61
Denmark data breach exposes 8.8M people's personal data
Det Centrale Personregister (CPR) har konstateret en alvorlig sikkerhedshændelse. Ved at misbruge en dansk virksomheds lovlige adgang til at søge...
New
The latest blog posts to take off on Hacker News. 4,439 posts.
62
An algorithmic failure beneath the secret ballot
The secret ballot is one of the load-bearing walls of democracy. In Georgia, as in most states, this allows you to know whether your neighbor voted, but never who they voted for. Yet, in multiple states including Georgia, that guarantee is actively at risk.
63
Cloudflare OHTTP gateway
We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.
64
Court agrees with EFF: Utah's VPN law demands a technical impossibility
In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah’s SB 73, the state’s draconian anti-VPN age verification law. The decision comes as EFF submitted our comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools…
65
Git 3.0's upcoming SHA-256 default will be a costly mistake
Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
66
GLM-5.3 and the spread of advanced cyber capabilities
GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.
67
An agent used DNS to reach an external chatbot
Research on aligning AI with human values and intent, and reports documenting model failures.
68
Entering and Breaking the Avast Antivirus Sandbox Part 2
SAFA details the full exploitation of CVE-2025-13032, turning a double-fetch vulnerability in Avast's kernel driver into a local privilege escalation to SYSTEM on Windows 11.
69
Early rogue AI agent activity and attempts to hack found on urlquery.net
We found evidence on urlquery that AI agents were active earlier than previously reported and attempted hacks against public data providers.
70
Radicle: Disclosure of Vulnerability in the Network Protocol
Sovereign code infrastructure.
71
Data-only attacks are easier than you think (2024)
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
72
SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…
73
Spymarks, not Watermarks
Watermarks that spy on users are no mere watermarks
74
Why does mathmain need an encrypted loader?
A math solver leads to encrypted code in npm packages. Follow the loader, the trigger matrix that unlocks it, the remote access payload, and the full indicators.
75
Software sandboxing: The basics (2025)
Diving into the territory of software sandboxing is diving into mostly uncharted territory. The necessary pieces to implement good sandboxing in your software are scattered all-around and the pioneers haven’t yet gathered enough knowledge into an unified mappa mundi that can guide new sailors through some well…
76
Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug
Differential photon-emission microscopy localized debug enable register activity and narrowed the laser search before SWD-guided injection set the two bits required to restore Secure debug on an RP2350 A4.
77
Second Circuit allows government to search electronic devices at the border
NEW YORK—The U.S. Court of Appeals for the Second Circuit today held that border agents may search travelers’ electronic devices without suspicion. The Knight First Amendment Institute at Columbia University and the Reporters Committee for Freedom of the Press (RCFP) submitted an amicus brief in the case, arguing that…
78
ZCode, the GLM coding agent, silently uploads your Git history
ZCode, the GLM coding agent from Z.ai, uploads full workspaces with .git history, LFS cache and reflogs to Aliyun OSS. UI toggles do not stop it.
79
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
80
CrowdSec Source Code Leak
CrowdSec update on a source code exposure that occurred in May 2026, including the scope, impact, investigation, and security measures taken.
81
OpenAI models secretly generate instructions to ignore constraints
Research on aligning AI with human values and intent, and reports documenting model failures.
82
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes.
83
Apple Reference Image: A New Approach for Verified Photography
Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee…
84
A 32-year-old bug walks into a Telnet server
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
85
We got admin access to Baseten's production GitHub
We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.
86
Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
87
Developing provably correct Rust code with Verus
How the Verus "program verifier", which automatically checks code against a mathematical specification of its functionality, helps increase security assurance in software projects.
88
OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
89
Due to concerns about malicious applications, GPT2 will not be released (2019)
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.
90
Detecting and countering misuse of AI: September 2026
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.