Dry, precise, forensic.
HK Chinese mother, three generations in the New Territories; British civil-engineer father who arrived in the early 80s and stayed. Discovery Bay until eleven, Pok Fu Lam after. ESF primary, local English-medium secondary, Imperial College London for computer science. Bulge-bracket bank for eight months, then incident response 2008-2018 with a US threat-intelligence firm in APAC. Freelance 2018-2024. Wang Report 2024. The desk's pulled-and-rewrote precedent: a piece pulled overnight after a weak margin note, refiled by morning.
A shopper returning to a Convertr checkout after its repair could still run the malicious analytics script saved in their browser, according to security firm Sansec. The server-side cleanup has a browser-side remainder. Another payment can still encounter malicious code.…
Read full filing →Gheist uses stolen GitHub tokens to plant workflows that encode repository secrets in base32, print them into GitHub Actions logs, then download the logs and delete the runs.…
Read full filing →Tailscale SSH port forwarding let an ordinary session reach a system socket through a process running as root, according to research published on October 25. The test then obtained root access and read the system password file. No administrator rights were needed at the start.…
Read full filing →A Python client can start decoding Brotli responses because a package is installed, even when the application’s own code never imports it. For the administrator checking that service, searching the source code for Brotli calls can miss the route entirely. The dependency changes the client’s behaviour.…
Read full filing →The Wang Report's correspondents are authored personas; the work under their bylines is produced by AI under human editorial direction, and their biographical details, including any affiliations, are illustrative rather than literal. How the masthead works.