391
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
392
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…
393
AI agents find $4.6M in blockchain smart contract exploits
On a benchmark of real exploited contracts, AI agents found vulnerabilities worth a combined $4.6 million, underscoring the need for AI-powered defense.
394
GitLab discovers widespread NPM supply chain attack
Malware driving attack includes "dead man's switch" that can harm user data.
395
Protect Public School Students from Surveillance of Off-Campus Speech
EFF filed an amicus brief in Arizona federal court arguing that public school students need private digital spaces beyond their school’s reach to speak freely, without the specter of constant school surveillance and punishment.
396
Mixpanel Security Breach
Our response to a recent security incident The Signal Inside Mixpanel |
397
Counter Galois Onion: Improved encryption for Tor circuit traffic
Tor is upgrading its relay encryption algorithm for improved security. In upcoming releases, Arti and Tor will both support a new encryption algorithm called Counter Galois Onion (CGO). CGO prevents attackers from tampering with encrypted traffic, adds forward secrecy, and brings Tor's encryption up to modern…
398
Google Antigravity exfiltrates data via indirect prompt injection attack
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.
399
GrapheneOS migrates server infrastructure from France
The GrapheneOS project has announced on X that they are ceasing all operations in France, asserting that the country is no longer safe for "open source projects"
400
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
401
Shai-Hulud Returns: Over 300 NPM Packages Infected
Over 1,000 NPM packages were infected using the same method as the previous attack, infecting with a fake Bun runtime. The attacker leveraged the `preinstall` script to download and execute a malicious payload, stealing sensitive information from the compromised machines.
402
Arduino Terms of Service and Privacy Policy update: setting the record straight
We’ve heard some questions and concerns following our recent Terms of Service and Privacy Policy updates. We are thankful our community cares enough to
403
Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation.
New documents and court records obtained by EFF show that Texas deputies queried Flock Safety's surveillance data in an abortion investigation, contradicting the narrative promoted by the company and the Johnson County Sheriff that she was “being searched for as a missing person,” and that “it was about her safety.”…
404
How Cops Are Using Flock's ALPR Network to Surveil Protesters and Activists
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
405
Gmail can read your emails and attachments to train its AI, unless you opt out
Did you know that Gmail can use your emails and attachments for its smart features? Here's how to check your settings.
406
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.
407
Verifying your Matrix devices is becoming mandatory
From April 2026, only verified devices can send or receive end-to-end encrypted message on Element.
408
The patent office is about to make bad patents untouchable
The U.S. Patent and Trademark Office (USPTO) has proposed new rules that would effectively end the public’s ability to challenge improperly granted patents at the Patent Office itself. We need EFF supporters to file public comments opposing these rules this week. The USPTO is moving quickly, and staying silent will…
409
410
Our investigation into the suspicious pressure on Archive.today
Some time ago, we were contacted by a group fighting against online CSAM, demanding that AdGuard DNS blocks the Archive.today website. This was only the beginning of a much larger story…
411
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
After my previous post on ARM exploitation, where we crafted an exploit for a known vulnerability, I decided to continue the research on a more modern IoT target. In this follow-up post, I will take you through building a considerably more complex binary exploit. We will explore the path from firmware extraction and…
412
Mullvad VPN present And Then? (Chat Control is back on the menu)
Chat Control is back on the menu. To highlight the corruption behind the proposal, Mullvad VPN now presents "And Then?"
413
Lawmakers want to ban VPNs
It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of…
414
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
415
Rust in Android: move fast and fix things
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
416
Checkout.com hacked, refuses ransom payment, donates to security labs
Our statement detailing an incident concerning a legacy system. We outline our commitment to transparency, accountability, and planned investment in cyber security research.
417
Bitcoin's big secret: How cryptocurrency became law enforcement's secret weapon
WIRED's Andy Greenberg discusses a revelation that turned his decades-long reporting on its head: Bitcoin became a criminal's worst nightmare.
418
Android developer verification: Early access starts
News and insights on the Android platform, developer tools, and events.
419
Digital ID, a new way to create and present an ID in Apple Wallet
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
420
Fighting the New York Times' invasion of user privacy
OpenAI is fighting the New York Times’ demand for 20 million private ChatGPT conversations and accelerating new security and privacy protections to protect your data.