1
New
The latest blog posts to take off on Hacker News. 308 posts.
2
3
MongoDB Server Security Update, December 2025
The following is an update on the security vulnerability identified in December 2025.
4
Say No to Palantir in the NHS
NHS England is rolling out software to run our health records from Palantir - fight back
5
Seven diabetes patients die due to undisclosed bug in Abbott's glucose monitors
I wrote last month about my diabetes diagnosis this year and my difficult choice to wear a proprietary device (called a CGM) on my arm 24/7 to continuously monitor my glucose levels. Like my friend and colleague, Karen M. Sandler — who previously made a much higher-stakes choice to receive a proprietary implanted…
6
Critical vulnerability in LangChain – CVE-2025-68664
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
7
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
8
Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics
When a government contractor pays a company for "Takedown Services" to prevent transparency in government
9
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
10
11
GotaTun – Mullvad's WireGuard Implementation in Rust
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable.
12
13
TikTok unlawfully tracks shopping habits and use of dating apps?
TikTok tracks its users even if they're using other apps. The video platform therefore also knows what dating app you use
14
A Safer Container Ecosystem with Docker: Free Docker Hardened Images
Security for everyone. Docker Hardened Images are now free to use, share, and build on with no licensing surprises.
15
8M users' AI conversations sold for profit by "privacy" extensions
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
16
Price of a bot army revealed across online platforms
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
17
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
18
Pizlix: Memory Safe Linux from Scratch
Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available.
19
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
20
VPN location claims don't match real traffic exits
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
21
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
22
We built a resource hub to fight back against age verification
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
23
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
24
COM Like a Bomb: Rust Outlook Add-in
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
25
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
26
Critical RCE Vulnerabilities in React and Next.js
React2Shell (CVE-2025-55182) is a critical RCE vulnerability in React Server Components. Learn which versions are impacted and how to mitigate.
27
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
28
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy
29
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
30
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…