From the 5bats blog

Short, practical notes on the threats 5bats is built for — supply-chain attacks and prompt injection — explained plainly, and where useful, shown stopped with a 5bats tool.

July 13, 2026

Why you should never click a link in an email

The email looks like it is from your bank. There is a problem with your account, it says, and you have twenty-four hours to confirm your details or it will be locked. There is a button. Your heart rate ticks up, your thumb moves toward it, and that small jump, from worry to tap, is the entire attack.

Read the article →

June 30, 2026

The private messenger that never asks for your phone number

You probably send dozens of messages a day without thinking about who, besides the person you are texting, gets to know about it. It is a fair thing not to think about, until you do. And the surprising part is that the riskiest piece is usually not what you wrote. It is everything around it. This post is about what “private messaging” actually means for an ordinary person, and about one app that takes the idea further than most, partly because the team behind it has just had to fight to keep it alive.

Read the article →

June 29, 2026

The install step is the most dangerous moment in your day

It is a Tuesday morning. A developer pulls a popular open-source package, one they have installed a hundred times, and runs the install. Nothing looks wrong: the progress bar fills, the prompt returns, they move on. What they cannot see is that the version they just pulled went up four hours ago, and that buried in its install script are a few lines that read their SSH keys and environment variables and post them to a server they have never heard of. By the time an advisory is filed, the keys are already gone.

Read the article →

June 23, 2026

You only need to remember two passwords

“I don’t have much — why would anyone come after me?” It is one of the most common things people believe about their safety online. It is also the belief that does the most damage. Consider what it cost one person. Sure they were too ordinary to be worth targeting, they used a single password they could remember — a genuinely strong one — for everything: email, the social accounts, the shopping sites. And, because it was easier, for online banking too. Then one of those sites was breached, the way sites are breached every week. The leaked password was tried automatically against every other account — and it worked. They found out when the bank account was empty and there was nothing left to pay with. The following weeks ran on borrowed money.

Read the article →

June 20, 2026

TrapDoor: 34 packages went bad overnight, and a 3-day rule would have stopped them

In late May 2026, security researchers disclosed a supply-chain campaign that came to be known as TrapDoor. More than 34 malicious packages went up across PyPI, npm and Crates.io at roughly the same time. They were not broken or buggy. They were built to run hostile code the moment they were installed or imported, scraping SSH keys and credentials off the machine and sending them to the attackers (reported by The Hacker News , 25 May 2026).

Read the article →