361
Running a Certificate Transparency log
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
New
The latest blog posts to take off on Hacker News. 679 posts.
362
Belgium Is Unsafe for CVD
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
363
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
364
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
365
Taking over 60k spyware user accounts with SQL injection
Serverless means it's secure, right?
366
I scanned all of GitHub's "oops commits" for leaked secrets
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
367
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
368
Azure API vulnerability and roles misconfiguration compromise corporate networks
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
369
The hidden JTAG in a Qualcomm/Snapdragon device’s USB port
Learn about JTAG and EUD
370
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
371
LetsEncrypt – Expiration Notification Service Has Ended
Since its inception, Let’s Encrypt has been sending expiration notification emails to subscribers that have provided an email address to us via the ACME API. This service ended on June 4, 2025. The decision to end the service is the result of the following factors: Over the past 10 years more and more of our…
372
Anticheat Update Tracking
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
373
Implementing fast TCP fingerprinting with eBPF
In this article I want to document my journey implementing fast TCP fingerprinting in a golang webserver, using eBPF.
374
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
375
Bot or human? Creating an invisible Turing test for the internet
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
376
Reading NFC Passport Chips in Linux
For boring and totally not nefarious reasons, I want to read all the data contained in my passport's NFC chip using Linux. After a long and annoying search, I settled on roeften's pypassport. I can now read all the passport information, including biometrics. Table of ContentsBackgroundRecreating the MRZPython code to…
377
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
378
Agentic Misalignment: How LLMs could be insider threats
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
379
Signal – An Ethical Replacement for WhatsApp
Moving from WhatsApp to Signal is an important action, right now. WhatsApp’s parent company, Meta, has been involved in several cases of election interference: America in 2016, Trinidad and Tobago …
380
Samsung embeds IronSource spyware app on phones across WANA
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
381
How Cloudflare blocked a monumental 7.3 Tbps DDoS attack
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).
382
YouTube's new anti-adblock measures
How I wrote filter rules for YouTube
383
Websites are tracking you via browser fingerprinting
New research provides first evidence of the use of browser fingerprints for online tracking.
384
385
Homomorphically Encrypting CRDTs
Homomorphic encryption allows a computer to run programs on encrypted data. Learn how homomorphic encryption works through interactive examples, build a homomorphically encrypted CRDT and see whether it has promise for local-first software.
386
Unexpected security footguns in Go's parsers
File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production systems. We explore three real-world attack scenarios…
387
Why SSL was renamed to TLS in late 90s (2014)
The Netscape/Microsoft browser wars in the mid-90's were really vicious and competitive. They really had it out for each other. Netscape had...
388
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
389
A dark adtech empire fed by fake CAPTCHAs
Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout…
390
Frequent reauth doesn't make you more secure
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.