Archive - Tolmo

One byte in nginx, and why 90 days is too long

F5 just patched CVE-2026-93479, a heap off-by-one in nginx's script engine we reported in July. The bug took four days to fix and 81 to disclose. That…

19 hrs ago

What is a white box penetration test?

Why it matters more in the age of AI attackers

Oct 6

September 2026

Pre-auth RCE on MikroTik: exploited before the patch, rebuilt in three hours

We rebuilt the full exploit from the public advisory and patch diff in about three hours.

Sep 6

June 2026

Fable 5 wrote a Windows kernel in 38 minutes

Fable 5 wrote a booting, NT-shaped kernel in Rust in 38 minutes. The code is impressive; the signal is what it tells us about AI-authored trust, and the…

Jun 23

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts