RC RANDOM CHAOS

access-control

41 posts

Two failures are not one attack.
Article

Two failures are not one attack.

A heap overflow and SSO misconfiguration compromised OpenAI internal repos. Two controls named as present, neither enforced in effect.

Baseten lost production GitHub admin in 25 minutes
Article

Baseten lost production GitHub admin in 25 minutes

Admin access to Baseten's production GitHub was reached in 25 minutes. A briefing on the identity boundary that failed and what the number means.

Every new feature makes iOS 27 less safe
Article

Every new feature makes iOS 27 less safe

iOS 27, iPadOS 27, and macOS 27 concentrate risk at one point: whether a capability re-checks identity at execution, not at the moment consent was captured.

You depended on access you never owned.
Article

You depended on access you never owned.

Google's anti-scraping update changed a control scrapers never owned, exposing the structural risk of building on an interface you cannot see or govern.

Chrome exempts Google's domains from user site-data controls
Article

Chrome exempts Google's domains from user site-data controls

Chrome does not enforce user site data settings against Google-owned domains. What the exempt scope means and how to treat the control.

The system ran one veteran 100 times
Article

The system ran one veteran 100 times

One person was queried 100+ times in a Flock tracking system. When identity is the only enforced gate, abuse completes exactly like legitimate use.

Verification became the leak
Article

Verification became the leak

An unauthorized live feed of every ID verification let attackers bypass MFA for over a year. Why readable verification output stops being proof.

Nobody had to hack your meetings.
Article

Nobody had to hack your meetings.

Over 180,000 tl;dv meetings were left open because access to recorded content was not conditioned on validated identity. What that failure exposes.

The record is the authority
Article

The record is the authority

A for-sale DNS record sells naming authority itself, and every control above DNS keeps validating the name for whoever now holds the record.

The camera on your shelf handed out your GPS
Article

The camera on your shelf handed out your GPS

A TP-Link Kasa camera returned home GPS over unauthenticated UDP for six years. The mechanism, the pattern it exposes, and what must now be true.

TS-2026-009 turned an argument into root
Article

TS-2026-009 turned an argument into root

TS-2026-009: Tailscale SSH permitted root through argument handling. When supplied input can reach the privilege context, argument handling is the access control.

An open door where the gate should be
Article

An open door where the gate should be

GitHub's AI agent returned private repo content when tricked, proving it holds read reach across the private boundary with no enforced refusal.