421
Firefox expands fingerprint protections
With Firefox 145, we’re rolling out major privacy upgrades that take on browser fingerprinting — a pervasive and hidden tracking technique that lets we
New
The latest blog posts to take off on Hacker News. 4,439 posts.
422
Benchmarking leading AI agents against Google reCAPTCHA v2
We evaluate three leading AI models—Claude Sonnet 4.5, Gemini 2.5 Pro, and GPT-5—on their ability to solve Google reCAPTCHA v2 challenges and find significant performance differences, with success rates ranging from 28% to 60%.
423
How cops can get your private online data
Can the cops get your online data? In short, yes. There are a variety of US federal and state laws which give law enforcement powers to obtain information that you provided to online services. But, there are steps you as a user and/or as a service provider can take to improve online privacy.Law...
424
About KeePassXC's Code Quality Control
KeePassXC Password Manager
425
Using bubblewrap to add sandboxing to NetBSD
As of the time of writing, there is no real sandboxing technique available to NetBSD. There is chroot , which can be considered a weak sandbox because it modifies the root directory of the process, effectively restricting the process' view of the file system, but it doesn't isolate anything else, so all networking…
426
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
427
Defeating KASLR by doing nothing at all
IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...
428
Anonymous credentials: rate-limit bots and agents without compromising privacy
As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.
429
Czech police forced to turn off facial recognition cameras at the Prague airport
The shutdown of the facial recognition cameras at the Václav Havel Airport in Prague came after years of criticism from EDRi member IuRe.
430
The cryptography behind electronic passports
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs.
431
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
432
Tor Browser 15.0
Tor Browser 15.0 is now available, featuring an update to Firefox ESR 140, improvements to tab management and the address bar on desktop, and screen lock for Android.
433
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
434
Criminal complaint against facial recognition company Clearview AI
Clearview AI is known for scraping billions of photos of people around the world on the internet – and selling its facial recognition system to law enforcement and state actors
435
Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update
iVerify brings operating system-level telemetry, behavioral baselining, and AI-driven threat hunting to hundreds of thousands of mobile devices
436
Google flags Immich sites as dangerous
How Google actively breaks Immich deployments, an open-source Google Photos alternative.
437
Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)
The vulnerabilities we found in Cloudflare's CIRCL FourQ implementation: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
438
The security paradox of local LLMs
Local LLMs prioritize privacy over security. Our research reveals a 95% backdoor injection success rate.
439
Free the Internet: The Tor Project's annual fundraiser
This year we are calling to FREE THE INTERNET. Your donation will help break the chains of censorship and surveillance. If you give now during the campaign, your donation will be matched by our supporters at Power Up Privacy. This means a $25 donation will have a $50 impact.
440
A kernel stack use-after-free: Exploiting Nvidia's GPU Linux drivers
This article details two bugs discovered in the NVIDIA Linux Open GPU Kernel Modules and demonstrates how they can be exploited. The bugs can be triggered by an attacker controlling a local unprivileged process. Their security implications were confirmed via a proof of concept that achieves kernel read and write…
441
Bots are getting good at mimicking engagement
Click fraud protection in one tool: DataCops flags bot clicks, blocks repeat bots at your Cloudflare edge, keeps them out of the conversions 8 ad platforms learn from, and exports Google refund evidence.
442
Europe's Digital Sovereignty Paradox – "Chat Control" Update
Can you build tech independence while breaking encryption?
443
CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code
Get details on our discovery of a critical vulnerability in GitHub Copilot Chat.
444
Google Safe Browsing incident
For approximately six hours on 25.9.2025, the entire statichost.eu domain was flagged as deceptive by Google Safe Search. This meant that anyone using Google Safe Search was shown a very aggressive warning or outright blocked when trying to access any site on the statichost.eu domain. In some cases even custom domains…
445
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
446
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
447
The weaponization of travel blacklists
[A Federal Air Marshal (FAM) tasked with surveillance of an airline passenger targeted by Quiet Skies lists and/or rules followed the traveler out to the curb and recorded the license plate number of the vehicle in which she left the airport, so that her airline reservations could be integrated with license plate…
448
RediShell: Critical remote code execution vulnerability in Redis
A 13‑year Redis flaw (CVE‑2025‑49844) allows attackers to escape Lua sandbox and run code on hosts. See Wiz Research’s analysis and mitigations.
449
CodeMender: an AI agent for code security
Using advanced AI to fix critical software vulnerabilities
450
The UK is still trying to backdoor encryption for Apple users
The Financial Times reports that the U.K. is once again demanding that Apple create a backdoor into its encrypted backup services. The only change since the last time they demanded this is that the order is allegedly limited to only apply to British users. That doesn’t make it any better.The demand...