31
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 88 posts.
32
PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
FINAL STATUS (2026-10-21): the CVE-2026-109618 / CVE-2026-109619 memory-corruption class shipped patches 2026-10-21. On the patch, that class is closed: the cached-pointer chain dies at the addref and the serialize-state path is a memory-safety bug, not code execution. Two session-handling flaws survive on…
33
OpenSSH 10.6p2 Critical workaround for alpine without PAM
OpenSSH release notes
34
EFF is leaving X
After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue.
35
Notepad++ hijacked by state-sponsored actors
Following the security disclosure published in the v8.8.9 announcement https://notepad-plus-plus.org/news/v889-released/ the investigation has continued in collaboration with external experts and with the full involvement of my (now former) shared hosting provider.
36
EmDash – A spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
37
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
38
Hacking Moltbook
Learn how a misconfigured Supabase database at Moltbook exposed 1.5M API keys, private messages, and user emails, enabling full AI agent takeover.
39
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
40
Cloudflare targets 2029 for full post-quantum security
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
41
Concerning behavior from a popular open-weight AI model
Discover how untrusted open-weight AI models can potentially leak data, even when self-hosted. Learn the security risks and how to protect your enterprise.
42
Police Have Used License Plate Readers at Least 14x to Stalk Romantic Interests
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
43
Patch the Planet: global response coordination as agents uncover vulnerabilities
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
44
The relay market powering token resellers and fraud
A look inside the gray-market reseller economy that gives mainland China cheap, structured, B2B-grade access to OpenAI, Anthropic, Google, and beyond
45
An agent used DNS to reach an external chatbot
Research on aligning AI with human values and intent, and reports documenting model failures.
46
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
47
Google API keys weren't secrets, but then Gemini changed the rules
Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.
48
Claude Cowork exfiltrates files
Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.
49
OpenAI, the US government and Persona built an identity surveillance machine
53MB of source code leaked from a government endpoint. 269 verification checks. biometric face databases. SAR filings to FinCEN. and the same company that verifies your ChatGPT account.
50
6-Day and IP Address Certificates Are Generally Available
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
51
Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public
ACLU documents how surveillance camera company Flock has lied to local officials about its operations
52
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in…
53
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
54
METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
Yesterday I covered the OpenAI technical report on the HuggingFace hack. That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignm…
55
Early rogue AI agent activity and attempts to hack found on urlquery.net
We found evidence on urlquery that AI agents were active earlier than previously reported and attempted hacks against public data providers.
56
57
The ways we contain Claude across products
As agents grow more capable, so does their potential blast radius. Here's what we learned building containment for claude.ai, Claude Code, and Cowork.
58
VMs won't contain cyber-capable agents
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
59
C2PA Cameras Do Not Survive Contact with Reality
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
60
Good Bad ISPs
Defend yourself against tracking and surveillance. Circumvent censorship. | Good Bad ISPs