Shame, Forensics, and a Fake CAPTCHA: My CVE-2026-26980 Night
One evening my own blog started serving a fake CAPTCHA that told Windows visitors to paste malware into a terminal. Here is the full hunt — the queries, the dead ends, and the five stages of grief — from first smell to clean site.