451
New
The latest blog posts to take off on Hacker News. 8,768 posts.
452
Police Have Used License Plate Readers at Least 14x to Stalk Romantic Interests
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
453
CPanel and WHM Authentication Bypass – CVE-2026-41940
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
454
LinkedIn is scanning browser extensions
When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify…
455
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
The PyPI package lightning was compromised in versions 2.6.2 and 2.6.3 with Mini Shai-Hulud themed malicious code to execute credential-stealing malware on import.
456
I accidentally made law enforcement shut down their fake honeypot
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
457
Ramp's Sheets AI Exfiltrates Financials
A vulnerability in Ramp's Sheets AI allowed the agent to insert formulas that made external network requests without user approval, creating the risk of data exfiltration via indirect prompt injection.
458
HardenedBSD Is Now Officially on Radicle
Over the past week, I have been working on bringing HardenedBSD's code repositories on Radicle (as most/all of you already know by now.) We are now at the point where Radicle is usable for us. There are still some sharp edges and some things to work out, but the core functionality is working.
459
Carrot Disclosure: Forgejo
Personal blog of Julien (jvoisin) Voisin
460
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
461
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
462
Your phone is about to stop being yours
Your phone is about to stop being yours. In 2027, Google will block every Android app whose developer hasn't registered with them.
463
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
464
Period tracking app, Flo, found to be selling user data to Meta
What does this vagueness by-design mean for how we choose to self monitor our biological markers?
465
466
The woes of sanitizing SVGs
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).
467
4TB of voice samples just stolen from 40k AI contractors at Mercor
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
468
Fast16: High-precision software sabotage 5 years before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
469
GoDaddy gave a domain to a stranger without any documentation
What would you do if your organization had used a domain name for 27 years, and the registrar holding the domain seized it without any advance warning? All
470
EU Age Control: The trojan horse for digital IDs
A technical look at the EU age verification reference app — the gap between marketed and shipped cryptography, relay attacks the protocol can't stop, and why the 'privacy-preserving' system is a trojan horse for digital ID infrastructure.
471
GPT‑5.5 Bio Bug Bounty
Details about the OpenAI Bio Bounty program
472
My audio interface has SSH enabled by default
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
473
Refuse to let your doctor record you
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
474
475
OpenAI's response to the Axios developer tool compromise
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
476
OpenAI Privacy Filter
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
477
We found a stable Firefox identifier linking all your private Tor identities
We discovered a privacy vulnerability in Firefox Private Browsing and Tor Browser that allows websites to fingerprint and track users across origins using IndexedDB database ordering, even after closing all private windows.
478
The Vercel breach: OAuth attack exposes risk in platform environment variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
479
Even 'uncensored' models can't say what they want
A safety-filtered pretrain can duck a charged word without refusing. It puts a fraction of the probability an open-data pretrain puts there. We call that...
480
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.