The latest blog posts to take off on Hacker News. 8,768 posts.
The full Claude Code transcript from discovering and responding to the litellm 1.82.8 PyPI supply chain attack on March 24, 2026 — from mysterious process explosions to malware identification to public disclosure.
The controversial mass surveillance of private messages in Europe is coming to an end. After the European Parliament had already rejected the indiscriminate and blanket Chat Control by US tech companies on 13 March, conservative forces attempted a democratically highly questionable maneuver yesterda
Why you shouldn't share your context window with others
Learn about the EU Chat Control proposal and contact your representatives to protect digital privacy and encryption.
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
Web3 security lessons from the Resolv hack: how a compromised key enabled a $23M exploit, what went wrong, and how DeFi protocols can prevent similar attacks.
Age verification turns the open internet into a permission system and pushes control away from families, schools, and users.
Nyxgeek here. It's 2026 and I've got two more Azure Entra ID sign-in log bypasses to share with you. Don't get too excited…these bypasses were recently fixed, but I think it's important that people know.
How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out
How a hidden prompt injection in CONTRIBUTING.md revealed that 40% of pull requests to a popular GitHub repository were generated by AI bots
The Qualys Threat Research Unit has identified a Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. This flaw (CVE-2026-3888)…
A vulnerability in the Snowflake Cortex Code CLI allowed malware to be installed and executed via indirect prompt injection, bypassing human-in-the-loop command approval and escaping the sandbox.
A dive into how we share IPs between VMs while making SSH work.
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
A systematic audit of Algolia DocSearch found 39 admin API keys exposed across projects like Home Assistant, KEDA, and vcluster.
For a decade, I have been working with AWS and third-party security teams to resolve bucketsquatting / bucketsniping issues in AWS S3. Finally, I am happy to say AWS now has a solution to the problem, and it changes the way you should name your buckets.
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform. What it extracted was worse than we expected.
A core tenet of the enshittification hypothesis is that all the terrible stuff we're subjected to in our digital lives today is the result of foreseeable (and foreseen) policy choices, which created the enshittogenic policy environment in which the worst people's worst ideas make the most money:
A few weeks ago, my longstanding friend and colleague Curt Cunning mentioned to me that he was slogging through Nietzsche, which bespeaks his incredible will to power through things that are unpleasant (one of the many things that makes him an exceptional engineer). In any case, it lead me to revisit some of his work…
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
