←All topics

llm

2 pieces of writing

vm212 min read

vm2, NodeVM and Ollama show why JavaScript runtime isolation keeps failing at 300,000 deployments

Recent vm2, NodeVM and Ollama flaws show a recurring failure pattern: developer-friendly JavaScript isolation is being treated as a hard security boundary when the runtime was never designed to provide one.

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds
vulnerability9 min read

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds