Capital de Tokens
Brotli and CVE-2026-111497: When Decompressing a Response Becomes a Security Risk
A memory-corruption flaw in the Brotli decoder affects multiple runtimes. Learn how it works, when exposure is real, and how to remediate it without sensationalism.
Capital de Tokens
Blog
Ideas, analysis, and independent articles from the channel and its episodes.
Blog RSSMitigating Brotli Without Breaking Ubuntu: fwupd, PackageKit, and Automatic Updates
An anonymized, reversible Linux case study: reduce exposure to CVE-2026-111497 by blocking unnecessary services without removing libbrotli1 or disabling security updates.
SSRF: When a URL Makes a Server Cross Its Own Trust Boundary
What Server-Side Request Forgery is, why redirects and DNS rebinding matter, and how to secure downloads with layered defenses.
Will AI Replace GRC Cybersecurity Jobs? Tasks, Accountability, and New Risks
What AI can automate in governance, risk, and compliance, why accountability remains human, and how to prepare with NIST and ISO 42001.
Is AI a New Digital Species? Mustafa Suleyman's Metaphor Meets Real-World Agents
In a 2024 TED talk, Mustafa Suleyman compared AI to a new digital species. We unpack action quotient (AQ), autonomous agents, consciousness, safety, and human control.
Is the Open Internet Ending? PHP2Shell, Broken Certificates, and AI Agent Risks
A week of security incidents fueled predictions about the end of the open internet. What PHP2Shell and eMudhra prove, what DeepSeek claims do not, and how to secure connected systems.
Claude Duet: The AI That Stops Waiting for Prompts and Starts Managing Work
Anthropic introduces Claude Duet, a proactive agent with memory, app connectors, and a cloud computer. We examine its architecture, approval boundaries, usage costs, and limitations.
PHP2Shell: how AI uncovered critical PHP flaws—and what the 70% of the Internet claim means
Two memory-safety bugs in PHP's core can enable unauthenticated remote code execution under certain conditions. How AI-assisted researchers found them, why the 70% headline misleads, and how to patch.
Why Anthropic Replaced Git with Scion: Source Control at Agent Scale
Anthropic migrated a giant monorepo from Git to Scion in five months. We unpack the client-server architecture, changesets, tiered caching, results, and practical lessons.
vidIQ in ChatGPT: analyze YouTube, retrieve transcripts, and manage credits
A practical guide to vidIQ's ChatGPT integration: transcripts, MCP, pricing, free-plan limits, permissions, and security.
AI's scientific crisis: 49 out of 50 in physics and 722 initial manuscripts
AI agents can now solve unpublished physics problems, generate mathematics at scale and contribute to biology and fusion research. What is verified, what remains uncertain and why scientific review is the next bottleneck.
AI Can Now Solve Math Problems. Who Will Build the Knowledge?
A critical reading of Giordano Scarciotti's video in light of OpenAI's mathematical manuscripts: Lean proofs, human understanding, research incentives, and the future of mathematics.