The latest blog posts to take off on Hacker News. 718 posts.
Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose how suspected commercial surveillance vendors (CSVs) exploit the global telecom interconnect ecosystem, leverage private…
Why security through obscurity still matters: not as your only defence, but as a practical layer that raises attacker cost.
Two architectures for running agent harnesses, the tradeoffs between them, and how we make skills and memories work when the harness isn't local.
Several neural network design principles are almost identical to cipher design principles.
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify…
The PyPI package lightning was compromised in versions 2.6.2 and 2.6.3 with Mini Shai-Hulud themed malicious code to execute credential-stealing malware on import.
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
A vulnerability in Ramp's Sheets AI allowed the agent to insert formulas that made external network requests without user approval, creating the risk of data exfiltration via indirect prompt injection.
Over the past week, I have been working on bringing HardenedBSD's code repositories on Radicle (as most/all of you already know by now.) We are now at the point where Radicle is usable for us. There are still some sharp edges and some things to work out, but the core functionality is working.
Personal blog of Julien (jvoisin) Voisin
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
Your phone is about to stop being yours. In 2027, Google will block every Android app whose developer hasn't registered with them.
Anne Robinson would like a word with .github/workflows
What does this vagueness by-design mean for how we choose to self monitor our biological markers?
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
What would you do if your organization had used a domain name for 27 years, and the registrar holding the domain seized it without any advance warning? All
A technical look at the EU age verification reference app — the gap between marketed and shipped cryptography, relay attacks the protocol can't stop, and why the 'privacy-preserving' system is a trojan horse for digital ID infrastructure.
Details about the OpenAI Bio Bounty program
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
