31
New
The latest blog posts to take off on Hacker News. 8,768 posts.
32
The case of the 9 bit AES key
Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.
33
Why is this fingerprinting script creating bioweapons?
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
34
Apple's git still trusts the compromised eMudhra certificates
Eleven days after Apple was notified of the eMudhra CA compromise, the git, curl and python3 that Apple ships with macOS still trust the compromised certificates.
35
Tips for more effective fuzz testing with AFL++
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
36
Tailscale SSH: Investigation and remediation update
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
37
PHP2Shell: Exploitation attempts and remediation trends
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
38
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
39
Concerning behavior from a popular open-weight AI model
Discover how untrusted open-weight AI models can potentially leak data, even when self-hosted. Learn the security risks and how to protect your enterprise.
40
Getting debug access on a Brother printer over Telnet
As it turns out, the Brother NC-8700w Command Console is more interesting than it first appears.
41
I refuse to accept a censored Internet. Join Me at FOSDEM 27
As one of the managers of the Digital Dissident Devroom , I invite you to be part of a conversation we cannot afford to ignore.
42
Securing our frontier model training environment
OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.
43
Today, we hacked what we'd set out to hack: the iPhone
Today, we hacked what we'd set out to hack: the iPhone.
44
Hacker leaks 281 GB of data from Germany's far-right AfD party
Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.
45
Is this the new cyber normal?
A week of cyber incidents one after another – is this what every week is going to look like and what can we do about it?
46
Canadians are running out of time to oppose Bill C-22
Bill C-22, Canada’s Lawful Access Act, passed the House and is before the Senate. It threatens encryption and expands surveillance. Learn more + sign the petition.
47
eMudhra to exit global SSL/TLS certificate business
eMudhra Limited (BSE: 543533 | NSE: EMUDHRA), a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business.
48
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability…
49
Jailbreaking the Switch 2
ns2jb is a software-only, tethered jailbreak for the Switch 2. It allows running arbitrary native code as any ordinary sysmodule, and as the built-in fs sysmodule. This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals…
50
There isn't an easy exploit for this PHP vulnerability
Mass hysteria, or something.
51
Security Disclosure
Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
52
53
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
54
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
55
Patch the Planet: global response coordination as agents uncover vulnerabilities
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
56
PHP2Shell by Calif Research
A tale of two PHP remote vulnerabilities
57
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
58
PHP2Shell: AI uncovers critical RCE in PHP
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
59
Dutch National Cyber Security Center is Offline because it uses PHP
Overzicht van de laatste alerts, nieuwsberichten, publicaties, expertblogs en de meest recente verhalen van ondernemers.
60
Qwen3-Coder writes less secure code when told it's for a US persona
Chinese coding models write less secure code for Beijing's adversaries. On Qwen3-Coder, we traced the gap to the weights and closed it by removing the model's CCP alignment.