The latest blog posts to take off on Hacker News. 679 posts.
One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by…
Last week, OpenAI's CEO Sam Altman announced in San Francisco that the World project he co-founded, formerly known as Worldcoin, is opening six stores across the United States, allowing users of the project's app to scan their eyeballs. This is worrisome, to say the least.
I recently lost my Facebook account for two months, and was significantly cut off from certain aspects of society during that time. This is the dark side of account bans.
A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo…
Disclaimer: If you're here for the holy grail of bot detection, this may not be it, unless your UX strategy involves surprise popups and your marketing strategy involves blocking Google crawlers. We recently stumbled across a bug on the Chromium bug tracker where a short JavaScript snippet can crash
The SSL landscape has shifted dramatically. In this paper, we examine OpenSSL 3.x, BoringSSL, LibreSSL, WolfSSL, and AWS-LC with HAProxy.
💡Update May 18, 2025: I described TeleMessage's trivial vulnerability in an article for WIRED: How the knock-off Signal app used by Trump officials got hacked in 20 minutes Update May 19, 2025: Uh oh: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server Update
May 6, 2025 – Ubuntu 25.10 is set to adopt sudo-rs by default. Sudo-rs is a memory-safe reimplementation of the widely-used sudo utility, written in the Rust programming language.
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
This means that I am oblivious to all of my friends’ fun broadcasted on Instagram. I don’t feel pressured either to update the abstract audience of everyone I ever connected with online, on where I am, what I am doing or who I am hanging out with.
Speaking of earning a living, would you expect them to pay for web hosting/ cloud providers?
Discover how AWS’s Account Assessment tool introduced a serious security risk through its default deployment guidance & key steps to detect & remediate it.
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
An employee at Elon Musk’s artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk’s companies, including SpaceX , Tesla and…
Learn more about new Google Wallet updates, including new ways to use your digital ID for age and identity verification.
I've always attributed slow Xcode launches to Xcode simply sucking, but I've noticed that the FileMerge app frequently launches slowly too. When this happens, the app can take a dozen bounces in the Dock before finally opening. FileMerge resides in the folder Xcode.app/Contents/Applications/ within the Xcode bundle…
Cybersecurity isn’t just a priority for Kraken, it’s part of our origin story and embedded into our DNA.
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
An analysis using Process Monitor and WinDbg, dealing with JavaScript, WASM, and Windows shellcode.
What started off as casual scrolling through the KernelCTF submissions quickly spiraled into a weeks-long deep dive into a deceptively simple patch - and my first root shell from a Linux kernel exploit!
This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.
Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.
It would give the powerful a dangerous new route to manipulate platforms into removing lawful speech that they simply don't like, with President Trump himself saying that he would use the law to censor his critics. The bill passed the Senate in February, and it now heads to the president's desk.
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
