241
4TB of voice samples just stolen from 40k AI contractors at Mercor
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
242
Fast16: High-precision software sabotage 5 years before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
243
GoDaddy gave a domain to a stranger without any documentation
What would you do if your organization had used a domain name for 27 years, and the registrar holding the domain seized it without any advance warning? All
244
GPT‑5.5 Bio Bug Bounty
Details about the OpenAI Bio Bounty program
245
246
OpenAI's response to the Axios developer tool compromise
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
247
OpenAI Privacy Filter
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
248
We found a stable Firefox identifier linking all your private Tor identities
We discovered a privacy vulnerability in Firefox Private Browsing and Tor Browser that allows websites to fingerprint and track users across origins using IndexedDB database ordering, even after closing all private windows.
249
The Vercel breach: OAuth attack exposes risk in platform environment variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
250
Even 'uncensored' models can't say what they want
A safety-filtered pretrain can duck a charged word without refusing. It puts a fraction of the probability an open-data pretrain puts there. We call that...
251
Keep Pushing: We Get 10 More Days to Reform Section 702
In a dramatic middle-of-the-night stand off, a bipartisan set of lawmakers pushing for true reform and privacy protections for Americans bought us some more time to fight! They are holding out for, at a minimum, the requirement of an actual probable cause warrant for FBI access to information...
252
"cat readme.txt" is not safe if you use iTerm2
Turning "cat readme.txt" into arbitrary code execution in iTerm2.
253
We reproduced Anthropic's Mythos findings with public models
Anthropic framed Mythos and Project Glasswing as proof that frontier AI vulnerability research now needs gated access. We tested the public, patched cases with GPT-5.4 and Claude Opus 4.6 and found that the key building blocks are already accessible outside Glasswing, while reliable operationalization remains the real…
254
Codex Hacked a Samsung TV
We gave Codex a foothold. It popped a root shell.
255
Google broke its promise to me – now ICE has my data
In 2025, Google gave Amandla Thomas-Johnson's data to ICE without giving him the chance to challenge the subpoena, breaking a nearly decade-long promise to notify users before handing their data to law enforcement.
256
Prove you are a robot: CAPTCHAs for agents
How we built a reverse-CAPTCHA for agents, and what we learned.
257
Someone bought 30 WordPress plugins and planted a backdoor in all of them
Last week, I wrote about catching a supply chain attack on a WordPress plugin called Widget Logic. A trusted name, acquired by a new owner, turned into
258
Small models also found the vulnerabilities that Mythos found
When AISLE tested Mythos's showcase vulnerabilities on small, cheap, open-weights models, most found the same bugs. Here's what that means for cyber.
259
New iPhone age and identity checks restrict internet freedom in the UK
A recent iPhone software update is quietly changing how millions of people in the UK access the internet — and most people don’t yet realise the scale of what’s happened. With the release of iOS 26.4, Apple has introduced mandatory age and identity checks at the operating system level. In simple terms, your iPhone may…
260
EFF is leaving X
After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue.
261
Session is shutting down in 90 days
The Session Technology Foundation cannot continue without your support. Donate today to help Session in its fight for survival.
262
Open source security at Astral
Insights and guidance from our engineering team on how Astral secures its tools.
263
Assessing Claude Mythos Preview's cybersecurity capabilities
Technical details on how we tested Claude Mythos Preview, a model strikingly capable at computer security tasks, and what we found.
264
Project Glasswing: Securing critical software for the AI era
A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.
265
Cloudflare targets 2029 for full post-quantum security
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
266
267
The FAA’s flight restriction for drones is an attempt to criminalize filming ICE
Legal intern Raj Gambhir was the principal author of this post.Update: On April 15, 2026 the FAA rescinded the TFR (FDC 6/4375) and instead issued an advisory (FDC 6/2824), which states: [Drone] operators are advised to avoid flying in proximity to: Department of War (DOW), Department of Energy (...
268
EmDash – A spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
269
We intercepted the White House app's network traffic
We set up a MITM proxy and captured the decrypted HTTPS traffic from the official White House iOS app. On a single browsing session it contacts multiple Elfsight domains, sends your device fingerprint to OneSignal, and loads Google DoubleClick ad tracking. The privacy manifest says it collects nothing.
270
Axios compromised on NPM – Malicious versions drop remote access trojan
Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis.