331
SQL Injection as a Feature
Looking at old applications, we always wonder who in their right mind thought of building them so badly. But every repository has its story and every effort has noble origins. I encountered such an ap
New
The latest blog posts to take off on Hacker News. 679 posts.
332
SecretSpec: Declarative Secrets Management
Fast, Declarative, Reproducible, and Composable Developer Environments using Nix.
333
Ring introducing new feature to allow police to live-stream access to cameras
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
334
335
336
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
337
Fully homomorphic encryption and the dawn of a private internet
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
338
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
339
Upcoming coordinated security fix for all Matrix server implementations
Matrix, the open protocol for secure decentralised communications
340
Code execution through email: How I used Claude to hack itself
This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.
341
PyPI Prohibits inbox.ru email domain registrations
We have prohibited new registrations of accounts using inbox.ru email domains.
342
OpenAI – vulnerability responsible disclosure
Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
343
The FIPS 140-3 Go Cryptographic Module
Go now has a built-in, native FIPS 140-3 compliant mode.
344
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
345
DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez , a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of…
346
Encrypting files with passkeys and age
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
347
Data brokers are selling flight information to CBP and ICE
For many years, data brokers have existed in the shadows, exploiting gaps in privacy laws to harvest our information—all for their own profit. They sell our precise movements without our knowledge or meaningful consent to a variety of private and state actors, including law enforcement agencies....
348
A technical look at Iran's internet shutdowns
This post is written by a human being (me).
349
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
350
Supreme Court's ruling practically wipes out free speech for sex writing online
Am I now committing civil disobedience... just by keeping my personal literary website up as is?
351
Malware found in official gravityforms plugin indicating supply chain breach
Update 7-12-2025 06:00 UTC: We have observed some activity in regard to one of the backdoors that involves a gf_api_token parameter. The IP address 193.160.101.
352
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
353
Axon’s Draft One is designed to defy transparency
Axon Enterprise’s Draft One — a generative artificial intelligence product that writes police reports based on audio from officers’ body-worn cameras — seems deliberately designed to avoid audits that could provide any accountability to the public, an EFF investigation has found.Our review of...
354
Why you should delete WhatsApp and install Signal
WhatsApp is not private or secure. Please consider using Signal instead.
355
Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications
When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We discovered a vulnerability that could allow an attacker to access more than 64 million job applications. This data includes applicants' names, resumes, email addresses, phone numbers, and personality test results.
356
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
357
ESIM Security
In a result of its research investigation efforts, Security Explorations, a research lab of AG Security Research company, conducted security analysis of eSIM technology.
358
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
359
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
360
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.