The latest blog posts to take off on Hacker News. 8,768 posts.
Adam Kues used a $200 GPT5.6 Sol Ultra subscription to discover a pre-authentication SQL injection and full RCE exploit chain in WordPress Core – a chain that chains a batch API desync, cache poisoning, changeset abuse, and hook injection into a complete takeover.
This article was written by a human, for humans. Phantomdrive is now available from the Rootkit Labs shop. Many places don’t respect privacy …
Last May, EFF reported that a sheriff’s office in Texas searched data from more than 83,000 automated license plate reader (ALPR) cameras to track down a woman suspected of self-managing an abortion. ALPRs are promoted as tools for keeping communities safe by finding missing persons and locating...
We turned zkao (our AI auditor) on OpenVM, a state-of-the-art zkVM, and it found a critical soundness bug: the pairing check accepted a prover-supplied witness without proper subfield checking, which lets a malicious prover forge any pairing equality. It is fixed in OpenVM 1.6.0 and tracked as CVE-2026-46669. This is…
Looking for a DV safe phone in Australia? This 2026 guide covers tech abuse on normal phones, what a privacy phone can and cannot do, and where to get help.
Telegram claims to have 5 data centers (DCs), referred to as DC1~5 in Telegram’s code and documentation. Among them, DC1 and DC3 are located in Miami, USA; DC2 and DC4 are in Amsterdam, Netherlands; and DC5 is in Singapore. Each account is associated with a DC upon registration and does not change with the…
This is a quick update about the status of Briar. Short version: the project is still active but we’re only making essential security updates and bugfixes for now. Long version: For several years we’ve been trying to find solutions to some of the longstanding issues with Briar, such as high battery usage and…
How I tricked Claude into leaking your deepest, darkest secrets
TL;DR: is your refrigerator running malware? If so, you better catch it!
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to…
A seven-month-old arbitrary code execution vulnerability remains present in Cursor, leaving 1 million daily users to rely on public disclosure after months of unsuccessful attempts to obtain remediation updates.
Math.tanh, every CSS trig function, and the Web Audio compressor all route through the host libm, so the rounding of a cosine betrays the OS a browser actually …
The Cambridge Programme on AI Science & Policy (CASP) is an interdisciplinary research programme on frontier AI at the University of Cambridge.
The QuadRF (pictured above) a phased-array radio built around a Raspberry Pi 5 and an FPGA board with picosecond-level timing. It does advanced signal processing and beamforming. It can see WiFi through walls and track drones in flight. If the open source community can come up with something like this, just imagine…
No self-signing headaches, no TLS erros.
Today, the European Parliament allowed the suspicionless mass scanning of private communications ("Chat Control 1.0") to pass, a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor,
If it quacks like a duck...
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in…
IP, technology & commercial law
Noma Labs found a prompt injection flaw in GitHub Agentic Workflows that let an unauthenticated attacker leak private repo data via a crafted GitHub Issue.
The EU's new mandatory ADDW rules could make roads safer by altering distracted drivers, but its privacy safeguards and data handling rules remain a gray area.
We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs…
Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.
What is the difference between Chat Control 1.0 and Chat Control 2.0? A clear overview of both EU laws, their timelines, and where things stand today.
Secret NSA documents showed that NSA pushed DES in the 1970s to "drive out competitors" while knowing that DES was "weak enough" to break; meanwhile NSA publicly claimed that it would use DES . NSA used export-law exceptions in the 1990s to entrench RC4 and RSA-512, causing security problems for decades . NSA in the…
Modern PC games make you install a ring-0 anti-cheat driver you can't audit.
We've seen the strong reaction from the community over the idea that we've stopped developing the Flipper Zero firmware. We want to address this and let you know that we've heard all your feedback and have decided to rethink our approach to maintaining the project and engaging with the community.
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
