511
Critical vulnerability in AI coding platform Base44 allowing unauthorized access
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
512
Sign in with Google in Chrome
Many websites such as Yelp show an annoying “Sign in with Google” banner when you visit.
513
How we rooted Copilot
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
514
Exploiting zero days in abandoned hardware
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
515
Google spoofed via DKIM replay attack: A technical breakdown
Learn how a Google spoof used a DKIM replay attack to bypass email security and trick users with a fake subpoena in this real-world phishing case.
516
Lumo: Privacy-first AI assistant
Lumo gives you the power to solve problems big and small, while keeping your personal data confidential. Try it now.
517
Brave blocks Microsoft Recall by default
Starting in version 1.81 for Windows users, Brave browser will block Microsoft Recall from automatically taking screenshots of your browsing activity.
518
Subliminal learning: Models transmit behaviors via hidden signals in data
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
519
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
520
SecretSpec: Declarative Secrets Management
Fast, Declarative, Reproducible, and Composable Developer Environments using Nix.
521
Ring introducing new feature to allow police to live-stream access to cameras
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
522
523
Upcoming coordinated security fix for all Matrix server implementations
Matrix, the open protocol for secure decentralised communications
524
Code execution through email: How I used Claude to hack itself
This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.
525
PyPI Prohibits inbox.ru email domain registrations
We have prohibited new registrations of accounts using inbox.ru email domains.
526
The FIPS 140-3 Go Cryptographic Module
Go now has a built-in, native FIPS 140-3 compliant mode.
527
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
528
Data brokers are selling flight information to CBP and ICE
For many years, data brokers have existed in the shadows, exploiting gaps in privacy laws to harvest our information—all for their own profit. They sell our precise movements without our knowledge or meaningful consent to a variety of private and state actors, including law enforcement agencies....
529
Malware found in official gravityforms plugin indicating supply chain breach
Update 7-12-2025 06:00 UTC: We have observed some activity in regard to one of the backdoors that involves a gf_api_token parameter. The IP address 193.160.101.
530
Axon’s Draft One is designed to defy transparency
Axon Enterprise’s Draft One — a generative artificial intelligence product that writes police reports based on audio from officers’ body-worn cameras — seems deliberately designed to avoid audits that could provide any accountability to the public, an EFF investigation has found.Our review of...
531
ESIM Security
In a result of its research investigation efforts, Security Explorations, a research lab of AG Security Research company, conducted security analysis of eSIM technology.
532
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
533
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
534
I scanned all of GitHub's "oops commits" for leaked secrets
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
535
Azure API vulnerability and roles misconfiguration compromise corporate networks
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
536
The hidden JTAG in a Qualcomm/Snapdragon device’s USB port
Learn about JTAG and EUD
537
LetsEncrypt – Expiration Notification Service Has Ended
Since its inception, Let’s Encrypt has been sending expiration notification emails to subscribers that have provided an email address to us via the ACME API. This service ended on June 4, 2025. The decision to end the service is the result of the following factors: Over the past 10 years more and more of our…
538
Bot or human? Creating an invisible Turing test for the internet
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
539
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
540
Agentic Misalignment: How LLMs could be insider threats
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.