Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
BREAKING: Railway breach exposed customer environment variables. Rotate every secret you stored in Railway
How to fix the Railway environment variable breach: rotate every secret stored in Railway variables, move funds out of any wallet key kept there, and check provider logs for use of the old keys. Railway says an intruder reached encrypted env vars and decrypted some; stolen wallet keys were drained before the notice.
BREAKING: Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.
HOL Guard
DARE: De Anthropocentric Research Engine
DARE is a research skill library for AI agents. Not a tool that helps an agent do research — the research procedure itself, written down in a form an agent can execute.
Three Clueless Examples: Product Review, Evidence Checks, and Plain-Language Research
Three Clueless Examples: Product Review, Evidence Checks, and Plain-Language Research
A creator-approved PDF records three redacted, translated Codex-session examples, with the limits each one leaves in view.
DanilaThree Trust Boundaries Under Pressure: PHP, LiteLLM, and eMudhra
Three Trust Boundaries Under Pressure: PHP, LiteLLM, and eMudhra
Three October 21 security disclosures affected runtime handling, published package artifacts, and certificate authority key generation. Here is what operators should verify at each boundary.
Joel Hillier
BREAKING: GitLab CVE-2026-110264 lets attackers run code on self-managed servers with no login, even ones patched Oct 12
How to fix CVE-2026-110264: upgrade GitLab to 19.5.1, 19.4.3, 19.3.6, or the 19.2.9, 19.1.9, 19.0.10 and 18.11.13 backports. A crafted Org-mode file gives no-login code execution on self-managed GitLab, and servers patched on October 12 are exposed again.
HOL Guard
eMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
HOL Guard
BREAKING: LiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keys
How to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
HOL Guard
BREAKING: PHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
HOL Guard
BREAKING: Plex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)
How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
HOL Guard
Your AI Agent Writes Code. Who's Auditing Its Commits?
A maintainer's guide to conventional-commits-framework — what it does, who it helps, and how to get started.
What I Check Before I Install a Claude Plugin on a Client's Computer
What I Check Before I Install a Claude Plugin on a Client's Computer
A Claude consultant's pre-install checklist for small businesses: who made it, what it tells Claude to do, what it runs, what it touches, what Claude finds when it reviews it, where it gets tested, and who keeps track.
A declaration buys fewer stages, never fewer boundaries
The ai-native-sdlc plugin packages six stages as committed Markdown artifacts and uses an opt-in PreToolUse gate to block uncovered source-code writes.
HOL Guard research desk
Security research for the AI agent era
Threat guides and evidence dossiers on prompt injection, MCP tool poisoning, slopsquatting, and the attacks shaping how teams ship code with agents.
Prompt injection
How hidden instructions trick coding agents into unsafe work.
Read the researchEvergreen guideMCP security
Tool poisoning, overbroad permissions, and shadow MCP servers.
Read the researchNew dossierSlopsquatting and package hallucination
Slopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.
Read the researchNew dossierMalicious extensions and marketplace fraud
Malicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.
Read the research