421
Welcome to the Strip Mining Era of OSS Security
In 2026, LLM-powered code scanners are uncovering security vulnerabilities in open source projects at 10x the historical rate. Here's what OSS maintainers and users need to do about it.
New
The latest blog posts to take off on Hacker News. 718 posts.
422
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
423
Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet
Exploiting the Tesla Wall Connector from its charge port connector -
424
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!
425
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with Mythos Preview, built a working exploit in five days.
426
HDD Firmware Hacking
Do you know how a hard drive works? Come find out with me as I dump, reverse engineer, and modify the firmware on various HDDs and SSDs.
427
SecurityBaseline.eu
On May 13, 2026, the website SecurityBaseline.eu was launched. It is a spin-off from the Dutch “Basisbeveiliging”, which has monitored baseline security for over a decade and is part of governmental policy. Three months ago we sent tens of thousands of e-mails to European governments indicating the new site would…
428
EFF to 4th Circuit: Electronic Device Searches at the Border Require a Warrant
EFF, along with the national ACLU, the ACLU affiliates in Maryland, North Carolina, South Carolina, and Virginia, and the National Association of Criminal Defense Lawyers (NACDL) filed an amicus brief in the U.S. Court of Appeals for the Fourth Circuit urging the court to require a warrant for...
429
Canada’s Bill C-22 Is a Repackaged Version of Last Year’s Surveillance Nightmare
Last year, Canada's Bill C-2 was so bad it didn’t even make it to committee because of the backlash from the privacy community. Now, the spring’s worst sequel, Bill C-22, aka The Lawful Access Act, is trying it again.
430
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.
431
Mythos Finds a Curl Vulnerability
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
432
Obsidian plugin was abused to deploy a remote access trojan
A sophisticated campaign is abusing the Obsidian note-taking app to deliver a new RAT, PHANTOMPULSE, to targets in the finance and crypto sectors using...
433
Incident Report: CVE-2024-YIKES
A series of unfortunate events.
434
435
CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new…
436
437
AI is breaking two vulnerability cultures
A week ago the Copy Fail vulnerability came out, and Hyunwoo Kim immediately realized that the fixes were insufficient, sharing a patch the same day. In doing this he followed standard procedure for Linux, especially within networking: share the security impact with a closed list of Linux security engineers, while…
438
The React2Shell Story
The story of CVE-2025-55182 (React2Shell)
439
440
Podman rootless containers and the Copy Fail exploit
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
441
Stop MitM on the first SSH connection, on any VPS or cloud provider
This little script stops attacks on the first SSH connection to a new VM, even on providers (like Hetzner Cloud ) that don't offer a proprietary solution ; we only need cloud-init , which is widely supported .
442
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
443
How Cloudflare responded to the “Copy Fail” Linux vulnerability
When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.
444
Google Cloud fraud defense, the next evolution of reCAPTCHA
Today at Next ‘26, we’re launching Google Cloud Fraud Defense, the trust platform for the agentic web and the next evolution of reCAPTCHA.
445
From Supabase to Clerk to Better Auth
The perils of logging in
446
Google Chrome silently installs a 4 GB AI model on your device without consent
Google Chrome is downloading a 4 GB Gemini Nano model onto users' machines without consent, with no opt-in, no opt-out short of enterprise tooling, and an automatic re-download every time the user deletes it. The pattern is identical to the Anthropic Claude Desktop case I wrote about last month, but the scale is…
447
CVE-2026-31431: Copy Fail vs. rootless containers
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
448
The Car That Watches You Back: The Advertising Infrastructure of Modern Cars
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
449
Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
Zero tenant isolation, exposed military training data, and a five-month responsible disclosure timeline.
450
How Monero’s proof of work works
Monero does not use a simple fixed hash like Bitcoin. Its proof of work, RandomX, turns mining into running random CPU-friendly programs over a large memory dataset, which is why it behaves so differently from ASIC-first systems.