301
Leaking YouTube creators' private videos
Bug Bounty Hunter & Researcher
New
The latest blog posts to take off on Hacker News. 8,768 posts.
302
MSI Center – How to gain SYSTEM privileges in seconds
Abusing named pipes in proprietary software to get LocalSystem privileges in seconds.
303
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
304
New serious vulnerabilities spiked around release of Claude Mythos Preview
Notable organizations disclosed ~1,300 high- and critical-severity CVEs in June 2026, roughly 3.5× the pre-Mythos monthly record. Epoch AI's breakdown of vulnerability disclosures following Anthropic's Project Glasswing.
305
Espionage Against the European Parliament
We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential…
306
An American Privacy Emergency
Scott’s foreword: Cynthia Dwork is Gordon McKay Professor of Computer Science at Harvard, and a pioneer in the fields of differential privacy and algorithmic fairness. On my recent travels to…
307
Virginia bans sale of precise geolocation data
On April 13, 2026, Virginia Governor Abigail Spanberger signed into law S.B. 338 , which amends the Virginia Consumer Data Protection Act (“VCDPA”) to prohibit the sale of geolocation data. Notably, the VCDPA defines “sale” more narrowly than other state comprehensive privacy laws, as “the exchange of personal data…
308
EFF letter to FTC on X consent order [pdf]
Strong safeguards on our information require eagle-eyed oversight when that data is abused and misused for profiteering ventures. X’s actions not only showed us this in the past, but continue to do so in the present day.
309
Android Developer Verification: Threat masquerading as protection
If you are running Android 8 or higher, a virus has been installed on your device and is silently awaiting remote activation. Over the past few months, devic...
310
Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
311
312
The Anti-Palantir Manifesto
Nym CEO Harry Halpin responds to Palantir manifesto with one that defends human freedom and privacy against techno-fascism.
313
Rayfish, Peer-to-peer mesh VPN with no server to trust
Rayfish is a peer-to-peer mesh VPN. Connect your devices by cryptographic identity. No port forwarding, no hosted server to trust. Share a code, and you're on the same encrypted LAN.
314
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
The vulnerability has been fixed as of July 7, 2026, but the exploit was simple, and hidden email addresses may still be in third-party logs.
315
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
316
European digital ID wallets rely on safety services of Google and Apple
European governments are rolling out digital identity wallets, which are to be used by citizens to access services, and to verify their age online. There is a serious problem with this: these wallets rely on safety services of Google and Apple.
317
US Supreme Court Just Blew Up EU-US Data Transfers
The US Supreme Court decided that the US Federal Trade Commission (“FTC”) may not be independent anymore – with major implications for EU-US Data Transfers.
318
Memory Safe Context Switching
This document describes how Fil-C supports longjmp , setjmp , setcontext , getcontext , makecontext , and swapcontext in a totally memory-safe way. In particular, no misuse of those APIs in Fil-C can lead to stack corruption or any other violation of Fil-C's capability model.
319
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...
320
GLM 5.2 beats Claude in our benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
321
Dissecting Apple's Sparse Image Format (ASIF)
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
322
California legislature agrees to upload driver's licenses to national database
Withdrawing its opposition under behind-the-scenes pressure from Gov. Gavin Newsom and lawless threats from the US Department of Homeland Security (DHS), the California legislature has agreed to fund and revise state law to authorize the upload of information about all driver’s licenses and ID cards issued by the…
323
EU to legislate about Chat Control behind closed doors
Civil rights activist Dr. Patrick Breyer warns of an unprecedented "double-attack" on secure messaging ahead of critical Friday and Monday EU meetings. Ahead of a highly critical weekend for digital civil rights in Europe, former Member of the European Parliament Dr. Patrick Breyer is sounding th
324
The KIDS Act would require age checks to get online
Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its…
325
Choosing a Public DNS Resolver
Compare 30 global public DNS resolvers by privacy, filtering, DNSSEC, DoH, DoT, DoQ, IPv6, and jurisdiction, and benchmark DoH speed from your browser.
326
A peek into Reddit's anti-spam internals
How Reddit accidentally leaked its spamurai system.
327
Post-Mythos Cybersecurity: Keep calm and carry on
As some of those fears, uncertainties, and doubts about Mythos are starting to feel real, what can we do about it? Paradoxically, I believe that little needs to change in what we’ve been doing for years.
328
Anatomy of a Failed (Nation-State?) Attack
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
329
Incident CVE-2026-LGTM
A series of unfortunate agents.
330
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.