Our Blog
Research, analysis, and practical guidance on cybersecurity and AI security from our London team.
Get new posts by email
Security and AI research from our team, when we publish. No spam, unsubscribe anytime.
Provably Hidden Capabilities: Why AI Model Evals Can't Prove a Model Is Safe
New research shows a backdoor can embed an encrypted network inside a model's weights, leaving it hard to elicit or interpret without a secret trigger. If the result holds up, capability evaluations can show that a model is dangerous but cannot show that it is safe.
Project Zero: Build Your Emergency Patch Path Before You Need It
Google Project Zero argues that for most vendors the slow part of an urgent fix is testing and delivery, not finding or writing the patch. It surveys four mechanisms that shorten that window.
Qwen3-Coder Writes Less Secure Code Depending on Who It Is For
Hirundo reports that Qwen3-Coder's code security shifts with the customer named in the prompt, and that removing the model's CCP alignment removes the gap. The findings come from one vendor and are not independently replicated, but they matter for anyone shipping AI-generated code.
Project Zero on Emergency Patching: Four Ways to Fix a Bug Faster
Google Project Zero's Natalie Silvanovich argues that testing and delivery, not triage or coding, are what slow emergency fixes. The post sets out four mechanisms vendors can build before the next actively exploited bug arrives.
Dangling COM Registrations: How a Missing DLL Became a Windows SYSTEM Exploit
Google Project Zero's James Forshaw detailed CVE-2026-66804, an incomplete fix for the 'Dark Elevator' bug. A COM class registered system-wide but pointing at a DLL that did not exist let any local user plant code and run it as SYSTEM.
Emergency Patching: Project Zero on Fixing a Bug in a Fix
Project Zero argues that when vendors say they can't fix an exploited bug quickly, the bottleneck is usually testing and delivery rather than triage or coding. Its post surveys four rapid-remediation mechanisms that vendors, and the enterprises that depend on them, should plan for before an emergency.
Project Zero on emergency patching: fixing exploited bugs faster than a normal release
Google Project Zero argues that vendors should build ways to remediate a few urgent vulnerabilities much faster than their normal update cycle. The delay is mostly in testing and delivery, not in writing the fix.
Two critical PHP RCE flaws fixed: what to patch and why mod_php is the worry
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Both are memory-lifecycle bugs in request handling, so the exposure sits in the runtime rather than in your application code.
Agent Skills Move to the Linux Foundation's AAIF: What Security Teams Should Take From It
Anthropic is donating the Agent Skills standard to the Agentic AI Foundation, the same body that now hosts MCP. Neutral governance helps, but it doesn't make third-party agent extensions safe to trust.
Why 25 Years of WEIS Papers on Security Economics Matter to Practitioners
A new public archive collects every paper from twenty-five years of the Workshop on Economics and Information Security. For security leaders, it is a free library on why incentives, not just technology, decide how secure systems turn out.
eMudhra Intermediate CA Keys Compromised: What Defenders Must Update
The private keys of eight eMudhra intermediate CA certificates have been compromised, and they chain to roots trusted by the major root programs. The fix is mostly about trust-store hygiene, which is slow to roll out.
Battle Drones: Treating a Vibe-Coded Game's Audio Link as Untrusted Input
Simon Willison's agent-built RTS syncs multiplayer state over sound between nearby devices. As a design, it is a small, useful case study in out-of-band channels, determinism and trusting AI-generated code.
Connected Fridges Attacked in France: The Unpatchable IoT Problem
Attackers reportedly took over the software controlling supermarket refrigeration in France and pushed units to heat up overnight. The reported detail that the affected models could not be patched is the part security teams should dwell on.
Self-Training CAPTCHA Solvers Recover From Adversarial Perturbations, Research Shows
A new arXiv paper describes a solver that turns a vision-language model's answers into training labels for a fast detector. In the authors' simulation, it recovered from every attempt to break it. Defenders who treat CAPTCHAs as a static barrier should take note.
Undeclared dependencies: what an LLM plugin break teaches about supply-chain hygiene
A small fix in llm-tools-datasette 0.1.1 shows how a core library's HTTP client swap can break plugins that never declared the dependency. It is a low-severity bug, and a useful reminder for anyone running AI tooling in production.