@damianobianda

Damiano Bianda

@damianobiandaJoined October 2026

Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.

About

Nothing here yet.

Available for

Nothing here yet.

Damiano Bianda's blogs

Damiano Bianda's Dev Notesdamianobianda.hashnode.dev17 posts

GitLab Was Patched, the Server Was Still Vulnerable: CVE-2026-97229 Lives in Ruby

On October 20, 2026, someone registered an account on Alpine Linux's public GitLab instance and started sending it crafted CI configurations. The instance crashed eight times over two days. Four of th

19h ago · 6 min readdamianobianda.hashnode.dev

Your PDF says AES-256. The key had 9 bits of entropy

Open a password-protected PDF and the properties dialog will proudly tell you the document is secured with AES-256. That number describes the cipher. It says nothing about the key. This week, Rick de

1d ago · 6 min readdamianobianda.hashnode.dev

CVE-2026-97631: A 16-Year-Old Buffer Overflow That Runs Before Your Defenses Do

Your server's security model has a load-bearing assumption buried in it: the code that runs first is trustworthy. Secure Boot, the TPM, disk encryption, remote attestation — all of it sits on top of f

2d ago · 7 min readdamianobianda.hashnode.dev

One Token Leaked 155 AI Responses: Inside Cloudflare's GLM-5.3 KV Cache Exposure

On September 8, 2026, a security researcher told Cloudflare that very long prompts sent to one of its hosted models sometimes came back with text from other customers' sessions. Cloudflare reproduced

3d ago · 8 min readdamianobianda.hashnode.dev

The Brotli flaw is in .NET now: Microsoft's out-of-band patch, and the self-contained trap

Yesterday I wrote about HTTP2Shell: CVE-2026-111497, a buffer overflow in the Brotli decoder that ended up in Node.js's HTTP stack and a long tail of Python packages. Today the same CVE forced Microso

4d ago · 4 min readdamianobianda.hashnode.dev

Damiano Bianda

About

Available for

Damiano Bianda's blogs

GitLab Was Patched, the Server Was Still Vulnerable: CVE-2026-97229 Lives in Ruby

Your PDF says AES-256. The key had 9 bits of entropy

CVE-2026-97631: A 16-Year-Old Buffer Overflow That Runs Before Your Defenses Do

One Token Leaked 155 AI Responses: Inside Cloudflare's GLM-5.3 KV Cache Exposure

The Brotli flaw is in .NET now: Microsoft's out-of-band patch, and the self-contained trap

Search Hashnode

Damiano Bianda

About

Available for

Damiano Bianda's blogs

GitLab Was Patched, the Server Was Still Vulnerable: CVE-2026-97229 Lives in Ruby

Your PDF says AES-256. The key had 9 bits of entropy

CVE-2026-97631: A 16-Year-Old Buffer Overflow That Runs Before Your Defenses Do

One Token Leaked 155 AI Responses: Inside Cloudflare's GLM-5.3 KV Cache Exposure

The Brotli flaw is in .NET now: Microsoft's out-of-band patch, and the self-contained trap