Over six weeks I rebuilt a 30-year-old poetry site with an AI coding partner and logged every security issue it produced: 59 of them, from a one-line config change that took the whole site down to a 90-minute triple credential leak. Two became actual incidents; a control caught all 59. Here is the pattern behind them, Self-Attested Safety, and the controls that caught every one.
CISA added CVE-2021-39935 to the KEV catalog on February 3, 2026 – a 2021 GitLab SSRF vulnerability now seeing active exploitation. The federal remediation deadline is February 24, 2026. This is worth examining not because it’s novel (GitLab patched it in October 2021), but because the threat model around CI/CD attack surfaces has fundamentally changed … Read more
Fortinet’s CVE-2026-24858 highlights a critical architectural anti-pattern that every product security team should understand: authentication bypass through alternate paths in SSO implementations. This critical zero-day (CVSS 9.4) allowed attackers with any FortiCloud account to authenticate to other customers’ FortiOS, FortiManager, and FortiAnalyzer devices – even on fully patched systems that had addressed previous SSO bypasses … Read more
