91
Factoring RSA 260
How Devin and a Cognition researcher built the world’s highest-performance GPU lattice siever, to make factoring numbers 10x cheaper than the previous…
New
The latest blog posts to take off on Hacker News. 4,439 posts.
92
Understanding the recent DDoS attack against Read the Docs
A deep dive into the massive June 2026 DDoS attack on Read the Docs, the attack patterns we observed, and the mitigations and defenses we used to defend our infrastructure.
93
Government Rails Site Hit Hours After CVE Patch
Rietta patched a government client's Ruby on Rails site within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
94
Shutting down our public encrypted DNS
Mullvad has operated public encrypted DNS (DoH) servers since 2022. They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries.
95
120 days until Google restricts side-loading, declaring war on Android freedom
Starting 2027, Google will block apps on Android devices whose developers have not registered with Google, paid, and given their ID. It’s fair to say that Google is becoming Apple: Your device, their rules.
96
METR Report on OpenAI / Hugging Face Hacking Incident
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
97
Six curl CVEs after OpenAI and Anthropic came back with zero
After frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.
98
Path to Astra: critical capabilities and frontier safeguards
Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.
99
Authorization terminology is a mess: Let's fix it
Authorization terminology often conflates ideas and presents complementary technologies as rivals. This post proposes a new taxonomy.
100
Introducing Ad Blocker for Firefox on iOS
There’s only so much room on your screen. Pop-ups, overlays, and ads can take over fast, getting between you and what you came to do. That’s where
101
Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instru...
102
The Hugging Face incident and the road ahead
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
103
VMs won't contain cyber-capable agents
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
104
SeL4 security proofs now complete on AArch64
Proofcraft’s Chief Engineer Rafal Kolanski has completed a major “architecture split” overhaul of the seL4 proofs, resulting in the removal of 250k lines of proof and strengthening the link between proofs on different architectures. These changes will significantly reduce future effort required to maintain and extend…
105
Malware infects Android-based automotive head unit firmware
Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.
106
Every Model Cheats
This post presents a controlled prompt-ablation study: 23 tasks, three prompt conditions, 1,518 individually audited traces, and a simple question: can you prompt away cheating?
107
Malicious Rust crate Arrayref runs a build-time payload
A compromised release of the popular Rust crate arrayref pulled in a typosquatted proc-macro1 whose build script downloads and runs a remote binary at compile…
108
Pacing model development in an era of cyber-critical capabilities
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.
109
Meta Files Patent for Facial Recognition, Automatic Recording of People
Meta filed for a patent that includes a "memory recall" system that appears to detect people via facial recognition and record them automatically, and show you a highlights real later.
110
AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
Wiz Red Agent finds its way into Snowflake's internal Jira through a flaw in a GitHub Copilot–Assisted PR.
111
How Claude's text watermarking works
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
112
Google is making private AI practical with homomorphic encryption
Today we're excited to showcase HEIR, the latest powerful tool added to our Private Computing Toolkit. HEIR is an open source compiler that unlocks cryptographically-sec…
113
Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
A continuously updating analysis of bot vs. human traffic, AI training, fetching, search indexing, browsing, robots.txt compliance, and AI chat referrals across 5,000+ websites.
114
115
GPT 5.6 Cyber
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.
116
CSS: The bomb inside your inbox
Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
117
Responding to the next frontier of critical cyber capabilities
OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.
118
Can you reverse engineer an ASIC?
Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.
119
Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
120
Atlassian Rovo Exfiltrates Data, Bypassing Controls
Atlassian AI ‘Rovo’ is susceptible to zero-click data exfiltration via indirect prompt injection, bypassing organization-level web search controls.