211
We are retiring our bug bounty program
For almost a year now, Turso has had a program that pays $1,000 for any bug that can be demonstrated to lead to data corruption. Today, we are retiring this program.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
212
Welcome to the Strip Mining Era of OSS Security
In 2026, LLM-powered code scanners are uncovering security vulnerabilities in open source projects at 10x the historical rate. Here's what OSS maintainers and users need to do about it.
213
Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet
Exploiting the Tesla Wall Connector from its charge port connector -
214
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with Mythos Preview, built a working exploit in five days.
215
SecurityBaseline.eu
On May 13, 2026, the website SecurityBaseline.eu was launched. It is a spin-off from the Dutch “Basisbeveiliging”, which has monitored baseline security for over a decade and is part of governmental policy. Three months ago we sent tens of thousands of e-mails to European governments indicating the new site would…
216
EFF to 4th Circuit: Electronic Device Searches at the Border Require a Warrant
EFF, along with the national ACLU, the ACLU affiliates in Maryland, North Carolina, South Carolina, and Virginia, and the National Association of Criminal Defense Lawyers (NACDL) filed an amicus brief in the U.S. Court of Appeals for the Fourth Circuit urging the court to require a warrant for...
217
Canada’s Bill C-22 Is a Repackaged Version of Last Year’s Surveillance Nightmare
Last year, Canada's Bill C-2 was so bad it didn’t even make it to committee because of the backlash from the privacy community. Now, the spring’s worst sequel, Bill C-22, aka The Lawful Access Act, is trying it again.
218
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.
219
Obsidian plugin was abused to deploy a remote access trojan
A sophisticated campaign is abusing the Obsidian note-taking app to deliver a new RAT, PHANTOMPULSE, to targets in the finance and crypto sectors using...
220
221
CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new…
222
223
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
224
How Cloudflare responded to the “Copy Fail” Linux vulnerability
When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.
225
Google Cloud fraud defense, the next evolution of reCAPTCHA
Today at Next ‘26, we’re launching Google Cloud Fraud Defense, the trust platform for the agentic web and the next evolution of reCAPTCHA.
226
From Supabase to Clerk to Better Auth
The perils of logging in
227
Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
Zero tenant isolation, exposed military training data, and a five-month responsible disclosure timeline.
228
How Monero’s proof of work works
Monero does not use a simple fixed hash like Bitcoin. Its proof of work, RandomX, turns mining into running random CPU-friendly programs over a large memory dataset, which is why it behaves so differently from ASIC-first systems.
229
Bad Connection: Global telecom exploitation by covert surveillance actors
Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose how suspected commercial surveillance vendors (CSVs) exploit the global telecom interconnect ecosystem, leverage private…
230
The agent harness belongs outside the sandbox
Two architectures for running agent harnesses, the tradeoffs between them, and how we make skills and memories work when the harness isn't local.
231
Police Have Used License Plate Readers at Least 14x to Stalk Romantic Interests
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
232
CPanel and WHM Authentication Bypass – CVE-2026-41940
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
233
LinkedIn is scanning browser extensions
When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify…
234
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
The PyPI package lightning was compromised in versions 2.6.2 and 2.6.3 with Mini Shai-Hulud themed malicious code to execute credential-stealing malware on import.
235
Ramp's Sheets AI Exfiltrates Financials
A vulnerability in Ramp's Sheets AI allowed the agent to insert formulas that made external network requests without user approval, creating the risk of data exfiltration via indirect prompt injection.
236
HardenedBSD Is Now Officially on Radicle
Over the past week, I have been working on bringing HardenedBSD's code repositories on Radicle (as most/all of you already know by now.) We are now at the point where Radicle is usable for us. There are still some sharp edges and some things to work out, but the core functionality is working.
237
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
238
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
239
Your phone is about to stop being yours
Your phone is about to stop being yours. In 2027, Google will block every Android app whose developer hasn't registered with them.
240