sshole: the OpenSSH bug that lets a long password open an account with no password

On 5 November 2026 the OpenSSH project shipped an emergency release, OpenSSH 10.6p2, to close a password authentication bypass. The researcher who found it, Özgün Kültekin of Wakefield, named it sshole. It is tracked as CVE-2026-123158 and scored 8.1 (high) on CVSS 3.1. In plain terms: on some Linux systems, an attacker can log into … Read moresshole: the OpenSSH bug that lets a long password open an account with no password

Fifty Signatures and a Moving Nonce: How the $6.3 Billion Binance Hack Worked

Updated October 31, 2026. This is still developing: Binance hasn’t published its post-mortem yet, so some of what follows is reconstruction from on-chain data and early analysis. Where something is confirmed, assessed or still unknown, I say so. On the evening of Thursday, October 29, 2026, an attacker took about $6.3 billion in crypto out … Read moreFifty Signatures and a Moving Nonce: How the $6.3 Billion Binance Hack Worked

PHP2Shell Explained: How an Out-of-Memory Error Became Remote Code Execution

On 21 October 2026, the PHP project shipped an emergency release to fix two critical vulnerabilities that live in the PHP engine itself, not in any application running on top of it. Researchers named them PHP2Shell, and the name is a promise: send the right HTTP requests to a vulnerable server, no login required, and … Read morePHP2Shell Explained: How an Out-of-Memory Error Became Remote Code Execution

The Bottleneck Moved: Open Source Security After Cheap Bug-Finding

Anyone can now afford to audit the code they depend on. That’s the easy part — and it’s not where the shortage is anymore. For five years, a Coldcard hardware wallet could generate a private key that a stranger could guess. The bug was mundane. A March 2021 firmware release set a build flag called … Read moreThe Bottleneck Moved: Open Source Security After Cheap Bug-Finding

Building Networks That Don’t Need Permission: Reticulum vs. FIPS

The Internet has become one of the most important pieces of modern infrastructure—but it’s also built on a surprising amount of centralized trust. Every time you connect online, you’re relying on Internet service providers to assign addresses, DNS servers to translate domain names, certificate authorities to verify identities, and registrars to determine who owns a … Read moreBuilding Networks That Don’t Need Permission: Reticulum vs. FIPS

Nostr and the Architecture of Freedom

For most of the internet’s life, the first thing you do online is ask permission. You ask a company for an account. You hand over an email, a phone number, a slice of your identity, and in return you get a username that can be revoked the moment you say the wrong thing. We have … Read moreNostr and the Architecture of Freedom

CleanThis.io: The File You’re About to Send Probably Knows Too Much

Every file you share is a little more talkative than you’d like. That PDF contract has the name of every person who edited it, when, and on what machine. The photo you posted last weekend quietly broadcasts the GPS coordinates of where you took it. The Word doc a colleague forwarded to you might be … Read moreCleanThis.io: The File You’re About to Send Probably Knows Too Much

The Internet Dies. N.O.M.A.D. Doesn’t.

Open Source · Survival Tech The Internet Dies. N.O.M.A.D. Doesn’t. A scrappy open-source project has quietly turned a stock Linux box into a fully self-contained offline computer — complete with Wikipedia, Khan Academy, local AI, and downloadable maps. 13,000 GitHub stars later, the world is paying attention. In most emergency preparedness conversations, “go bag” means … Read moreThe Internet Dies. N.O.M.A.D. Doesn’t.

Motorola and GrapheneOS Announce Strategic Partnership to Build a Privacy-Focused Smartphone

In a major development for the mobile privacy ecosystem, Motorola has officially announced a long-term partnership with the GrapheneOS Foundation to bring the security-focused operating system to a future Motorola smartphone. The announcement was made during Mobile World Congress (MWC) in Barcelona, marking one of the most significant milestones in the history of GrapheneOS. For … Read moreMotorola and GrapheneOS Announce Strategic Partnership to Build a Privacy-Focused Smartphone

Mullvad’s QUIC Obfuscation Brings WireGuard Back to Life

WireGuard, once praised as the lean, modern, and lightning-fast VPN protocol, has increasingly found itself under siege by state-level censorship systems. From China to Russia, deep packet inspection (DPI) technologies are learning to detect and block it almost instantly — a reminder that speed and security don’t always equal stealth. But a new development by … Read moreMullvad’s QUIC Obfuscation Brings WireGuard Back to Life

Collaborations & press enquiries: s-foot-aade7b@nomadscrolls.net · s-foot-0096cd@nomadscrolls.net · s-foot-7ad09f@nomadscrolls.net · full contact directory