NLTK’s Text.findall() passes user-supplied patterns to Python’s re engine with no timeout and no complexity check. One request freezes the process indefinitely. CVSS 7.5 High, fixed in 3.10.0.
OpenAI released an LLM-only application security agent. We studied the codebase. Here’s what we found and why Kira chose a different architecture.
Ghost maintained a hardened, DNS-rebinding-resistant HTTP library and used it everywhere except webhook delivery, the one place where an admin directly controls the target URL.
One unauthenticated HTTP request. No login, no token, no credentials. Four independent weaknesses spread across the codebase, none dangerous alone, catastrophic together.
No marketing. Just security findings, attack breakdowns, and research from the Offgrid team when we publish.
No spam. Unsubscribe anytime.