oct 21. A triage order for anyone with PHP on a server: inventory, patch and restart, mitigate, isolate.
eMudhra Distrust: Why Bumping castore Won't Save Req
Eight eMudhra CA keys were guessable. Browsers blocked them in hours. Req reads CAs from the OS first, so bumping castore usually does nothing. Here's the fix.
What a Fractional Chief AI Officer Does for Dev Teams
A fractional Chief AI Officer for a 5-20 engineer team owns the daily agent workflow, not a governance board. The four jobs and the first 30 days, week by week.
Claude Code and SOC 2: The Evidence Your Auditor Wants
Engineers run Claude Code and the auditor wants proof. The managed settings that work as controls, the SOC 2 criteria they support, and the evidence to give.
Omarchy on a Company Laptop: The SOC 2 Verdict
An engineer wants to run Omarchy on a company laptop. Here's the verdict a security lead signs off on, control by control, for a SOC 2 Type II shop.
Model Routers Are Vendors. Review Them Like One.
PRC labs harvested their own users' sessions, many arriving via third-party model routers. The fix is treating the router as a vendor.
Anthropic's Extreme Scenario Has a Precondition
Anthropic published an economic upside scenario and an alignment risk admission the same week. The upside needs the thing nobody has a plan for.
Agents Don't Need Prompts. They Need Managers.
Agents stop before the work is done, not because the model is lazy but because nobody built the management system a human employee gets for free.
Most Security Controls Assume a Team You Don't Have
Security checklists only ever grow, because nobody who writes them pays the cost of a control a small team cannot staff. Which to defer, and which never wait.
Nobody Got Replaced. Agents Got Added.
McKinsey didn't swap 25,000 people for AI agents. What its CEO actually said is more useful to founders, and changes the question to ask before hiring.
Multi-Tenant AI SaaS in Phoenix: Isolation That Holds
Tenant isolation for AI SaaS in Phoenix: per-tenant API key tradeoffs, Ecto context scoping, and the pgvector bug that leaks one tenant into another.