361
The PGP problem (2019)
The PGP problem
New
The latest blog posts to take off on Hacker News. 4,439 posts.
362
We found cryptography bugs in the elliptic library using Wycheproof
Trail of Bits discovered and disclosed two vulnerabilities in the widely used elliptic JavaScript library that could allow signature forgery or prevent valid signature verification, with one vulnerability still unfixed after the 90-day disclosure window.
363
364
365
MongoDB Server Security Update, December 2025
The following is an update on the security vulnerability identified in December 2025.
366
Say No to Palantir in the NHS
NHS England is rolling out software to run our health records from Palantir - fight back
367
Seven diabetes patients die due to undisclosed bug in Abbott's glucose monitors
I wrote last month about my diabetes diagnosis this year and my difficult choice to wear a proprietary device (called a CGM) on my arm 24/7 to continuously monitor my glucose levels. Like my friend and colleague, Karen M. Sandler — who previously made a much higher-stakes choice to receive a proprietary implanted…
368
Critical vulnerability in LangChain – CVE-2025-68664
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
369
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
370
Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics
When a government contractor pays a company for "Takedown Services" to prevent transparency in government
371
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
372
373
GotaTun – Mullvad's WireGuard Implementation in Rust
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable.
374
375
TikTok unlawfully tracks shopping habits and use of dating apps?
TikTok tracks its users even if they're using other apps. The video platform therefore also knows what dating app you use
376
A Safer Container Ecosystem with Docker: Free Docker Hardened Images
Security for everyone. Docker Hardened Images are now free to use, share, and build on with no licensing surprises.
377
8M users' AI conversations sold for profit by "privacy" extensions
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
378
Price of a bot army revealed across online platforms
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
379
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
380
Pizlix: Memory Safe Linux from Scratch
Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available.
381
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
382
VPN location claims don't match real traffic exits
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
383
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
384
We built a resource hub to fight back against age verification
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
385
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
386
COM Like a Bomb: Rust Outlook Add-in
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
387
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
388
Critical RCE Vulnerabilities in React and Next.js
React2Shell (CVE-2025-55182) is a critical RCE vulnerability in React Server Components. Learn which versions are impacted and how to mitigate.
389
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
390
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy