diff --git a/content/posts/commits/2026-07-07-commit-78eeea5.md b/content/posts/commits/2026-07-07-commit-78eeea5.md
new file mode 100644
index 0000000..8d60a5e
--- /dev/null
+++ b/content/posts/commits/2026-07-07-commit-78eeea5.md
@@ -0,0 +1,46 @@
+---
+title: "[bojemoi] fix(ml-threat): break label/feature circular dependency, oversample pwned hosts"
+date: 2026-07-07T23:55:30+02:00
+draft: false
+tags: ["commit", "bojemoi", "main"]
+categories: ["Git Activity"]
+summary: "Commit 78eeea5 par grafana-watcher dans bojemoi"
+author: "grafana-watcher"
+---
+
+## Commit `78eeea5`
+
+| | |
+|---|---|
+| **Repository** | bojemoi |
+| **Branch** | `main` |
+| **Author** | grafana-watcher |
+| **Hash** | `78eeea58d13e88214844d9b11f2ee4d04d24d437` |
+
+
+### Description
+
+- fetch_msf_data: query ALL pwned hosts exhaustively + benign_ratio*n_pwned
+  benign sample — avoids 5/50000 imbalance that made accuracy=1.0 trivial
+- build_feature_matrix: feature[6] = filtered_port_count (replaces malware_hits)
+  confirmed_vulns used only for labels, not in X — breaks circular dependency
+- train.py synthetic: feature[6] = filtered_port_count to match real data layout
+- train_from_msf signature: benign_ratio param instead of msf_limit
+- Result: 184 pwned + 1000 benign, test_acc=0.933 (was 1.0 trivially)
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+
+### Files Changed
+
+```
+M	ml-threat/train.py
+M	ml-threat/train_from_msf.py
+```
+
+### Diff Summary
+
+```
+ ml-threat/train.py          |  22 +++----
+ ml-threat/train_from_msf.py | 142 +++++++++++++++++++++++++++++---------------
+ 2 files changed, 106 insertions(+), 58 deletions(-)
+```