151
Every new car sold in the European Union must include a driver monitoring camera
The EU's new mandatory ADDW rules could make roads safer by altering distracted drivers, but its privacy safeguards and data handling rules remain a gray area.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
152
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs…
153
Better Auth is joining Vercel
Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.
154
Chat Control 1.0 and 2.0 Explained
What is the difference between Chat Control 1.0 and Chat Control 2.0? A clear overview of both EU laws, their timelines, and where things stand today.
155
156
The future of Flipper Zero development
We've seen the strong reaction from the community over the idea that we've stopped developing the Flipper Zero firmware. We want to address this and let you know that we've heard all your feedback and have decided to rethink our approach to maintaining the project and engaging with the community.
157
New serious vulnerabilities spiked around release of Claude Mythos Preview
Notable organizations disclosed ~1,300 high- and critical-severity CVEs in June 2026, roughly 3.5× the pre-Mythos monthly record. Epoch AI's breakdown of vulnerability disclosures following Anthropic's Project Glasswing.
158
Espionage Against the European Parliament
We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential…
159
Virginia bans sale of precise geolocation data
On April 13, 2026, Virginia Governor Abigail Spanberger signed into law S.B. 338 , which amends the Virginia Consumer Data Protection Act (“VCDPA”) to prohibit the sale of geolocation data. Notably, the VCDPA defines “sale” more narrowly than other state comprehensive privacy laws, as “the exchange of personal data…
160
EFF letter to FTC on X consent order [pdf]
Strong safeguards on our information require eagle-eyed oversight when that data is abused and misused for profiteering ventures. X’s actions not only showed us this in the past, but continue to do so in the present day.
161
Android Developer Verification: Threat masquerading as protection
If you are running Android 8 or higher, a virus has been installed on your device and is silently awaiting remote activation. Over the past few months, devic...
162
Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
163
The Anti-Palantir Manifesto
Nym CEO Harry Halpin responds to Palantir manifesto with one that defends human freedom and privacy against techno-fascism.
164
Rayfish, Peer-to-peer mesh VPN with no server to trust
Rayfish is a peer-to-peer mesh VPN. Connect your devices by cryptographic identity. No port forwarding, no hosted server to trust. Share a code, and you're on the same encrypted LAN.
165
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
The vulnerability has been fixed as of July 7, 2026, but the exploit was simple, and hidden email addresses may still be in third-party logs.
166
European digital ID wallets rely on safety services of Google and Apple
European governments are rolling out digital identity wallets, which are to be used by citizens to access services, and to verify their age online. There is a serious problem with this: these wallets rely on safety services of Google and Apple.
167
US Supreme Court Just Blew Up EU-US Data Transfers
The US Supreme Court decided that the US Federal Trade Commission (“FTC”) may not be independent anymore – with major implications for EU-US Data Transfers.
168
Memory Safe Context Switching
This document describes how Fil-C supports longjmp , setjmp , setcontext , getcontext , makecontext , and swapcontext in a totally memory-safe way. In particular, no misuse of those APIs in Fil-C can lead to stack corruption or any other violation of Fil-C's capability model.
169
GLM 5.2 beats Claude in our benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
170
California legislature agrees to upload driver's licenses to national database
Withdrawing its opposition under behind-the-scenes pressure from Gov. Gavin Newsom and lawless threats from the US Department of Homeland Security (DHS), the California legislature has agreed to fund and revise state law to authorize the upload of information about all driver’s licenses and ID cards issued by the…
171
The KIDS Act would require age checks to get online
Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its…
172
Post-Mythos Cybersecurity: Keep calm and carry on
As some of those fears, uncertainties, and doubts about Mythos are starting to feel real, what can we do about it? Paradoxically, I believe that little needs to change in what we’ve been doing for years.
173
Countries are competing to see which can carry out mass surveillance the best
USA and their friends in the surveillance alliance Fourteen Eyes have demonstrated that they have the capacity, the desire and the experience to monitor who they want, when they want, anywhere in the world.
174
OAuth for all
Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core OAuth engine to make it happen.
175
OpenAI DayBreak – GPT-5.5-Cyber
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
176
Nearly half of LG smart TV apps contain residential proxy SDKs
Spur scanned 6,038 LG and Samsung smart TV apps and found 2,058 with residential proxy SDKs, exposing privacy and home network risks.
177
Temporary Cloudflare accounts for AI agents
The moment an agent needs to deploy something, it slams face-first into a wall built for humans. Today we're rolling out Temporary Accounts on Cloudflare Workers. Any agent can now run wrangler deploy — temporary and get a live Worker in seconds.
178
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
179
A new bill takes aim at government pressure to silence lawful online speech
The bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers into taking actions against lawful, First-Amendment-protected speech, and establishes a transparency system for government…
180
Court Records Should Be Free
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a...