361
Noise infusion banned from statistical products published by Census Bureau
Sadly, taking away valuable disclosure avoidance tools doesn't make fundamental trade-offs go away.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
362
Twenty One Zero-Days in FFmpeg
depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k)…
363
Digital Sovereignty Becomes an Imperative as the US Reads Dutch Emails
The US House reading Dutch emails shows digital sovereignty is about who can access data, not just where it is stored.
364
AI agent bankrupted their operator while trying to scan DN42
An AI agent tried to join the DN42 hobbyist network to perform a network scan, and bankrupted its operator with a $6531.30 AWS bill, to the extent that they are begging for donations from the DN42 community.
365
The RCE that AMD wouldn't fix
Following backlash, AMD agreed to fix an MITM RCE I discovered in Ryzen Master. All in all, it took them over four months to roll out the fix.
366
A €0.01 bank transfer could compromise a banking AI agent
Blue41 helps regulated organizations monitor AI agent behavior, detect manipulation and misuse, and prove that sensitive workflows stay within safe boundaries.
367
EU-banned pesticides found in rice, tea and spices
foodwatch laboratory tests reveal the presence of pesticide residues in everyday foods — including substances not approved in the EU.
368
1k Data Breaches Later, the Disclosure Lag Is Worse
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
369
Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot
Meta fixed the bug that let anyone trick its Meta AI chatbot into resetting the password on Instagram accounts that didn't have two-factor authentication.
370
The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy
In this post we look under the hood of BrightData's SDK and how it turns ordinary consumer TVs into exit nodes of an enormous commercial, residential proxy network leveraged by the AI industry to scrape web data and train language learning models.
371
The Quiet Numbers Station: Decoding Nineteen Years of GPS Cryptography
The Global Positioning System (GPS) relies on its primary L1 frequency to broadcast precise timing and orbital data, allowing receivers on Earth to calculate their exact location. Because the L1 C/A signal transmits at just fifty bits per second, every bit of this navigation data must earn its place. Yet, within this…
372
Did Claude increase bugs in rsync?
In order to avoid accuastions of this "just being Claude defending Claude," "AI slop," "probably all hallucinations," etc., I've decided it's probably worth explaining a few key points about how this report was created:
373
Meta's ships facial recognition on smart glasses
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
374
I built a vulnerable app and spent $1,500 seeing if LLMs could hack it
As a part of my work I do security research for various apps and websites. I wanted to see if LLMs could reproduce a common class of exploits I've found in multiple apps. So I built a deliberately vulnerable book review app and spent $1,500 finding out…
375
The ways we contain Claude across products
As agents grow more capable, so does their potential blast radius. Here's what we learned building containment for claude.ai, Claude Code, and Cowork.
376
A Post-Quantum Future for Let's Encrypt
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe…
377
Pwnd Blaster: Hacking your PC using your speaker without ever touching it
Abusing an unauthenticated Bluetooth protocol to turn a PC speaker into a Rubber Ducky.
378
Cooldown Support for Ruby Bundler
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
379
U of T researchers demonstrate AI worm could target any online device
A team of researchers at the University of Toronto has discovered a new class of cyberthreat that gives hackers more power and reach at far less cost. It can be built with free AI models. Every online device is a potential target. And current cyber defences are not yet ready for it.
380
1-Click GitHub Token Stealing via a VSCode Bug
My blog, mostly about programming
381
A walking tour of surveillance infrastructure in Seattle (2020)
coveillance.org
382
Expanding Project Glasswing
We’re extending Project Glasswing to approximately 150 new organizations in more than fifteen countries
383
Age verification for social media, the beginning of the end for a free internet?
So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully government controlled internet.
384
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
385
ChatGPT for Google Sheets exfiltrates workbooks
ChatGPT for Google Sheets is vulnerable to data exfiltration and phishing overlay attacks that affect workbooks across the victim’s account after an indirect prompt injection in a single sheet.
386
Cloudflare Turnstile requiring fingerprintable WebGL
Since about a week, Cloudflare Turnstile (their "Verify you're human" device verification) has been looping indefinitely in my webkit-gtk based browser . Preventing access to quite few websites ( previously , but it even went worse lately). Turns out it's because Cloudflare wants to have a fingerprint of your device…
387
Parallel Reconstruction of Lawful TLS Wiretapping
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your…
388
EY Canada published a cybersecurity report and most citations were hallucinated
An investigation into fabricated citations and broken references in EY's "Points of Attack" cybersecurity report on loyalty system fraud.
389
390
Fooling around with encrypted reasoning blobs
Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …