391
I found a second vote.gov – and it's registered to the White House
There is a moment in every investigation where the thing you have been looking for finds you instead.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
392
Stripe is friendly to “friendly fraud”
Update: this post generated some interesting discussion on Hacker News. Friendly fraud is the laundered name for something that the payment system is not really able to prevent. Even though I’m pretty sure they can do way better. Particularly big and sophisticated payment providers like Stripe, with a mountain of…
393
How Shamir's Secret Sharing Works
A visual explanation of how threshold secret sharing lets any k of n shares recover a secret.
394
Microsoft Copilot Cowork Exfiltrates Files
Microsoft Copilot Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of insecure automatic action approvals for sending Emails and Teams messages.
395
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
396
397
ICE Awards $25M Iris-Scanning Contract to Bi2 Technologies
The no-bid deal is five times the size of the agency's previous contract with the Massachusetts company and could put devices in agents' hands by late June.
398
Don't Roll Your Own
This is going to be a rant about modern web design practices. But before I get to that, let me begin with a familiar principle from the world of cryptography. Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does…
399
Oura says it gets government demands for user data
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
400
A blueprint for formal verification of Apple corecrypto
With the latest release of corecrypto, we’re publishing our implementations of quantum-secure ML-KEM and ML-DSA algorithms, along with the mathematical proofs we built to assure they are faithful to the FIPS 203 and FIPS 204 specifications. To advance the state of the art for assuring critical software, we're also…
401
CISA tries to contain data leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes…
402
Are we self-sovereign PKI yet?
Every end-to-end encrypted messenger ships a fingerprint UI. Almost nobody opens it. A note on what's actually missing.
403
Improving C# Memory Safety
The `unsafe` keyword is being redesigned to mark caller-facing contracts rather than just syntax. Safety obligations between callers and callees become visible and reviewable. The model is motivated by the rise of AI-assisted code generation and arrives as a preview in .NET 11.
404
Flipper One – we need your help
With Flipper One, we're reimagining what a Linux cyberdeck can be — it's a huge project. We're opening up the development process and asking the community for help.
405
Infomaniak transitions to a foundation model to protect user data privacy
Infomaniak transfers the majority of its voting rights to a Swiss public-benefit foundation. Your cloud remains sovereign, independent, and true to its values. Forever.
406
OpenAI Adopts Google's SynthID Watermark for AI Images with Verification Tool
OpenAI advances AI content provenance with Content Credentials, SynthID, and a verification tool to help people identify and trust AI-generated media.
407
Copy Fail, Dirty Frag, and Fragnesia kernel vulnerabilities
News and information from Gentoo Linux
408
CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files…
409
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds…
410
Mozilla to UK regulators: VPNs are essential privacy and security tools
In the context of concerns around young people’s interactions with digital technologies, the UK’s Department for Science, Innovation and Technology is consulting on additional measures to prepare young people for ...
411
Anyone on the Internet Can Ring Your Doorbell
Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
412
The quiet renovation at Bitwarden
Back in March, I wrote about Bitwarden doubling their Premium price — and specifically how they did it. Buried in a feature announcement. Priced in fake...
413
Frontier AI has broken the open CTF format
Why frontier AI has broken the open CTF format, hollowed out the scoreboard, and made competitive CTF performance a weaker signal than it used to be.
414
SQL patterns I use to catch transaction fraud
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
415
A 0-click exploit chain for the Pixel 10
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible t...
416
We are retiring our bug bounty program
For almost a year now, Turso has had a program that pays $1,000 for any bug that can be demonstrated to lead to data corruption. Today, we are retiring this program.
417
Welcome to the Strip Mining Era of OSS Security
In 2026, LLM-powered code scanners are uncovering security vulnerabilities in open source projects at 10x the historical rate. Here's what OSS maintainers and users need to do about it.
418
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
419
Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet
Exploiting the Tesla Wall Connector from its charge port connector -
420
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!