Posted on
The Hugging Face Incident Is Not an AI Story
A security engineer’s analysis of the OpenAI-Hugging Face incident, what failed in the architecture and incident response, and the lessons security teams can learn from it.
This blog is where I share my thoughts on security, software engineering, and navigating a career in tech. Some of it will be deep technical dives, some will be lessons from experience, and some will be the kind of things I wish someone had told me earlier.
What you'll find on this blog:
Blog posts
A security engineer’s analysis of the OpenAI-Hugging Face incident, what failed in the architecture and incident response, and the lessons security teams can learn from it.
CVE-2026-64638 is a pre-authentication reflected XSS affecting the WordPress core login page in versions 6.4 through 7.0.2. This post explains the parser differential, the affected versions, the fix, the conditional RCE extension, and a hands-on reproduction lab.
WP2Shell is an unauthenticated remote code execution chain in WordPress core, combining CVE-2026-63030 and CVE-2026-60137. What it is, how to fix and detect it, and how to reproduce the full pre-auth RCE in a hands-on lab.
AI can generate code faster than most developers can evaluate it. The risk isn't only bad output. It's losing the understanding you need to tell good code from plausible code.
AI makes it dramatically cheaper to produce software that appears to work. But 'building an app' and 'engineering a system' are two different activities that people keep confusing, and the gap between them is where most of the actual work lives.
Security is having a moment: new tools can read code, find bugs, and even suggest fixes. Some people took that to mean cybersecurity is basically over. This is my take from the inside: what’s actually changing, what isn’t, and why security was never just a code problem.
More posts
How a nested digest[email] parameter becomes autofocus and onfocus attributes in a newsletter signup, including the payload, vulnerable code and fix.
How a Base64-encoded return reference leads to IDOR in a financial action: the request, decoded JSON, modified payload, vulnerable code, impact, and correct ownership check.
This post is all about the “big ideas” behind secure systems, like least privilege and separation of duties. These principles are surprisingly simple but form the backbone of how we design systems to stay safe from attacks.
How do systems make sure the right people get in, and the wrong ones stay out? In this post, we’ll dig into authentication (proving who you are) and authorization (what you’re allowed to do). They’re simple ideas, but they have a massive impact on security.
Practical insights on security, software engineering, and career, delivered when I publish something worth your time.
Unsubscribe anytime.